Re: barbut anyone?

On Wed, 2011-11-16 at 18:20 +1300, Jaco wrote:
> > Hate to say it, but root ownership means server ownership in most
> > cases. I'd be disinclined to trust any executables on that server now.
> > Especially since you say that keeps returning.
> Yip - you may already be in a bad way (thinking rootkits).
> If your system is already compromised, you may need to boot up with some 
> sort of live/recovery system & try your recovery from that.
> 
> Recover what data you can & start again from a sterile environment.
> 
> This may also mean that other hosts/nodes on your network could be 
> compromised - nmap may help with analysing suspicious traffic.
> 
> Some interesting reading-material as mitigation for future reference:
> * DSD Top 35 Mitigation Strategies 
> (http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm)
> (still struggling to get my head around AppArmor/SELinux - it's a beast!)
> 
> Would be curious to know what AV's & other security 
> suites/products/solutions other folks are using (Clam just doesn't cut it)
> 
> - J
> 
> _______________________________________________
> NZLUG mailing list [email protected]
> http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug
> 

f-prot on an F14 box used as desktop / development workstation

http://www.f-prot.com/products/home_use/linux/

free for personal home use.

I run it about once a month and it never found anything so can't say how
good it is at removing viruses and malware.

Adrian



_______________________________________________
NZLUG mailing list [email protected]
http://www.linux.net.nz/cgi-bin/mailman/listinfo/nzlug