lkml.org 
[lkml]   [2003]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: Help with virus/hackers
    From
    Date
    On Iau, 2003-04-17 at 14:55, Richard B. Johnson wrote:
    > (2) Boot with init=/bin/bash

    Doesnt help you
    > (5) Examine /etc/inetd.conf (if one exists). If you see an
    > unusual entry near the end, you have been 'rooted'. Newer
    > systems use xinetd and won't get invaded this way.
    Wrong. Old xinetd < 2.3.10 has remote root exploits and real
    ones circulate
    > (6) Check /etc/passwd for a strange account.
    Rootkits patch other stuff
    > (7) Check /bin/login for a new file-date.
    > (8) Check /usr/sbin/sendmail for a new file-date.
    > Check /usr/sbin/inetd ""
    > Check /usr/sbin/xinetd ""
    > Check /usr/sbin/syslogd ""
    > Check /usr/sbin/klogd ""
    > Check /usr/sbin/in.* ""

    Rootkits know about avoiding this

    > If none of these have recent writes, just change the password on
    > the root account and be happy. You just has some file-system
    > corruption and you can fix up /etc/DIR_COLORS (for your color-ls
    > problem) and fix /etc/profile or /root/.bashrc, /root/.profile
    > to fix the bad environment variables created by these scripts.

    Never do this. You don't know what else has changed on the system. You
    should always (barring odd exceptions) do a full reinstall. Also clean
    user executable files if neccessary (roots .login is often archived and
    people rerun exploits from it...)

    See the cert documents on recovering from an attack

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:34    [W:3.311 / U:0.668 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site