我的虛擬機器感染了一些加密貨幣挖礦惡意軟體。我可以殺死它，但它顯然會在每次啟動時重新啟動。我嘗試找到可執行文件，但無法找到它；進程路徑（來自htop、ls -l、lsof -p、 等）不存在。這怎麼可能？ 我如何找到可執行檔並將其刪除？
這裡有一些輸出來證明我所說的話。
root@mediaserver:/home/tech# ls -l /proc/3648/exe
lrwxrwxrwx 1 media media 0 juin 23 00:48 /proc/3648/exe -> /config/c3pool/xmrig
root@mediaserver:/home/tech# readlink /proc/3648/exe
/config/c3pool/xmrig
root@mediaserver:/home/tech# lsof -p 3648
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
xmrig 3648 media cwd DIR 0,82 4096 20054344 /
xmrig 3648 media rtd DIR 0,82 4096 20054344 /
xmrig 3648 media txt REG 254,2 2364488 22675798 /config/c3pool/xmrig
xmrig 3648 media mem REG 254,2 13503512 /usr/share/zoneinfo/Europe/Paris (path inode=31594143)
xmrig 3648 media 0r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 1w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 2w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 3r CHR 1,9 0t0 101097 /dev/urandom
xmrig 3648 media 4u a_inode 0,13 0 10340 [eventpoll]
xmrig 3648 media 5r FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 6w FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 7r FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 8w FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 9u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 10w REG 254,2 87499703 22675799 /config/c3pool/xmrig.log
xmrig 3648 media 11u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 12u sock 0,9 0t0 231410 protocol: UNIX
xmrig 3648 media 13u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 14r a_inode 0,13 0 10340 inotify
xmrig 3648 media 15r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 16u sock 0,9 0t0 243829 protocol: TCP
root@mediaserver:/home/tech# cd /config
bash: cd: /config: Aucun fichier ou dossier de ce type
編輯：在幫助下https://askubuntu.com/questions/1005437/greping-all-files-for-a-string-takes-a-long-time我設法找到了根源。他在多個地方安裝了惡意軟體，當他運行它時，他檢查這裡是否已經存在進程。我會讓 grep 完成並刪除它的所有副本。但我仍然想知道腳本是如何執行的......有人有想法嗎？以下是一些日誌，以便更好地了解情況：
root@mediaserver:/home/tech# sudo time grep -rnw --exclude-dir={boot,dev,lib,media,mnt,proc,root,run,sys,/tmp,tmpfs,var,/shares} '/' -e 'xmrig'
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config.json:63: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config_background.json:90: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config.json:65: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config_background.json:112: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:8: echo "如果要先删除后台矿工，请运行 \"killall xmrig\" 或 \"sudo killall xmrig\"."
media@mediaserver:~$ ls -al /appdata/config/code-server/c3pool/
total 87800
drwxr-xr-x 2 media media 4096 déc. 31 2020 .
drwxr-xr-x 12 media media 4096 janv. 6 12:38 ..
-rw-r--r-- 1 media media 4172 déc. 31 2020 config_background.json
-rw-r--r-- 1 media media 2441 déc. 31 2020 config.json
-rwxr-xr-x 1 media media 277 déc. 31 2020 miner.sh
-rwxr-xr-x 1 media media 2364488 déc. 23 2020 xmrig
-rw-r--r-- 1 media media 87510988 juin 23 02:46 xmrig.log
media@mediaserver:~$ cat /appdata/config/code-server/c3pool/miner.sh
#!/bin/bash
if ! pidof xmrig >/dev/null; then
nice /config/c3pool/xmrig $*
else
echo "Monero miner is already running in the background. Refusing to run another one."
echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
fi