#!/bin/bash

echo "=============================="
echo "XMRig Malware Removal Script"
echo "=============================="

# Step 1: Kill all XMRig processes
echo "- Killing XMRig processes..."
pkill -9 xmrig
pkill -9 virtualizatorcron

# Step 2: Remove XMRig binary files
echo "- Removing XMRig files..."
rm -rf /root/*xmrig*
rm -rf /root/*virtualizatorcron*

rm -rf ~/.xmrig /tmp/xmrig /var/tmp/xmrig /usr/local/bin/xmrig /etc/systemd/system/xmrig.service
rm -rf ~/.virtualizatorcron /tmp/virtualizatorcron /var/tmp/virtualizatorcron /usr/local/bin/virtualizatorcron /etc/systemd/system/virtualizatorcron.service

# Step 3: Remove malicious cron jobs
echo "- Checking and removing suspicious cron jobs..."
rm -rf /etc/cron.d/xmrig
rm -rf /etc/cron.d/virtualizatorcron

# Step 4: Remove XMRig systemd service
echo "- Checking and disabling xmrig services..."
systemctl stop xmrig.service 2>/dev/null
systemctl disable xmrig.service 2>/dev/null
rm -rf /etc/systemd/system/xmrig.service
systemctl stop virtualizatorcron.service 2>/dev/null
systemctl disable virtualizatorcron.service 2>/dev/null
rm -rf /etc/systemd/system/virtualizatorcron.service