The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
2answers
124 views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with ...
0
votes
0answers
24 views

Files beginning with log being deleted [duplicate]

Im have a huge, and bizarre problem, this has occured twice no this month, on the 1st and the 13th. I run a small shared server for my clients, maybe 30 active domains, most run on the same real ...
1
vote
1answer
98 views

Rkhunter triggered last night warning for a possible infection. What next?

Last night rkhunter triggered with the following warnings: [04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk ...
2
votes
1answer
517 views

remove shared library from sshd [duplicate]

mv /lib64/libkeyutils.so.1.9 /root service sshd restart Stopping sshd: [ OK ] Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
1
vote
2answers
154 views

Squid showed up on port 8080. Possible Rootkit?

I recently attempted to connect to my EC2 server on 8080 and had some strange issues that weren't occurring earlier. NGinx (though setup for :81) captures any requests on port 8080. If I stop ...
2
votes
2answers
69 views

How to keep track of the serverconfiguration: keep entire “/etc” in git

I want to keep my whole /etc folder in a git repository to track unauthorised changes by intruders and find out mistakes I could have done myself. What would be the right way to achieve this?
0
votes
2answers
137 views

Could it be that “chkrootkit” just doesn't like .hmac, .packlist, and .relocation-tag files?

I just cleaned up my hacked CentOS server (due to not updating since versino 5.3). But still, "chkrootkit" says this: Possible t0rn v8 \(or variation\) rootkit installed ...
-1
votes
3answers
202 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something ...
0
votes
2answers
112 views

How to replace infected `/lib/libsh.so` and `/etc/sh.conf` files? [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Which package does the file /lib/libsh.so belong to? I need to replace it since it was infected. Same for /etc/sh.conf. For now I ...
0
votes
1answer
300 views

Hacked CentOS 5 server - possible rootkit installed? [duplicate]

Possible Duplicate: How do I know if my Linux server has been hacked? My server's been hacked EMERGENCY I am running CentOS 5.3 and here is the result of "chkrootkit": Possible t0rn ...
-3
votes
2answers
432 views

Rootkit scanning

Are there any good services or ways to scan for rootkits and backdoors? I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
-3
votes
1answer
124 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely ...
0
votes
0answers
183 views

Possible rooted debian (wheezy) server?

The first symptom was that I couldn't connect on port 6667, thus falling of irc-servers (and was unable to connect to them again). After some tcpdumping etc. I couldn't figure out what caused this, ...
0
votes
3answers
2k views

running a high CPU consuming process, but top/htop show ALL process cpu 0%?

all. I have these weird servers can not explained as follow: htop 1 [||||||||||||||| 28.5%] Tasks: 53 total, 1 running 2 [|||||||||||||||| ...
0
votes
1answer
163 views

Scripted install of Debian backdoor/rootkit [closed]

We have a number of servers (100+) that we need to increase a certain type of security on. (sortof internal, sorry NDA). We have thought about using a rootkit of some sort that would be able to keep ...
1
vote
1answer
134 views

What is “ndptsp.tsp”?

Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp: Area: Local hard drives Description: Unknown hidden file Location: ...
0
votes
4answers
170 views

Rootkit security and learning? [closed]

Long time ago, my server was brute forced and a root kit was installed on. Since then, I have bunch of root kit checkers and Im always changing my password. However, without fully understanding how ...
4
votes
4answers
642 views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
2
votes
4answers
2k views

My computer is sending ICMP packets to arbitrary destinations

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is : Internet Control Message Protocol Type: 3 (Destination unreachable) ...
9
votes
10answers
888 views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
5
votes
3answers
857 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
3
votes
0answers
677 views

How to detect a hidden process in linux? [duplicate]

Possible Duplicate: How to detect a hidden process in linux? We have a box we suspect has been rooted at work. The question is how do we find it? I am no system administrator, but I was ...
7
votes
5answers
2k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
1
vote
1answer
88 views

HOw to view all Logs in OSSSEC system ubuntu

I have installed OSSEC It is working and sometime sending me alert email as well. But i want to see what can i type so that i can get view all the logs of what OSSEC has found in my system
0
votes
1answer
599 views

rootkit exploit on centos server

I have recenrly found a file in my folder called wunderbar_emporium its details is here What is that , how it came here and what should i check to make sure what arong has been done to system
4
votes
2answers
1k views

ifconfig showing wrong RX/TX byte count

ifconfig tells for eth0 some RX = 2,8GB, TX = 1,3GB value that cannot be real, since I recently transmitted many 10GB+ files over eth0. I would like to know if that's just some ordinary integer ...
5
votes
7answers
3k views

How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?

In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
1
vote
1answer
2k views

RtKit on my ubuntu?

Hi I just updated my ubuntu karmic Koala to Lucid Lynx and found sth strange on my file /etc/passwd. rtkit:x:120:130:RealtimeKit,,,:/proc:/bin/false Can someone tell me what it is?
4
votes
4answers
2k views

Check integrity of Debian system after possible rootkit?

I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from ...
1
vote
1answer
2k views

How to prevent wunderbar_emporium rootkit

I just learned about the wunderbar_emporium rootkit, and it sounds pretty nasty. I tested it on a few linux servers I have access to, and while it failed on two of them, it was successful on one with ...
3
votes
7answers
522 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
6
votes
5answers
12k views

how to find out what created a file?

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
8
votes
8answers
3k views

A list of Windows rootkit detection and removal tools

A list of rootkit detection and/or removal tools from publicly trusted sources: Name, Vendor, Latest release RootkitRevealer, Sysinternals, November 1 2006 Rootkit Unhooker, ep_x0ff ...
5
votes
6answers
1k views

Anti-Rootkit programs

What program do you use for detecting Rootkits? How do you know what to trust?