chfn, chsh, ls, ps - INFECTED

[Nickolay A. Kritsky]

Hello Alexandru,

Sunday, April 13, 2003, 5:53:00 PM, you wrote:

AB> My machine got hacked a few days ago through the samba bug. I
AB> reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM
AB> but still...
AB> Can anyone please advise ?

AB> bash-2.05b# chkrootkit | grep INFECTED
AB> Checking `chfn'... INFECTED
AB> Checking `chsh'... INFECTED
AB> Checking `date'... INFECTED
AB> Checking `ls'... INFECTED
AB> Checking `ps'... INFECTED

This was mentioned on this list before. Is your system 5.x ?

;-------------------------------------------
; NKritsky
; mailto:nkritsky at internethelp.ru