Re: [cobalt-users] CHkrootkit output

["PageKeeper Service" <host@xxxxxxxxxxxxxxxxxxxxx>]

> Subject: Re: [cobalt-users] CHkrootkit output
>
>
> > sounds like a Trojan of some sorts.
> > Can you see it running in top?
> >
> >
> >
> >
> > ----- Original Message -----
> > Subject: Re: [cobalt-users] CHkrootkit output
> >
> >
> > > Subject: Re: [cobalt-users] CHkrootkit output
> > >
> > >
> > > > >
> > > > > I believe that machine has been hacked. Is cron doing weird stuff?
> > Other
> > > > > processes like devine?
> > > >
> > > >
> > > > And you conclusion is based on ??
> > > Seeing it first hand. Some notes..
> > > Cron will work. Tuning it off is the problem, a process called devine
> > > will popup usually once a day and stay running. Its nasty. Believe it
> can
> > > sniff the username and pw of clients
> > > isp logins besides the system passwords. They used a wget from the
> server
> > to
> > > download it from a free isp in europe.
> > > They entered through a script called phpnuke one time and cgi (forgot
> the
> > > name) on another raq4. Other than those
> > > notes it ran fine. It also searches files for cc numbers, email
> addresses
> > > and any ftp user connections from any scripts.
> > > Once I saw that, it went offline. A reboot usually starts the ball
> rolling
> > > if I remember right,
> > > then clients can be locked out of shell and ftp along with the admin.
> mods
> > > to the hosts.deny and allow files.
> > >
> > > > Cron is fully operational and normail.
> > > >
> > > > No strange processess
>
> Google T0rn Rootkit. I think that is part of the package that was
installed.
> I'll try to find my notes.

BTW, Can anyone share the fix to keep the below out of  chkrootkits output?

/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Jcode/.packlist
/usr/lib/perl5/5.00503/i386-linux/.packlist

or with the latest MySql,

/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/DBI/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Msql-Mysql-modules/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Jcode/.packlist
/usr/lib/perl5/5.00503/i386-linux/.packlist

>
> > >   David Hahn
> > >   PageKeeper Service
> > >   1512 Deborah Road #102
> > >   Rio Rancho, New Mexico 87124 US
> > >   505-892-8723
> > >   http://www.pagekeeperservice.com
>
>
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>