RE: [cobalt-users] "Sort of" hacked?? Raq3 with some problems...

["cowbridge" <cobalt@xxxxxxxxxxxxx>]

> Ok, checking my files against those found in other posts, I've discovered
> that while my login, ls, netstat,  ps, du and find commands seem
> to be "new
> and unproved," others appear untainted (checked via Md5 checksums)
>
> I also don't seem to have all the xlogin, ld.so.hash, crth.o, etc files,
> BUT I have come across the directory (empty):
>
> usr/src/.puta
>
> This was mentioned by Rik Thomas in an earlier message (2/9). What else
> should I be looking for?
>
> Should I replace my tainted files with those found in the unhack.tar.gz
> mentioned here earlier, or....?

I'm afraid this is not sort of hacked, but definitley hacked. You have the
t0rn rootkit.

See http://www.sans.org/y2k/t0rn.htm for details.

The only remedy is to use the Restore CD, I'm afraid.

Good luck,

Roger