Re: barbut anyone?

On Wed, Nov 16, 2011 at 11:47, Steve Holdoway <[email protected]> wrote:
> I'm trying to find out any info about malware that generates an
> executable called barbut[0-9], owned by root that keeps infecting a
> CentOS5 - patched to current - server.
>
> My google fu gets me to posts from 2007, and I'd be surprised if the
> same attack vector would be open. Still looking, but v. worried about
> the root ownership...
>
> rkhunter, log mining, etc find nothing untoward.
>
> Please feel free to contact me offlist if you feel it more appropriate.
>
> Cheers,
>
> Steve
>

It's probably this:
  http://bit.ly/vJ1xUN
  http://bit.ly/uSgXlE

You could compile the source and check the MD5 hash to see if it's the
same Trojan.

It might be in your init scripts or a .bashrc file and it could be
disguised as a 'normal' binary in /usr/bin. Check if it's connecting
to an IRC channel. As for the entry vector, do you have packages that
are not in the CentOS repos and potentially out of date? It would be
smart to take a snapshot of the current machine

If rebooting is a problem I'd setup a new machine, transfer any
services to it and then rebuild the infected machine. That way you can
migrate to CentOS 6 if you want to and only have to check the
transfered files for tampering.

_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug