Re: think I may have been rootkitted

From: charadeur (charadeur@spamsucks.nym.alias.net)
Date: 06/09/02

  • Next message: Macbrush: "Script for removing blocked IP in a list" 

    From: charadeur <charadeur@spamsucks.nym.alias.net>
Date: 8 Jun 2002 17:59:23 -0500

    On 23 May 2002 09:08:49 -0700, jared@hwai.com (Jared) wrote:

    >Chkrootkit gave me some bad news:

    When I was rootkited recently the tip off for me was when I ran ps I
    could not see processes I knew were running. I am using RedHat and
    noted I could see some directories and file with dir that I could not
    see with ls. In these directories I found the hackers rootkit and
    other tools. I ended up reinstalling because I could not get some of
    the rpms to reinstall.

    Relevant Pages

    • Re: AW: nouser - rootkit ?
      ... > bright enough to find the rootkit, I sure do hope that he also realizes that ... than reinstalling it really should stop. ... > For more information on this free incident handling, management ... > and tracking system please see: http://aris.securityfocus.com ...
      (Incidents)
    • Re: think I may have been rootkitted
      ... In these directories I found the hackers rootkit and ... I ended up reinstalling because I could not get some of ... the rpms to reinstall. ...
      (comp.os.linux.security)
    • Re: Urgent!!! My computer seems to be hacked, pls HELP!!!
      ... Then run a rootkit ... would harden ssh access, ... Reinstalling a system is far easier and quicker than ...
      (comp.security.ssh)