The rootkit tag has no wiki summary.
-3
votes
1answer
79 views
How do I remove a rootkit without an anti-rootkit program? [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
Windows 2000 Server.
I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
0
votes
0answers
85 views
Possible rooted debian (wheezy) server?
The first symptom was that I couldn't connect on port 6667, thus falling of irc-servers (and was unable to connect to them again). After some tcpdumping etc. I couldn't figure out what caused this, ...
0
votes
3answers
610 views
running a high CPU consuming process, but top/htop show ALL process cpu 0%?
all. I have these weird servers can not explained as follow:
htop
1 [||||||||||||||| 28.5%] Tasks: 53 total, 1 running
2 [|||||||||||||||| ...
0
votes
1answer
91 views
Scripted install of Debian backdoor/rootkit [closed]
We have a number of servers (100+) that we need to increase a certain type of security on. (sortof internal, sorry NDA).
We have thought about using a rootkit of some sort that would be able to keep ...
1
vote
1answer
66 views
What is “ndptsp.tsp”?
Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp:
Area: Local hard drives
Description: Unknown hidden file
Location: ...
0
votes
4answers
138 views
Rootkit security and learning? [closed]
Long time ago, my server was brute forced and a root kit was installed on.
Since then, I have bunch of root kit checkers and Im always changing my password. However, without fully understanding how ...
3
votes
4answers
353 views
Putting a whole linux server under source control (git)
I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
1
vote
4answers
743 views
My computer is sending ICMP packets to arbitrary destinations
My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is :
Internet Control Message Protocol
Type: 3 (Destination unreachable)
...
8
votes
10answers
769 views
Pull network or power? (for contianing a rooted server)
When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
5
votes
3answers
749 views
Weird set of shell commands in root's .bash_history
I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking.
Has anyone ever seen command like these:
echo _EoT_0.249348813417008_;
id;
echo ...
3
votes
0answers
675 views
How to detect a hidden process in linux? [closed]
Possible Duplicate:
How to detect a hidden process in linux?
We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was ...
7
votes
5answers
1k views
Pain removing a perl rootkit
So, we host a geoservice webserver thing at the office.
Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing.
Now I'm trying to clean the ...
0
votes
1answer
76 views
HOw to view all Logs in OSSSEC system ubuntu
I have installed OSSEC
It is working and sometime sending me alert email as well.
But i want to see what can i type so that i can get view all the logs of what OSSEC has found in my system
0
votes
1answer
476 views
rootkit exploit on centos server
I have recenrly found a file in my folder
called wunderbar_emporium
its details is here
What is that , how it came here and what should i check to make sure what arong has been done to system
3
votes
2answers
661 views
ifconfig showing wrong RX/TX byte count
ifconfig tells for eth0 some RX = 2,8GB, TX = 1,3GB value that cannot be real, since I recently transmitted many 10GB+ files over eth0. I would like to know
if that's just some ordinary integer ...
5
votes
7answers
1k views
How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?
In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
1
vote
1answer
2k views
RtKit on my ubuntu?
Hi I just updated my ubuntu karmic Koala to Lucid Lynx and found sth strange on my file /etc/passwd.
rtkit:x:120:130:RealtimeKit,,,:/proc:/bin/false
Can someone tell me what it is?
2
votes
4answers
1k views
Check integrity of Debian system after possible rootkit?
I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from ...
1
vote
1answer
1k views
How to prevent wunderbar_emporium rootkit
I just learned about the wunderbar_emporium rootkit, and it sounds pretty nasty. I tested it on a few linux servers I have access to, and while it failed on two of them, it was successful on one with ...
3
votes
7answers
404 views
Identifying changed files on *nix webserver
Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear.
Similar to rkhunter et ...
3
votes
5answers
6k views
how to find out what created a file?
I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
8
votes
8answers
2k views
A list of Windows rootkit detection and removal tools
A list of rootkit detection and/or removal tools from publicly trusted sources:
Name, Vendor, Latest release
RootkitRevealer, Sysinternals,
November 1 2006
Rootkit Unhooker, ep_x0ff ...
5
votes
6answers
619 views
Anti-Rootkit programs
What program do you use for detecting Rootkits? How do you know what to trust?
