Re: chfn, chsh, ls, ps - INFECTED

From: Alexandru Balan (Alexandru.Balan@iNES.RO)
Date: 04/13/03

  • Next message: Mark Shepard: "chroot() as non-root user?" 
    From: Alexandru Balan <Alexandru.Balan@iNES.RO>
To: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
Date: 13 Apr 2003 17:17:38 +0300

    Yes it is 5.x, I'm truly sorry if it was posted before but i just
    subscribe. I'll search in the archives. Thank you

    On Sun, 2003-04-13 at 17:07, Nickolay A. Kritsky wrote:
    > Hello Alexandru,
    >
    > Sunday, April 13, 2003, 5:53:00 PM, you wrote:
    >
    > AB> My machine got hacked a few days ago through the samba bug. I
    > AB> reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM
    > AB> but still...
    > AB> Can anyone please advise ?
    >
    > AB> bash-2.05b# chkrootkit | grep INFECTED
    > AB> Checking `chfn'... INFECTED
    > AB> Checking `chsh'... INFECTED
    > AB> Checking `date'... INFECTED
    > AB> Checking `ls'... INFECTED
    > AB> Checking `ps'... INFECTED
    >
    > This was mentioned on this list before. Is your system 5.x ?
    >
    > ;-------------------------------------------
    > ; NKritsky
    > ; mailto:nkritsky@internethelp.ru 

    -- 
Jy

  • Next message: Mark Shepard: "chroot() as non-root user?"