Re: Re: Is my system compromised

[Carl Fink <carl@fink.to>]

On Sat, Feb 04, 2006 at 04:33:20PM +0100, Ben Meijering wrote:

> My question now is how to disinfect my system, how do I locate keventd
> and kflushd and how do I know for sure my system is clean ?

Remove the hard drive(s).  Mount on another system and recover data BUT NOT
PROGRAMS.

Put the drives back in and boot from a known clean Debian CD.  Reinstall
Debian and your programs.  Lock everything down using the Debian security
tips at <http://www.debian.org/security/>.  

Once you're rooted, this is way easier and more effective than trying to fix
things.
-- 
Carl Fink                                         carl@fink.to
   "Patriotism is supporting your country all the time, and your
   government when it deserves it."
                      - Mark Twain