Re: [cobalt-users] trojan possibly found - how do you delete them ?

[steve@xxxxxxxxx]

On Sun, 26 Oct 2003 12:07:20 -0600, "Ted" wrote

> 
> Checking `lkm'... You have     1 process hidden for
> readdir command
> You have     1 process hidden for ps command
> Warning: Possible LKM Trojan installed
> 
> found this at the post install run of chkrootkit for
> cobalt's.
> any ideas? 
> 


I had this personally not long ago and, managed to
remove them (briefly). It even infected the virus
scanner.

Unfortunately, after about 5 days they came back, so
clearly I missed something, despite scanning every file
and finding the infected ones and repairing them.

Somehow it manages to live on somewhere and come back
and haunt you.

Only real solution is a complete reload.


Bassi