The rootkit tag has no wiki summary.
3
votes
2answers
124 views
Rootkit Revealer is failing to run, why? [duplicate]
On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
0
votes
0answers
24 views
Files beginning with log being deleted [duplicate]
Im have a huge, and bizarre problem, this has occured twice no this month, on the 1st and the 13th.
I run a small shared server for my clients, maybe 30 active domains, most run on the same real ...
1
vote
1answer
98 views
Rkhunter triggered last night warning for a possible infection. What next?
Last night rkhunter triggered with the following warnings:
[04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk
...
2
votes
1answer
517 views
remove shared library from sshd [duplicate]
mv /lib64/libkeyutils.so.1.9 /root
service sshd restart
Stopping sshd: [ OK ]
Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
1
vote
2answers
154 views
Squid showed up on port 8080. Possible Rootkit?
I recently attempted to connect to my EC2 server on 8080 and had some strange issues that weren't occurring earlier.
NGinx (though setup for :81) captures any requests on port 8080.
If I stop ...
2
votes
2answers
69 views
How to keep track of the serverconfiguration: keep entire “/etc” in git
I want to keep my whole /etc folder in a git repository to track unauthorised changes by intruders and find out mistakes I could have done myself.
What would be the right way to achieve this?
0
votes
2answers
137 views
Could it be that “chkrootkit” just doesn't like .hmac, .packlist, and .relocation-tag files?
I just cleaned up my hacked CentOS server (due to not updating since versino 5.3). But still, "chkrootkit" says this:
Possible t0rn v8 \(or variation\) rootkit installed
...
-1
votes
3answers
202 views
Entries in `/etc/inittab` below last line - possible hack? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My Linux machine has been hacked lately.
There are a few entires in /etc/inittab below the
#end of /etc/inittab
Something ...
0
votes
2answers
112 views
How to replace infected `/lib/libsh.so` and `/etc/sh.conf` files? [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
Which package does the file /lib/libsh.so belong to?
I need to replace it since it was infected. Same for /etc/sh.conf.
For now I ...
0
votes
1answer
300 views
Hacked CentOS 5 server - possible rootkit installed? [duplicate]
Possible Duplicate:
How do I know if my Linux server has been hacked?
My server's been hacked EMERGENCY
I am running CentOS 5.3 and here is the result of "chkrootkit":
Possible t0rn ...
-3
votes
2answers
432 views
Rootkit scanning
Are there any good services or ways to scan for rootkits and backdoors?
I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
-3
votes
1answer
124 views
How do I remove a rootkit without an anti-rootkit program? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
Windows 2000 Server.
I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
0
votes
0answers
183 views
Possible rooted debian (wheezy) server?
The first symptom was that I couldn't connect on port 6667, thus falling of irc-servers (and was unable to connect to them again). After some tcpdumping etc. I couldn't figure out what caused this, ...
0
votes
3answers
2k views
running a high CPU consuming process, but top/htop show ALL process cpu 0%?
all. I have these weird servers can not explained as follow:
htop
1 [||||||||||||||| 28.5%] Tasks: 53 total, 1 running
2 [|||||||||||||||| ...
0
votes
1answer
163 views
Scripted install of Debian backdoor/rootkit [closed]
We have a number of servers (100+) that we need to increase a certain type of security on. (sortof internal, sorry NDA).
We have thought about using a rootkit of some sort that would be able to keep ...
1
vote
1answer
134 views
What is “ndptsp.tsp”?
Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp:
Area: Local hard drives
Description: Unknown hidden file
Location: ...
0
votes
4answers
170 views
Rootkit security and learning? [closed]
Long time ago, my server was brute forced and a root kit was installed on.
Since then, I have bunch of root kit checkers and Im always changing my password. However, without fully understanding how ...
4
votes
4answers
642 views
Putting a whole linux server under source control (git)
I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
2
votes
4answers
2k views
My computer is sending ICMP packets to arbitrary destinations
My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is :
Internet Control Message Protocol
Type: 3 (Destination unreachable)
...
9
votes
10answers
888 views
Pull network or power? (for contianing a rooted server)
When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
5
votes
3answers
857 views
Weird set of shell commands in root's .bash_history
I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking.
Has anyone ever seen command like these:
echo _EoT_0.249348813417008_;
id;
echo ...
3
votes
0answers
677 views
How to detect a hidden process in linux? [duplicate]
Possible Duplicate:
How to detect a hidden process in linux?
We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was ...
7
votes
5answers
2k views
Pain removing a perl rootkit
So, we host a geoservice webserver thing at the office.
Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing.
Now I'm trying to clean the ...
1
vote
1answer
88 views
HOw to view all Logs in OSSSEC system ubuntu
I have installed OSSEC
It is working and sometime sending me alert email as well.
But i want to see what can i type so that i can get view all the logs of what OSSEC has found in my system
0
votes
1answer
599 views
rootkit exploit on centos server
I have recenrly found a file in my folder
called wunderbar_emporium
its details is here
What is that , how it came here and what should i check to make sure what arong has been done to system
4
votes
2answers
1k views
ifconfig showing wrong RX/TX byte count
ifconfig tells for eth0 some RX = 2,8GB, TX = 1,3GB value that cannot be real, since I recently transmitted many 10GB+ files over eth0. I would like to know
if that's just some ordinary integer ...
5
votes
7answers
3k views
How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?
In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
1
vote
1answer
2k views
RtKit on my ubuntu?
Hi I just updated my ubuntu karmic Koala to Lucid Lynx and found sth strange on my file /etc/passwd.
rtkit:x:120:130:RealtimeKit,,,:/proc:/bin/false
Can someone tell me what it is?
4
votes
4answers
2k views
Check integrity of Debian system after possible rootkit?
I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from ...
1
vote
1answer
2k views
How to prevent wunderbar_emporium rootkit
I just learned about the wunderbar_emporium rootkit, and it sounds pretty nasty. I tested it on a few linux servers I have access to, and while it failed on two of them, it was successful on one with ...
3
votes
7answers
522 views
Identifying changed files on *nix webserver
Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear.
Similar to rkhunter et ...
6
votes
5answers
12k views
how to find out what created a file?
I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
8
votes
8answers
3k views
A list of Windows rootkit detection and removal tools
A list of rootkit detection and/or removal tools from publicly trusted sources:
Name, Vendor, Latest release
RootkitRevealer, Sysinternals,
November 1 2006
Rootkit Unhooker, ep_x0ff ...
5
votes
6answers
1k views
Anti-Rootkit programs
What program do you use for detecting Rootkits? How do you know what to trust?
