1. 检查动态链库，是否有异常lib
    - echo LD_PRELOAD
    - 查看/etc/ld.so.preload
2. 查看定时任务
    - crontab  -l
    - cat /var/spool/cron/
3. killall kworkerds

# shell script
```
echo "" > /etc/ld.so.preload
chattr +i /etc
rm -rf /var/spool/cron/*
rm -rf /etc/cron.d/*
chattr +i /var/spool/cron/
rm -f /usr/local/lib/*
chattr +i /usr/local/lib
killall kworkerds
rm -f /var/tmp/kworkerds*
rm -f /var/tmp/1.so
rm -f /tmp/kworkerds*
rm -f /tmp/1.so
rm -f /var/tmp/wc.conf
rm -f tmp/wc.conf
```

[ 详细 ](https://blog.csdn.net/xinxin_2011/article/details/85047245)