Shulou(Shulou.com)06/03 Report--

The production machine is implanted into the kdevtmpfsi mining program to deal with the process.

1. The mobile phone nail received an alarm message saying that one of Aliyun's machines was overloaded.

2. According to the alarm information, we log on to this machine and use the uptime command to check the machine load.

! []

Then the CPU of this machine is 8 cores, so it can be judged that the CPU load is indeed high.

3. At this time, use the command mpstat to check whether it is due to high load caused by CPU or disk.

We can see that CPU utilization is basically 100% per core.

4, and then we use the command pidstat to see which process takes up so much CPU

From this, we can see that the process with a PID of 28245 takes up a lot of our CPU. This process looks very strange and is not our own program, so we went to Baidu to download this.

I found this was a mining virus, and I thought to myself, mmp.

Now that we find out he's a mining virus, we start to deal with it and look at his process tree.

Found that the process is embedded in the redis container, decisively delete the container, change the image, set a strong password, and then solve this problem.

Summary:

Image can not be used casually, we should try to use the official docker image of the software.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.