某种矿机的预防脚本

#!/bin/bash

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "tor2web.io" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "onion.glass" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "onion.mn" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "tor2web.to" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "onion.ws" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "onion.in.net" --algo bm -j DROP

iptables -I OUTPUT -p tcp -m multiport --dport 80,443 -m string --string "onion.to" --algo bm -j DROP

tmpf=/tmp/pidlist.tmp

pidpath=/tmp/.X11-unix

ls -l $pidpath

cat $pidpath/* >$tmpf

cat $tmpf | while read LINE

do

echo "will kill " $LINE

kill -9 $LINE

done

mv /usr/bin/base64 /usr/bin/base64_org

cp /usr/bin/df /usr/bin/base64

rm -f $pidpath/*

service crond start

ps -ef | grep crond