Cостояние системы
Помимо поиска троянов также следует:
- проверить, нет ли запущенных подозрительных процессов на сервере;
- проверить, нет ли посторонних заданий в crontab;
- нет ли посторонних ssh-ключей.
> whoami
bitrix
> ps ux -u `whoami`
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
bitrix 2100955 1.1 0.3 45932 24704 ? S 16:53 3:07 nginx: worker process
bitrix 2100956 0.9 0.3 46444 24888 ? S 16:53 2:39 nginx: worker process
bitrix 2100957 0.9 0.3 46444 24860 ? S 16:53 2:38 nginx: worker process
bitrix 2100958 1.0 0.3 46188 24828 ? S 16:53 2:58 nginx: worker process
bitrix 2113162 8.9 3.2 1370464 257824 ? S 21:20 0:47 /usr/sbin/httpd -DFOREGROUND
bitrix 2113166 8.7 3.2 1371436 261680 ? R 21:20 0:42 /usr/sbin/httpd -DFOREGROUND
bitrix 2113203 8.7 2.9 1368456 236960 ? S 21:22 0:35 /usr/sbin/httpd -DFOREGROUND
bitrix 2113205 8.7 2.9 1369396 238108 ? S 21:22 0:35 /usr/sbin/httpd -DFOREGROUND
bitrix 2113235 8.9 2.7 1369580 223488 ? S 21:23 0:28 /usr/sbin/httpd -DFOREGROUND
bitrix 2113377 8.9 2.5 1370444 203864 ? S 21:25 0:16 /usr/sbin/httpd -DFOREGROUND
bitrix 2113445 13.0 1.4 1366244 119916 ? S 21:28 0:00 /usr/sbin/httpd -DFOREGROUND
bitrix 2113447 0.0 0.0 7060 3184 ? R 21:28 0:00 ps ux -u bitrix
> crontab -l
# Jobs moved to /etc/crontab
> last -i `whoami`
bitrix pts/0 46.159.116.161 Tue Oct 27 12:10 - 14:13 (02:03)
bitrix pts/1 46.158.121.179 Wed Oct 21 11:09 - 11:50 (00:41)
bitrix pts/1 46.158.121.179 Wed Oct 21 09:56 - 10:22 (00:25)
bitrix pts/0 46.158.121.179 Tue Oct 20 09:36 - 10:38 (01:01)
bitrix pts/0 46.158.121.179 Mon Oct 19 11:34 - 11:51 (00:17)
wtmp begins Thu Oct 15 09:26:20 2026
> cat ~/.bashrc
# .bashrc
# Source global definitions
if [ -f /etc/bashrc ]; then
. /etc/bashrc
fi
# User specific environment
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]
then
PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH
# Uncomment the following line if you don't like systemctl's auto-paging feature:
# export SYSTEMD_PAGER=
# User specific aliases and functions
if [ -d ~/.bashrc.d ]; then
for rc in ~/.bashrc.d/*; do
if [ -f "$rc" ]; then
. "$rc"
fi
done
fi
unset rc> stat ~/.bashrc
File: /home/bitrix/.bashrc
Size: 492 Blocks: 8 IO Block: 4096 regular file
Device: fd03h/64771d Inode: 138412747 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 600/ bitrix) Gid: ( 600/ bitrix)
Access: 2026-11-11 17:39:31.401125176 +0300
Modify: 2024-04-30 17:14:04.000000000 +0300
Change: 2026-10-15 09:28:49.492499730 +0300
Birth: 2026-10-15 09:28:49.492499730 +0300
> cat ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBE8kG0EfvUFfNZApbbbohlTpzpvANo1Gm37zLH6MxFG9qm8rApxZ/c3hrx7INEH9YsYmUOXcGnI+QW94eMjNXtTryWn5V3rUWKqoXiblvArum892XS1Pvd7EKADBQS+Y4aC5W75zjLbA/5IFPINmdzfyDPrJYGoNWdJXsEiWlJMbwvu7RgQ0lBgwF5vJ5+5iE1xSxQr7zRM8S65TA0dI2sfBDxslnnkw3UIds60AOeWZgqu2rEqDPRxO+Y19We/5RpBlv72d7Os9T4TJGx8vRK2n3iIDCNafqvRnjCgscrdzC1atoc7b9tLLZCbBOsH7xPV48BAnD4hG9fl9cfjRr gitlab-runner@git.