<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.12.0">
</HEAD>
<BODY>
On Fri, 2007-11-30 at 09:36 -0500, Evans F. Mitchell KD4EFM / AFA2TH / WQFK-894 wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">By any chances, have you ran 'ps ax' from root and looked</FONT>
<FONT COLOR="#000000">to see what does not look like it should be there??</FONT>
</PRE>
</BLOCKQUOTE>
<PRE>
The box is already down and replaced by a backup. Implemented some of your suggestions on it.
Issue was unauthorized web site.I have bash_history logs for all the users created by hacker so
I know commands run including starting httpd. When I get back from an 11 day business trip I will
set those drives on a slow as molasses test machine and see what I can figure out...for educational purposes.
</PRE>
<BR>
B.J.<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">IF you are willing, paste your 'ps' output for us to</FONT>
<FONT COLOR="#000000">help you find the program that is running and sending out</FONT>
<FONT COLOR="#000000">the emails.</FONT>
<FONT COLOR="#000000">also review your sendmail rule set.</FONT>
<FONT COLOR="#000000">Next, to help lock down your server a little more</FONT>
<FONT COLOR="#000000">make sure you have set a password on your VNC.</FONT>
<FONT COLOR="#000000">I had and Italian 17 year old poking around one</FONT>
<FONT COLOR="#000000">of my Amateur Radio boxes via VNC, simply cause I</FONT>
<FONT COLOR="#000000">forgot to set a vnc password, so it was wide open</FONT>
<FONT COLOR="#000000">like a windoz server box without a login screen,</FONT>
<FONT COLOR="#000000">you know, the good old "I AM OPEN FOR YOUR PLEASURES..."</FONT>
<FONT COLOR="#000000">Also change your sshd, the port it is on, and do a rule</FONT>
<FONT COLOR="#000000">set that only allows a specific ip to access it.</FONT>
<FONT COLOR="#000000">I think I am correct saying you can do that as well with VNC.</FONT>
<FONT COLOR="#000000">The other option would be to stop the service all together</FONT>
<FONT COLOR="#000000">IF your not needing it.</FONT>
<FONT COLOR="#000000">Good Luck.</FONT>
<FONT COLOR="#000000">Evans F. Mitchell KD4EFM/AFA2TH/WQFK-894</FONT>
<FONT COLOR="#000000"> </FONT>
<FONT COLOR="#000000">-----Original Message-----</FONT>
<FONT COLOR="#000000">From: <A HREF="mailto:centos-bounces@centos.org">centos-bounces@centos.org</A> [mailto:<A HREF="mailto:centos-bounces@centos.org">centos-bounces@centos.org</A>] On Behalf</FONT>
<FONT COLOR="#000000">Of Alfredo Perez</FONT>
<FONT COLOR="#000000">Sent: Friday, November 30, 2007 7:40 AM</FONT>
<FONT COLOR="#000000">To: CentOS mailing list</FONT>
<FONT COLOR="#000000">Subject: Re: [CentOS] CleanLog.h</FONT>
<FONT COLOR="#000000">On Thu, Nov 29, 2007 at 04:43:44PM -0600, B.J. McClure wrote:</FONT>
<FONT COLOR="#000000">> Sad to say one of my file servers was exploited and used to run a </FONT>
<FONT COLOR="#000000">> Phishing scam. Have identified subject virus amongst other things. </FONT>
<FONT COLOR="#000000">> It appears twice in a virus scan; /sbin/z (which I assume can just be</FONT>
<FONT COLOR="#000000">> deleted) and /sys/bus/serio/drivers/atkbd/description. The latter </FONT>
<FONT COLOR="#000000">> file is also present in identical uninfected machines. I have been </FONT>
<FONT COLOR="#000000">> unable to open the file, even with root privileges, although it </FONT>
<FONT COLOR="#000000">> appears to be a text file. Any suggestions on how to proceed </FONT>
<FONT COLOR="#000000">> appreciated. Guess I could delete it and copy over the file from an</FONT>
<FONT COLOR="#000000">identical machine.</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> Thanks in advance,</FONT>
<FONT COLOR="#000000">> B.J.</FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> CentOS 5.0, Linux 2.6.18-8.1.15.el5 x86_64 16:26:48 up 10:46, 1 user, </FONT>
<FONT COLOR="#000000">> load average: 0.07, 0.08, 0.04</FONT>
<FONT COLOR="#000000">Hi Can you tell me which virus scan you are using?</FONT>
<FONT COLOR="#000000">Thanks</FONT>
<FONT COLOR="#000000">_______________________________________________</FONT>
<FONT COLOR="#000000">CentOS mailing list</FONT>
<FONT COLOR="#000000"><A HREF="mailto:CentOS@centos.org">CentOS@centos.org</A></FONT>
<FONT COLOR="#000000"><A HREF="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</A></FONT>
<FONT COLOR="#000000">_______________________________________________</FONT>
<FONT COLOR="#000000">CentOS mailing list</FONT>
<FONT COLOR="#000000"><A HREF="mailto:CentOS@centos.org">CentOS@centos.org</A></FONT>
<FONT COLOR="#000000"><A HREF="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</A></FONT>
</PRE>
</BLOCKQUOTE>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
CentOS 5.0, Linux 2.6.18-8.1.15.el5 x86_64 09:57:33 up 1 day, 4:16, 1 user, load average: 0.05, 0.06, 0.04
</TD>
</TR>
</TABLE>
</BODY>
</HTML>