|
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
chkrootkit (http://www.chkrootkit.org/) can be useful for that type of work. Its not the end all
be all. But its a good start. A better start is running something
like Tripwire (http://www.tripwire.org/) all along.
On or about Thu, Nov 29, 2001 at 02:02:50PM -0500, Mike Leone wrote:
> > > Sounds like a virus. It also seems that the person who this happened to
> > was
> > > logged in as root or someone with root privliges.
> >
> > A Linux virus on a floppy disk?! I hope not. And, yes, he was logged in
> as
> > root.
>
> Sounds like he may have been "rooted", then. Check for a root kit - replaced
> binaries with specially hacked ones.
>
> Logging in as root. Tsk, tsk, tsk. :-)
>
>
>
>
> ______________________________________________________________________
> Philadelphia Linux Users Group - http://www.phillylinux.org
> Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
> General Discussion - http://lists.phillylinux.org/mail/listinfo/plug
______________________________________________________________________
Philadelphia Linux Users Group - http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion - http://lists.phillylinux.org/mail/listinfo/plug
|
|