- Product Introduction
- Tutorial
- Release Notes and Announcements
- Public Image Updates
- Announcements
- CentOS 8 End of Maintenance
- Discontinuation of Support for SUSE Commercial Images
- Price Reduction in Selected Availability Zones
- WebShell Proxy IP Addresses Updates
- Windows Server 2003 System Images End of Support Announcement
- Pay-as-you-go Price Adjustments for Standard S3 CVMs in the Silicon Valley Region
- Vulnerability repairing for Linux images
- Windows Server 2008 R2 Enterprise Edition SP1 64-bit Images End of Support Announcement
- Upgrading Virtio network card drive for Windows CVMs
- Solution to Tomcat Start Failure on Ubuntu14.04
- Stopping supporting for Ubuntu 10.04 images
- About Configuration of Security Group Port 53
- Purchase Guide
- Getting Started
- Operation Guide
- Operation Guide Overview
- Use Limits Overview
- Convenience Features
- Instances
- Creating Instances
- Working with Instance Launch Templates
- Batch Sequential Naming or Pattern String-Based Naming
- Generating API Explorer Reusable Scripts to Create Instances
- Adjusting Configuration
- Querying Information
- Renaming Instances
- Resetting Instance Password
- Managing Instance IPs
- Changing Instance Subnet
- Changing Security Group
- Searching for Instances
- Exporting Instance List
- Renewing Instances
- Querying the Repossession Status of a Spot Instance
- Shutting Down Instances
- Restarting Instances
- Logging in to Linux Instance
- Logging in to Windows instance
- Reinstalling System
- Using Tencent Cloud Automation Tools
- Terminating/Returning Instances
- Instance Repossession
- Spot Instances
- No Charges When Shut Down for Pay-as-You-Go Instances
- Managing Roles
- Starting Up Instances
- Managing Roles
- Images
- Service Migration
- Cloud Disks
- Networking
- Maintenance Tasks
- Security
- Security Groups
- Protection of Sensitive Operations
- Managing Login Password
- Managing SSH Keys
- Spread Placement Group
- Unblocking Port 25
- Tags
- Monitoring and Alarms
- Sample Console Configuration
- Best Practice
- Best Practices
- Choosing the CVM Model
- Migrating CVM Instances
- Setting up a Website
- Building an Environment
- Building a Website
- Building an Application
- Data Backup
- Uploading Local Files to CVM
- Copying Local Files to CVMs
- Uploading Files from MacOS to Windows CVM Using MRD
- Uploading Files from Linux to Windows CVM using RDP
- Uploading Files from Linux to a CVM Using FTP
- Uploading files via WinSCP to a Linux CVM from Windows
- Uploading Files from Windows to a CVM Using FTP
- Uploading Files from Linux or MacOS to Linux CVM via SCP
- Uploading Files from Windows to a Windows CVM via MSTSC
- Other CVM Operations
- Network Performance Test
- High-throughput Network Performance Test
- Building a Visual GUI
- Recovering Data on Linux CVMs
- CVM Access to COS via a Private Network
- Changing Kernel of a Linux Instance Manually
- Managing Disk Space on Windows CVMs
- Setting Up Windows-based AD Domain on a CVM
- Using RemoteFx to Redirect USB Devices in Windows
- Using USB/IP to Share USB Devices in Linux
- Using AVX-512 Instructions to Accelerate AI Applications on CVM
- Building Tencent SGX Confidential Computing Environment
- Configuring Persistent Memory in M6p Instances
- Operations Guide
- Initializing Data Disks
- Environment Configurations
- Installing Software
- User Data
- Work with Operating Systems
- System Activation
- System Updates
- System Shutdown
- Configuring High-performance Power Management
- Windows Recovery Mode
- Use of the atop Monitoring Tools by Linux Instances
- Ensuring Unique SIDs for CVMs Using Sysprep
- Modifying VNC Resolution
- Introduction to Linux Kernel Parameters
- Updating the Virtio ENI Driver
- Modifying SID
- Others
- Troubleshooting
- Instance-Related Failures
- CVM Login Failures
- Windows Instance Login Failures
- Windows Instance Login Failures
- An authentication error occurred when you tried to log in to a Windows instance remotely
- Failed to Reset the CVM Password or the CVM Password Is Invalid
- Windows instance: no remote Desktop license server can provide license
- Requires network-level identity verification
- Problems occurred when you tried to log in to a Windows CVM remotely on Mac
- Failed to log in to a Windows CVM due to high CPU and memory usage
- Failed to connect to a remote computer through Remote Desktop
- Credentials Not Work
- Connection to a Windows CVM through Remote Desktop was denied
- Remote Login Failure Due To Port Issues
- Linux Instance Login Failures
- Linux Instance Login Failures
- Unable to Log in to a Linux Instance via SSH Key
- Failing to log in to a Linux CVM due to high CPU and memory usage
- Remote Login Failure due to Port Issues
- VNC Login Error (Module is Unknown)
- VNC Login Error (Account Locked due to XXX Failed Logins)
- VNC Login Error (Login Failed with Correct Password)
- VNC or SSH Login Error (Permission Denied)
- Login Failure Due to /etc/fstab Configuration Errors
- sshd Configuration File Permissions
- Infinite Loop Call in /etc/profile
- Login Failure Due to Server Isolation
- Login Failure Due to High Bandwidth Occupation
- Remote Connect Failure Due to Security Group Settings
- Troubleshooting Linux Instance Issues via VNC and Rescue Mode
- Failed to shut down or restart a CVM
- Network Namespace Creation Failure
- Kernel and IO Issues
- Missing System bin or lib Soft Link
- Suspected Infection with Virus
- "no space left on device" Error During File Creation
- Linux CVM Memory Issues
- Network Related Failures
- Instance-Related Failures
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Region APIs
- Instance APIs
- DescribeInstances
- DescribeInstanceFamilyConfigs
- DescribeZoneInstanceConfigInfos
- DescribeInstanceTypeConfigs
- DescribeInstancesOperationLimit
- DescribeInstanceVncUrl
- InquiryPriceRunInstances
- InquiryPriceResetInstance
- InquiryPriceResetInstancesType
- InquiryPriceResizeInstanceDisks
- RunInstances
- StartInstances
- RebootInstances
- StopInstances
- ResetInstance
- TerminateInstances
- ResetInstancesType
- ResizeInstanceDisks
- ResetInstancesPassword
- ModifyInstancesAttribute
- ModifyInstancesProject
- InquirePricePurchaseReservedInstancesOffering
- DescribeReservedInstancesConfigInfos
- DescribeInstancesStatus
- Placement Group APIs
- Image APIs
- Key APIs
- Security Group APIs
- Network APIs
- Instance Launch Template APIs
- Data Types
- Error Codes
- FAQs
- Service Agreement
- Glossary
- Product Introduction
- Tutorial
- Release Notes and Announcements
- Public Image Updates
- Announcements
- CentOS 8 End of Maintenance
- Discontinuation of Support for SUSE Commercial Images
- Price Reduction in Selected Availability Zones
- WebShell Proxy IP Addresses Updates
- Windows Server 2003 System Images End of Support Announcement
- Pay-as-you-go Price Adjustments for Standard S3 CVMs in the Silicon Valley Region
- Vulnerability repairing for Linux images
- Windows Server 2008 R2 Enterprise Edition SP1 64-bit Images End of Support Announcement
- Upgrading Virtio network card drive for Windows CVMs
- Solution to Tomcat Start Failure on Ubuntu14.04
- Stopping supporting for Ubuntu 10.04 images
- About Configuration of Security Group Port 53
- Purchase Guide
- Getting Started
- Operation Guide
- Operation Guide Overview
- Use Limits Overview
- Convenience Features
- Instances
- Creating Instances
- Working with Instance Launch Templates
- Batch Sequential Naming or Pattern String-Based Naming
- Generating API Explorer Reusable Scripts to Create Instances
- Adjusting Configuration
- Querying Information
- Renaming Instances
- Resetting Instance Password
- Managing Instance IPs
- Changing Instance Subnet
- Changing Security Group