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDWBj5z1qHWJMAH0kul4OKbwAoZgf0/4ipYhME2mZ6YRAADN9cTkyKr2w9ZIuX0mVptN7xgJbN9My2mnjpFqmWieXrAN+PBmmO/tT+vtzZTGG+dUnjXirAkE9YF/WEGvXw+j/1Ze47im1AHhXT9C3yHI7CD9ac1GqRLitofIkTz80xTMvQrWVxLa1tNvro+rtlKlBIp5jN9y0EyMpa3Ipn4jvh1NOEUMVVlwqUwU1wf+a9Wx1WDw6Do4LneS8sy9tqEaY3uBniSk/2LS32kX2yUR3ABP4MFfbUc1KmzwfGowNQzdMdiC1MfCq4kG8oBWM5duda3X24Cgxxy5x6PvPFj adminka@ansible.o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCm8UKWDUnUMINQsr76HsSqu1WnKPKinbmbydCaZVi4oxLZxwMpMIVUGrgJuKX+M7FGZ4+NfroxaLH83TyrSbKQ3OokKdF87nO61tQYq6w9uBUrye5jiv819YgK49CeQmvnXy48Cmb7z6j8EMM70eSvHHCRFKPZkKAqAAH/S8Bt50nPhI89bgz9Ou4RL1WAjlP06WuXzDdwhixV5Uiem4tnqU5XN0RnqWnIIkB9a+chWpia9UE8Ar8m57z6E2EKEn67a8GYq9tzht92+YSbAfn1hxpTXr/fiTdju+t3zLResOiZzh485Ge+NyXnuKv8CP8eCMvbcRLLnzQThNHsdn7OsGdmlkWy+vkz/khwE1rVDYRjqKYyvel6xG0PfH+WbBmbp6r1lyAZm81sGvxds4whK8488w54mCHQ4SdBdw6eyREFbJF4KG03ruMiqCmBWBCzURWQvkZn+3krgdY5kEZ0Gpv0ra5nGcaOGcGgibkzADH88H8HGF5yNml32TTQAVE= tumerov@gmail.com
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNj85F84SDfkvLoCEqTrYqkbGyulyWGKHLolGRp1KX0Hcu8lTxcpuBNC2YEER21FRMVW2P/O395UGDZN4ApkScRpv4FMide5YH6jBlos/eD5CeWnwC8R2ftwNbALHcJB3e37qmdRwWkapZggRmTOiQtQLzAynM3UXuXVWOLYZKY7RU4A+CCBbZvwDaKvVzi6UwOFcJk5zmb3/pIhMznJrseAu3qr4Os8HHuM8aYHCHZp9mYuyq38ByeiOV+FnYYt5uxPA82x1iNW3+UR4bB2hsrSrq14YDiNogDvmf0XeDKMmICm7J5gQB9Pn4h9yBeqFTpoMN5cfCjdTD70BUYQ/dvu209az0saYRQILnS55Yp9NWdmnceXK0wVnAZ76vxekyykZoGPojQ5HLASdqr0qgElX6Ausy5+BoLEE06bHvz9wQI92pDVeRNRoZRC0wMv0/0s4ksrzi1YDYE1WBCMWbZ8dZytKZQRgPfvjxV1l7yxHxPgdHl6Ws5jT0a2Iy/z8= dmitriev@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDNT6eo6Um6boPiRC8/ReQv4sOwMu4S+Ib+gXzrrE/N9hOZXDXFAtAWKuwv8NZWfsQx6DFjMppa3RyN2DEhhzvE+CEfqSyrBaVYXbhi5nIChRNtFLzSf97zMJ9F7y23X2rNoullI6YSLBhNM9PnovG3xXwgzb8mh84FbIct1TgKsOfEkHwgB77Zc1eKUgmGElsF5rJt+cBTNm9tQAXdGjEH86fc4d2WxFYKas3nTOMAIFEIfNhaqXP3UVJv2osfBVafFJIuN7QEmbfXgHuT0qWVO4mXC8eCbLTkcukdPtWyr2RNzcD7YT87RYVlOlUdAWjM4jOF1HsaYpjQj0tnzyrXd423dyTfltgouQXsjYqF3HPasG2kfm77MWff01Hy2d5O0ZZ/BHSm4zgiSESQ6wpcKiGYcl+24i6xvDZP4hTo4VDDGUKcZh3o7m2u+hWw4Zeq/cBclx/7wJ2tMgueH/JPnAiUz3a8wdW7Y9qJazqGbIXohSENaDYKs828e+Yl+dE= shuvalov@o2k.ru
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDN/kd2fVsgRSGoEyvBO9m6OP/2rUSt3fJbuzIwlZChU6C5NjAmGNg8MxDe62vItkrMyFZ9DUo502T5DMedodEhoBFMd5o1PMw7gVXC3AVhxr2FYE+8HnoiqH1EHQNW4SzlH9H/EiJ/0sYpER2Qc3qiQX+6Hm3Z1EMskKzp9QWUVaGA5bqpOFALvibbgG4T7i/9Jko63XYdAYa3JGRnTQ4NuUOqwgtksCehu3QcgFVjo6x+YCT5DxPBXs9htKbTFGkDvFTgQ1u/PmT602vw+mj2PNLfcI2oiE5vBXSRQg6nzTpVErFLOnmRIDpjqI9qxte3l15V5bbcCJmBbbfKwNbePK/K5aY0uFeCJ5plaR4IF1L4860dbvZjNVh/BTO6Lo8D81jhiswMDlGhShsYIP49tqgaOrR8eA2oc+dyQeDCSpurWkdy5DVYGtcb/RgExX3UoSsiAoXv/gO9r1YwHQngEvj5I+0wivnOxM6rXEZUXdOxIg/+hbLR2+uFGvqtyC0= stepanov@o2k.ru
> stat ~/.ssh/authorized_keys
File: /home/bitrix/.ssh/authorized_keys
Size: 3088 Blocks: 8 IO Block: 4096 regular file
Device: fd03h/64771d Inode: 114317332 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 600/ bitrix) Gid: ( 600/ bitrix)
Access: 2026-11-11 17:39:31.403125145 +0300
Modify: 2026-07-03 08:01:23.872782118 +0300
Change: 2026-10-15 13:45:16.568481814 +0300
Birth: 2026-10-15 13:45:16.568481814 +0300
Эта установка предназначена для разработки на базе продукта "1С-Битрикс: Управление сайтом". Она не должна использоваться в качестве рабочего (боевого) сайта.