Re: fileutils Question (Last)

Hi Tine,

> Hello All ,
>
> Yeah! I have decided to move all the data to my new server. and then i'll
> clean the old infected server.
> But now i want to ask a last question??
>
> If i remove fileutils-4.1-10.1 which has dependencies with other packages
> ( fileutils   is needed by kernel-smp-2.4.18-10
>  fileutils is needed by MySQL-3.23.54a-1
>  fileutils is needed by xinetd-2.3.7-4.7x
>  fileutils   is needed by kernel-bigmem-2.4.18-3
> fileutils   is needed by kernel-2.4.18-3
> etc etc....
> )
> It'll Break those dependencies.
> What will be the Consequences???
> and if i Re-install it again will it work without affecting the
> dependencies?
> Or If it fails after re-installing , how do i bring it up??
> What precautions should i take before doing this???
>
> Sorry for so many questionss? I'll asure u if i got the answer this will
be
> my last question for TODAY ATLEAST!!! :)

No. please scratch this plan. You have been hacked. LKM's are inserted, you
don't just get one via email etc. Could be that someone is waiting for a
reboot,
at which time a series of rebuilt modules will make a mess of your system.
ls, lsof,
ps etc are all potential candidates. What a lot of these guys do is break in
and
start hiding their trail by not allowing you to accurately see what's going
on in your
system. fileutils is a symptom, not a cause.

If you reboot, you stand a good chance of further destroying your system and
killing your chances of making accurate backups of data. You might also
install
a whole new set of toys that the perp has prepared but that the good
originals are
now running in memory.

Your client base just has to hang on while you rebuild from scratch. If your
electrical systems were down for a couple days, you would be offline. Just
think
of this as a disaster of some magnitude. Nobody likes it, but when it
happens we
have to deal with it.