victim of stealthy rootkit
Hello All,
A persistent joker attacked me with lion, ramen, and I trojan I still
haven't found. I fired-up the free ID-scripts from SANS; did a whole lot of
combing the filesystems; done away with cgi-bin; retained only root and my
account as /bin/bash; and uninstalling everything except gnome+enlightenment
and basic services - Just when I think that I've cleaned this menace out my
system, he's back to wreak more havok.
Is it possible that he rolled-up a "trojan kernel" with daemons that nmap,
lsof and grep cannot detect to be listening? Now, postfix gets 'Name service
errors' for any domain except mine; has my eth0 automatically going
promiscuous for sniffing; and even managed to lock /etc/passwd.
We're reinstalling the system but it's important for me to know how exactly
this guys does what he does. Comments, anyone?
Thanks,
Erik
_______________________________________________________
Send a cool gift with your E-Card
http://www.bluemountain.com/giftcenter/
Reply to: