[95113] in RedHat Linux List
Re: port 111
daemon@ATHENA.MIT.EDU (Chris Fishwick)
Thu Oct 15 08:31:35 1998
Date: Fri, 16 Oct 1998 00:02:52 +1100 (EST)
From: Chris Fishwick <rimmer@calvin.nu>
To: redhat-list@redhat.com
In-Reply-To: <199810151224.IAA11193@bomi.uqtr.uquebec.ca>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
> I think this guy has installed some kind of root-kit on his
> machine. Does anyone know of such root-kit, how they work, how to fix
> the damage and how to prevent being hacked throw that port?
I got hacked by Linux RootKit III a few months ago.. the way I 'cleaned
up' was to check the date stamp on a file I knew was modified, then grep
the entire directory tree for that date stamp and check any file that was
listed... I guess this is not the best way to do it, but it fixed the
problem until I had time to re-install the machine and close the security
holes properly...
Regards
Chris
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
