fileutils Question (Last)

Hello All ,

Yeah! I have decided to move all the data to my new server. and then i'll
clean the old infected server.
But now i want to ask a last question??

If i remove fileutils-4.1-10.1 which has dependencies with other packages
( fileutils   is needed by kernel-smp-2.4.18-10
 fileutils is needed by MySQL-3.23.54a-1
 fileutils is needed by xinetd-2.3.7-4.7x
 fileutils   is needed by kernel-bigmem-2.4.18-3
fileutils   is needed by kernel-2.4.18-3
etc etc....
)
It'll Break those dependencies.
What will be the Consequences???
and if i Re-install it again will it work without affecting the
dependencies?
Or If it fails after re-installing , how do i bring it up??
What precautions should i take before doing this???

Sorry for so many questionss? I'll asure u if i got the answer this will be
my last question for TODAY ATLEAST!!! :)

Rgds,
Tina.


----- Original Message -----
From: "LULANI Olsi" <[email protected]>
To: <[email protected]>
Sent: Friday, February 28, 2003 7:47 PM
Subject: RE: LKM Trojan


> It is clear that it is inevitable that you are going to format the server
> sooner or later. My suggestion is that you move the web contect in another
> machine, Just the web content. Export the data via NFS and mount them
> read-only in the web server. The idea is to isolate web engine and the web
> content. It is easier to replace an empty web server than a loaded web
> server. Move the content to such a machine carefully checking it, and when
> the migration is over reinstall the web server.
>
> Sincerely
> Mr. Olsi Lulani
>
>
> -----Original Message-----
> From: Eric Koldeweij [mailto:[email protected]]
> Sent: Friday, February 28, 2003 2:30 PM
> To: [email protected]
> Subject: Re: LKM Trojan
>
> Well for one thing, your system is definitely not running perfectly.
> Right now it's probably sending all kinds of private data out on the net
> as well as allowing illegitimate entry to just about anyone. It's a
> matter of time before some vandal gets in and starts destroying stuff.
>
> I know it's very difficult for you to get the system offline but
> downtime is inevitable. I still strongly advise to reformat/reinstall
> and use a second server to minimize downtime. In any case there's going
> to be a lot of work and time involved. You can try to reinstall ALL rpms
> and find and eliminate the malicious kernel module(s) but you won't ever
> be sure the trojan's really gone and you can never trust the system
> again. This is (in my eyes) unacceptable for a webhosting server.
>
> I can offer advise on lots of things to improve security and minimize
> downtime. Upgrading/reinstalling MIGHT work but don't rely on it. You
> will need to locate the malicious kernel module and destroy it. Again, I
> strongly advise on taking the safe route, set up a new server from
> scratch, apply all security patches/firewalls, chuck everything you
> don't need, copy the client's data files to the new server and have it
> act as the webserver. When it's up and running, reformat/reinstall the
> infected server.
>
> If there was an easier way I (or anyone else on here) would certainly
> have suggested it.
>
> Eric.
>
> System wrote:
>
> >Thanks Eric, I appreciate ur help on this..
> >Actually its a LKM Trojan... which affected my fileutils and net-tools
> >checksum. and the surprise is the server is runnning perfectly, except
the
> >single ls command which says "segmentation fault" when executed. Else
> >everything is working fine.
> >
> >Will the upgrade of OS help???
> >
> >when i chkrootkit it says
> >Checking `rpcinfo'... INFECTED
> >Warning: Possible LKM Trojan installed
> >
> >Any clues for removing this.. all i got from the list is that I have to
> >re-install, but to be very frank at this moment i cannot format the
> >server!!!.
> >
> >Regards,
> >Tina.
> >
> >
> >
>
>
>
>
> _______________________________________________
> enigma-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/enigma-list
>
>
>
> _______________________________________________
> enigma-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/enigma-list
>
>
>