RE: LKM Trojan

It is clear that it is inevitable that you are going to format the server
sooner or later. My suggestion is that you move the web contect in another
machine, Just the web content. Export the data via NFS and mount them
read-only in the web server. The idea is to isolate web engine and the web
content. It is easier to replace an empty web server than a loaded web
server. Move the content to such a machine carefully checking it, and when
the migration is over reinstall the web server.

Sincerely
Mr. Olsi Lulani


-----Original Message-----
From: Eric Koldeweij [mailto:[email protected]] 
Sent: Friday, February 28, 2003 2:30 PM
To: [email protected]
Subject: Re: LKM Trojan

Well for one thing, your system is definitely not running perfectly. 
Right now it's probably sending all kinds of private data out on the net 
as well as allowing illegitimate entry to just about anyone. It's a 
matter of time before some vandal gets in and starts destroying stuff.

I know it's very difficult for you to get the system offline but 
downtime is inevitable. I still strongly advise to reformat/reinstall 
and use a second server to minimize downtime. In any case there's going 
to be a lot of work and time involved. You can try to reinstall ALL rpms 
and find and eliminate the malicious kernel module(s) but you won't ever 
be sure the trojan's really gone and you can never trust the system 
again. This is (in my eyes) unacceptable for a webhosting server.

I can offer advise on lots of things to improve security and minimize 
downtime. Upgrading/reinstalling MIGHT work but don't rely on it. You 
will need to locate the malicious kernel module and destroy it. Again, I 
strongly advise on taking the safe route, set up a new server from 
scratch, apply all security patches/firewalls, chuck everything you 
don't need, copy the client's data files to the new server and have it 
act as the webserver. When it's up and running, reformat/reinstall the 
infected server.

If there was an easier way I (or anyone else on here) would certainly 
have suggested it.

Eric.

System wrote:

>Thanks Eric, I appreciate ur help on this..
>Actually its a LKM Trojan... which affected my fileutils and net-tools
>checksum. and the surprise is the server is runnning perfectly, except the
>single ls command which says "segmentation fault" when executed. Else
>everything is working fine.
>
>Will the upgrade of OS help???
>
>when i chkrootkit it says
>Checking `rpcinfo'... INFECTED
>Warning: Possible LKM Trojan installed
>
>Any clues for removing this.. all i got from the list is that I have to
>re-install, but to be very frank at this moment i cannot format the
>server!!!.
>
>Regards,
>Tina.
>
>  
>




_______________________________________________
enigma-list mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/enigma-list