RE: [cobalt-users] Trinoo DDoS server in init

["Tony" <isplists@xxxxxxxxxxxx>]

+>>[root@www /root]# md5sum /sbin/init
+>>5a64a78a799ab2e0cc3c8a6f931ab2f4  /sbin/init  <== could someone else
+>> >>verify?
+
+That's what I've got... So it looks like we're good..
+
+-Craig

So which is the real init?

These appear to be the hacked files:
/usr/sbin
-rwxr-xr-x   1 root     root       318004 Feb 13 23:17 init
-rwxr-xr-x   1 root     root        35628 Feb 13 23:17 in.smb

a inetd.conf entry was added for in.smb

So the asshole scriptkiddie could connect via Samba with his daddy's windows
machine?

The good init checksum is at
/sbin
-rwxr-xr-x   1 root     root        27176 Apr 24  2000 init

Which init file is the box booting from?

Also got bad checksums on:

662c04f1e5af11fc38a82b736644b591  /usr/sbin/named
a8a65bd376f38ce3f99bed64956bdf09  /bin/netstat
60959ee2254105bfc55a2740dc1bdaab  /bin/login

This raq was fully patched too, including named.

Would replacing the bad checksum binaries secure the box until tommorrow?