- Searching for Instances
- Exporting Instance List
- Renewing Instances
- Querying the Repossession Status of a Spot Instance
- Shutting Down Instances
- Restarting Instances
- Logging in to Linux Instance
- Logging in to Windows instance
- Reinstalling System
- Using Tencent Cloud Automation Tools
- Terminating/Returning Instances
- Instance Repossession
- Spot Instances
- No Charges When Shut Down for Pay-as-You-Go Instances
- Managing Roles
- Starting Up Instances
- Managing Roles
- Images
- Service Migration
- Cloud Disks
- Networking
- Maintenance Tasks
- Security
- Security Groups
- Protection of Sensitive Operations
- Managing Login Password
- Managing SSH Keys
- Spread Placement Group
- Unblocking Port 25
- Tags
- Monitoring and Alarms
- Sample Console Configuration
- Best Practice
- Best Practices
- Choosing the CVM Model
- Migrating CVM Instances
- Setting up a Website
- Building an Environment
- Building a Website
- Building an Application
- Data Backup
- Uploading Local Files to CVM
- Copying Local Files to CVMs
- Uploading Files from MacOS to Windows CVM Using MRD
- Uploading Files from Linux to Windows CVM using RDP
- Uploading Files from Linux to a CVM Using FTP
- Uploading files via WinSCP to a Linux CVM from Windows
- Uploading Files from Windows to a CVM Using FTP
- Uploading Files from Linux or MacOS to Linux CVM via SCP
- Uploading Files from Windows to a Windows CVM via MSTSC
- Other CVM Operations
- Network Performance Test
- High-throughput Network Performance Test
- Building a Visual GUI
- Recovering Data on Linux CVMs
- CVM Access to COS via a Private Network
- Changing Kernel of a Linux Instance Manually
- Managing Disk Space on Windows CVMs
- Setting Up Windows-based AD Domain on a CVM
- Using RemoteFx to Redirect USB Devices in Windows
- Using USB/IP to Share USB Devices in Linux
- Using AVX-512 Instructions to Accelerate AI Applications on CVM
- Building Tencent SGX Confidential Computing Environment
- Configuring Persistent Memory in M6p Instances
- Operations Guide
- Initializing Data Disks
- Environment Configurations
- Installing Software
- User Data
- Work with Operating Systems
- System Activation
- System Updates
- System Shutdown
- Configuring High-performance Power Management
- Windows Recovery Mode
- Use of the atop Monitoring Tools by Linux Instances
- Ensuring Unique SIDs for CVMs Using Sysprep
- Modifying VNC Resolution
- Introduction to Linux Kernel Parameters
- Updating the Virtio ENI Driver
- Modifying SID
- Others
- Troubleshooting
- Instance-Related Failures
- CVM Login Failures
- Windows Instance Login Failures
- Windows Instance Login Failures
- An authentication error occurred when you tried to log in to a Windows instance remotely
- Failed to Reset the CVM Password or the CVM Password Is Invalid
- Windows instance: no remote Desktop license server can provide license
- Requires network-level identity verification
- Problems occurred when you tried to log in to a Windows CVM remotely on Mac
- Failed to log in to a Windows CVM due to high CPU and memory usage
- Failed to connect to a remote computer through Remote Desktop
- Credentials Not Work
- Connection to a Windows CVM through Remote Desktop was denied
- Remote Login Failure Due To Port Issues
- Linux Instance Login Failures
- Linux Instance Login Failures
- Unable to Log in to a Linux Instance via SSH Key
- Failing to log in to a Linux CVM due to high CPU and memory usage
- Remote Login Failure due to Port Issues
- VNC Login Error (Module is Unknown)
- VNC Login Error (Account Locked due to XXX Failed Logins)
- VNC Login Error (Login Failed with Correct Password)
- VNC or SSH Login Error (Permission Denied)
- Login Failure Due to /etc/fstab Configuration Errors
- sshd Configuration File Permissions
- Infinite Loop Call in /etc/profile
- Login Failure Due to Server Isolation
