我的虚拟机感染了一些加密挖掘恶意软件。我可以杀死它，但它显然在每次启动时都会重新启动。我试图找到可执行文件，但无法找到它；进程路径（来自htop、、、等）不存在。这怎么可能？我如何找到可执行文件并删除它ls -l？lsof -p
这里有一些输出可以证明我所说的话。
root@mediaserver:/home/tech# ls -l /proc/3648/exe
lrwxrwxrwx 1 media media 0 juin 23 00:48 /proc/3648/exe -> /config/c3pool/xmrig
root@mediaserver:/home/tech# readlink /proc/3648/exe
/config/c3pool/xmrig
root@mediaserver:/home/tech# lsof -p 3648
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
xmrig 3648 media cwd DIR 0,82 4096 20054344 /
xmrig 3648 media rtd DIR 0,82 4096 20054344 /
xmrig 3648 media txt REG 254,2 2364488 22675798 /config/c3pool/xmrig
xmrig 3648 media mem REG 254,2 13503512 /usr/share/zoneinfo/Europe/Paris (path inode=31594143)
xmrig 3648 media 0r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 1w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 2w CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 3r CHR 1,9 0t0 101097 /dev/urandom
xmrig 3648 media 4u a_inode 0,13 0 10340 [eventpoll]
xmrig 3648 media 5r FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 6w FIFO 0,12 0t0 231408 pipe
xmrig 3648 media 7r FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 8w FIFO 0,12 0t0 238200 pipe
xmrig 3648 media 9u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 10w REG 254,2 87499703 22675799 /config/c3pool/xmrig.log
xmrig 3648 media 11u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 12u sock 0,9 0t0 231410 protocol: UNIX
xmrig 3648 media 13u a_inode 0,13 0 10340 [eventfd]
xmrig 3648 media 14r a_inode 0,13 0 10340 inotify
xmrig 3648 media 15r CHR 1,3 0t0 101092 /dev/null
xmrig 3648 media 16u sock 0,9 0t0 243829 protocol: TCP
root@mediaserver:/home/tech# cd /config
bash: cd: /config: Aucun fichier ou dossier de ce type
编辑：在https://askubuntu.com/questions/1005437/greping-all-files-for-a-string-takes-a-long-time我设法找到了源头。他在多个地方安装了恶意软件，当他运行它时，他会检查这里是否已经存在一个进程。我将让 grep 完成并删除它的所有副本。但我仍然想知道脚本是如何执行的……有人有想法吗？以下是一些日志，以便更好地了解情况：
root@mediaserver:/home/tech# sudo time grep -rnw --exclude-dir={boot,dev,lib,media,mnt,proc,root,run,sys,/tmp,tmpfs,var,/shares} '/' -e 'xmrig'
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config.json:63: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/config_background.json:90: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/code-server/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config.json:65: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/config_background.json:112: "log-file": "/config/c3pool/xmrig.log",
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:2:if ! pidof xmrig >/dev/null; then
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:3: nice /config/c3pool/xmrig $*
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:6: echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
/shares/backup/mediaserver/delta_9/config/qbittorrent/c3pool/miner.sh:8: echo "如果要先删除后台矿工，请运行 \"killall xmrig\" 或 \"sudo killall xmrig\"."
media@mediaserver:~$ ls -al /appdata/config/code-server/c3pool/
total 87800
drwxr-xr-x 2 media media 4096 déc. 31 2020 .
drwxr-xr-x 12 media media 4096 janv. 6 12:38 ..
-rw-r--r-- 1 media media 4172 déc. 31 2020 config_background.json
-rw-r--r-- 1 media media 2441 déc. 31 2020 config.json
-rwxr-xr-x 1 media media 277 déc. 31 2020 miner.sh
-rwxr-xr-x 1 media media 2364488 déc. 23 2020 xmrig
-rw-r--r-- 1 media media 87510988 juin 23 02:46 xmrig.log
media@mediaserver:~$ cat /appdata/config/code-server/c3pool/miner.sh
#!/bin/bash
if ! pidof xmrig >/dev/null; then
nice /config/c3pool/xmrig $*
else
echo "Monero miner is already running in the background. Refusing to run another one."
echo "Run \"killall xmrig\" or \"sudo killall xmrig\" if you want to remove background miner first."
fi