Questions tagged [rootkit]
The rootkit tag has no usage guidance.
8
questions
0
votes
1
answer
3k
views
Hacked CentOS 5 server - possible rootkit installed? [duplicate]
Possible Duplicate:
How do I know if my Linux server has been hacked?
My server's been hacked EMERGENCY
I am running CentOS 5.3 and here is the result of "chkrootkit":
Possible t0rn v8 \(...
5
votes
8
answers
917
views
Identifying changed files on *nix webserver
Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear.
Similar to rkhunter et ...
11
votes
10
answers
1k
views
Pull network or power? (for contianing a rooted server)
When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
8
votes
8
answers
9k
views
A list of Windows rootkit detection and removal tools
A list of rootkit detection and/or removal tools from publicly trusted sources:
Name, Vendor, Latest release
RootkitRevealer, Sysinternals,
November 1 2006
Rootkit Unhooker, ep_x0ff (now working at ...
6
votes
6
answers
8k
views
Check integrity of Debian system after possible rootkit?
I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from ...
1
vote
1
answer
2k
views
How to prevent wunderbar_emporium rootkit
I just learned about the wunderbar_emporium rootkit, and it sounds pretty nasty. I tested it on a few linux servers I have access to, and while it failed on two of them, it was successful on one with ...
-1
votes
3
answers
758
views
Entries in `/etc/inittab` below last line - possible hack? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
My Linux machine has been hacked lately.
There are a few entires in /etc/inittab below the
#end of /etc/inittab
Something like:
#...
-3
votes
1
answer
242
views
How do I remove a rootkit without an anti-rootkit program? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
Windows 2000 Server.
I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely for ...