Re: barbut anyone?

Hate to say it, but root ownership means server ownership in most
cases. I'd be disinclined to trust any executables on that server now.
Especially since you say that keeps returning.

You may have done this already but to find the vector check for hidden
(ls -la) files and folders in /tmp and /var/tmp and also /dev/shm.
Look for recently modified files with find / -ctime <numdays>. Check
webserver logs for recuring IPs that you don't recognize, look for the
wget or other system commands there (in the webserver logs) as well.
And check all crontab entries by looking in /var/spool/cron. Verify
every single user on the system, make sure all passwords are strong.
Check login logs to see if there are any correlations with the malware
running. Add a monitor task to alert in case the malware process
starts and send a process list attached to that. etc

On 16 November 2011 11:47, Steve Holdoway <[email protected]> wrote:
> I'm trying to find out any info about malware that generates an
> executable called barbut[0-9], owned by root that keeps infecting a
> CentOS5 - patched to current - server.
>
> My google fu gets me to posts from 2007, and I'd be surprised if the
> same attack vector would be open. Still looking, but v. worried about
> the root ownership...
>
> rkhunter, log mining, etc find nothing untoward.
>
> Please feel free to contact me offlist if you feel it more appropriate.
>
> Cheers,
>
> Steve
>
> --
> Steve Holdoway BSc(Hons) MNZCS <[email protected]>
> http://www.greengecko.co.nz
> MSN: [email protected]
> Skype: sholdowa
>
> _______________________________________________
> NZLUG mailing list [email protected]
> http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug
>
>

_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug