RE: [cobalt-users] HaQ'd? Or not? Lion tracks...

["Jay Jennings" <jennings@xxxxxxxxxx>]

> - root's crontab has a line to run /usr/sbin/init every 5 minutes
> - there is a /usr/sbin/init file (normally isn't)
> - Do a search for files owned by group 'wheel' (infected files if
> got in via
> named)
> - /usr/bin/xcat (old /bin/login)
> - /bin/login is chattr +i'd (use lsattr to list attributes)
> - file called /etc/named/a that is a little script
> - turn off named, and run: netstat -tan |grep LISTEN .. if you see port 53
> still open, it's bad.. heh..

Okay, all that stuff came up negative, so I guess I'll assume I wasn't
successfully HaQ'd this time. But I'll keep an eye on things for a while...
:)

 ..jj..