RE: [cobalt-users] Help needed

["Andy Brown" <andy.brown@xxxxxxxxxxxxx>]

<snip>
> There have been worms placed in my server recently.
> After clearing my LPD worm yesterday, I saw this today.
> Checking `lkm'... You have     5 process hidden for readdir command
> You have     5 process hidden for ps command
> Warning: Possible LKM Trojan installed
> I would like to know how do i fix this problem of mine from future
> attacks/worms.
</snip>

As Eddy suggests, kill the machine off. Do an O/S restore from the restore CD on the machine, which performs an FDISK and format of the partitions, as you don't know how deep the attack has actually gone.
It may have replaced /bin/bash with its own, it may have replaced /usr/sbin/httpd who knows!!

As for ANY breach, format and start again, learning from the mistake of not hardening/securing the machine.

After rebuilding, apply every cobalt patch, disable telnet and install SSH, install port scanning tools (such as portsentry) and use ipchains firewall rules.

Do a few searches on the lists here and you'll get information on all of the tools i've mentioned, how to install, etc, etc.

Regards,

Andy
andy@xxxxxxxxxxxxxxx
http://www.raqpak.com/ <-- Raq/Qube unofficial PKGs and support advice