linux - The server is under attack, how to completely delete unknown files

Question

{code...} Then I checked the cpu status {code...} {code...} {code...} {code...}

世界只因有你 · Answer

It should be that your SSH has been cracked
Then I checked this wk and it is NsCpuCNMiner
Someone has used your server to mine Bitcoin to make money
It is not a DDCC attack, it is that the SSH port has been cracked
SSH side passwd command to change the password , end the process, delete these files, restart the machine
Then install sshguard to prevent explosions, or use a local key to connect to SSH

为情所困 · Answer

Flies don’t bite seamless eggs! Is there any module/plug-in vulnerability installed on your server that allows the system to be invaded?
Our server was also hacked last year and turned into a mining machine. All kinds of deleting processes and deleting abnormal files did not work, but it happened again after a while. In the end, it was found that it was caused by a redis vulnerability. Once it was fixed, it would be fine.
So, you have to find the "root cause" to completely solve the problem.

漂亮男人 · Answer

Strange G-spot - -
Waiting for the interpretation by the experts.