Re: [cobalt-users] t0rn's v8 rootkit installed

["PageKeeper Service" <host@xxxxxxxxxxxxxxxxxxxxx>]

----- Original Message ----- 
From: "Ted" <ted@xxxxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Tuesday, April 20, 2004 6:09 PM
Subject: [cobalt-users] t0rn's v8 rootkit installed


> Any easy ways to fix this problem without reloading the OS?

No. not really. I would cmu/av-scan the sites to another machine.
but found this.., may help if you want to delouse it:
http://www.sans.org/y2k/t0rn.htm
http://forums.servermatrix.com/viewtopic.html?p=33724
http://list.cobalt.com/pipermail/cobalt-security/2001-June/002655.html

  David Hahn
  PageKeeper Service
  1512 Deborah Road #102
  Rio Rancho, New Mexico 87124 US
  505-892-8723
  http://www.pagekeeperservice.com