barbut anyone?
Steve Holdoway <[email protected]> Wed, 16 Nov 2011 11:47:49 +1300
| Newsgroups | gmane.org.user-groups.linux.new-zealand.general |
|---|---|
| Organization | Green Gecko Global Ltd. |
| Message-ID | <1321397269.687.785.camel@steve-desktop> |
I'm trying to find out any info about malware that generates an executable called barbut[0-9], owned by root that keeps infecting a CentOS5 - patched to current - server. My google fu gets me to posts from 2007, and I'd be surprised if the same attack vector would be open. Still looking, but v. worried about the root ownership... rkhunter, log mining, etc find nothing untoward. Please feel free to contact me offlist if you feel it more appropriate. Cheers, Steve -- Steve Holdoway BSc(Hons) MNZCS <[email protected]> http://www.greengecko.co.nz MSN: [email protected] Skype: sholdowa _______________________________________________ NZLUG mailing list [email protected] http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug