RE: [cobalt-users] Trinoo DDoS server in init

["Tony" <isplists@xxxxxxxxxxxx>]

+> I was hacked a few days ago, and it looks as though my
+/usr/sbin/init file
+> has been replaced with a version containing a Trinoo DDoS
+server. The init
+> file /sbin/init appears untouched however. Is /sbin/init the same file as
+> /usr/sbin/init, or are they different. If they are different, could
+someone
+> possibly attach a clean version to an e-mail or put it up on a web site
+etc?
+>
+
+
+
+[root@www /root]# ls -l /usr/sbin/init
+ls: /usr/sbin/init: No such file or directory
+
+[root@www /root]# ls -l /sbin/init
+-rwxr-xr-x   1 root     root        27176 Apr 25  2000 /sbin/init
+
+[root@www /root]# md5sum /sbin/init
+5a64a78a799ab2e0cc3c8a6f931ab2f4  /sbin/init  <== could someone
+else verify?
+
+
+other md5 checksums here:
+
+http://list.cobalt.com/pipermail/cobalt-users/2001-February/032902.html


Mine matches:

[root /sbin]# md5sum init
5a64a78a799ab2e0cc3c8a6f931ab2f4  init

The bogus init is at /usr/sbin

Looks like they also enabled samba.

*!GDMOFOS.

I would really like to see the scriptkiddies that are behind this have
everyone of their fingers chopped off with a pair of pruning shears.