clean.sh

一个用C语言写的后门程序

#!/bin/sh
echo "########################SARS-Worm Cleanner##########################"
echo "############################H.L.C-Team##############################"
echo "Killing the SARS-Worm running process...."
killall -9 sama;killall -9 samb;killall -9 samc;killall -9 samd
killall -9 same;killall -9 samf;killall -9 klogd;killall -9 ddos
echo
echo "Restore the system's settings&files...."
mv /usr/bin/sars /bin/ps > /dev/null 2>&1
mv /usr/lib/klogd.so /usr/sbin/klogd > /dev/null 2>&1
mv /usr/lib/.lib/rc.local.bak /etc/rc.d/rc.local > /dev/null 2>&1
mv /usr/lib/.lib/0anacron.bak /etc/cron.daily/0anacron > /dev/null 2>&1
rm -rf /etc/cron.hourly/0anacron > /dev/null 2>&1
rm -rf /usr/lib/.lib > /dev/null 2>&1
echo "Done!"
echo
echo "Restart the system's http daemon...."
killall -9 xinetd > /dev/null 2>&1
rm -rf /etc/xinetd.d/thttpd > /dev/null 2>&1
rm -rf /usr/lib/shttpd > /dev/null 2>&1
/etc/rc.d/init.d/xinetd restart
/usr/bin/httpd &> /dev/null 2>&1
if [ -f /etc/rc.d/init.d/httpd ]; then
/etc/rc.d/init.d/httpd restart
exit 0
fi
/usr/sbin/klogd
echo
echo "The SARS-Worm had been deleted!!!"