- Login Failure Due to High Bandwidth Occupation
- Remote Connect Failure Due to Security Group Settings
- Troubleshooting Linux Instance Issues via VNC and Rescue Mode
- Failed to shut down or restart a CVM
- Network Namespace Creation Failure
- Kernel and IO Issues
- Missing System bin or lib Soft Link
- Suspected Infection with Virus
- "no space left on device" Error During File Creation
- Linux CVM Memory Issues
- Network Related Failures
- Instance-Related Failures
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Region APIs
- Instance APIs
- DescribeInstances
- DescribeInstanceFamilyConfigs
- DescribeZoneInstanceConfigInfos
- DescribeInstanceTypeConfigs
- DescribeInstancesOperationLimit
- DescribeInstanceVncUrl
- InquiryPriceRunInstances
- InquiryPriceResetInstance
- InquiryPriceResetInstancesType
- InquiryPriceResizeInstanceDisks
- RunInstances
- StartInstances
- RebootInstances
- StopInstances
- ResetInstance
- TerminateInstances
- ResetInstancesType
- ResizeInstanceDisks
- ResetInstancesPassword
- ModifyInstancesAttribute
- ModifyInstancesProject
- InquirePricePurchaseReservedInstancesOffering
- DescribeReservedInstancesConfigInfos
- DescribeInstancesStatus
- Placement Group APIs
- Image APIs
- Key APIs
- Security Group APIs
- Network APIs
- Instance Launch Template APIs
- Data Types
- Error Codes
- FAQs
- Service Agreement
- Glossary
CVMs may be intruded by hackers due to weak passwords and vulnerabilities of open-source components. This document describes how to determine whether a CVM has been infected with a virus and how to fix it.
Troubleshooting the Issue
Use SSH or VNC to log in to the instance and check whether it has been infected with a virus in the following ways:
Malicious commands were added to rc.local
展开&收起Run the following command to view the rc.local file.
cat /etc/rc.local
If the output information contains a command not added by the business team or public image, such as
wget xx and /tmp/xx, the CVM has probably been infected with a virus.Malicious tasks were added to crontab
展开&收起Run the following command to list the current schedule.
crontab -l
If the output information contains a command not added by the business team or public image, such as
wget xx and /tmp/xx, the CVM has probably been infected with a virus.Dynamic library hijacking was added to ld.so.preload
展开&收起Run the following command to view the /etc/ld.so.preload file.
cat /etc/ld.so.preload
If the output information contains a dynamic library not added by the business team, the CVM has probably been infected with a virus.
Huge page memory was configured in sysctl.conf
展开&收起Run the following command to check the usage of huge page memory.
sysctl -a | grep "nr_hugepages "
If the output is not 0, and the business program does not use huge page memory, the CVM has probably been infected with a virus.
Troubleshooting Procedure
- Back up the system data as instructed in Creating Snapshots.
- Reinstall the instance system as instructed in Reinstalling System and take the following security hardening measures:
- Change the CVM password to a stronger password containing 12-16 characters, including uppercase letters, lowercase letters, special characters, and numbers. For more information, see Resetting Instance Password.
- Delete unused CVM login accounts.
- Change the default sshd port 22 to a less common port between 1024-65525. For more information, see Modifying the Default Remote Port of CVM.
- Manage the associated security group rules to open only ports and protocols required by your business. For more information, see Adding Security Group Rules.
- Close the port for internet access for core applications such as MySQL and Redis databases.
- Install security software (such as CWP agent), and configure real-time alarms to get noticed about suspicious logins instantly.
Yes
No
Was this page helpful?