Rootkitin başarıyla silindimi diye soruyorlar ayrıca bu taramayı yaparken hangi script i kullandıgınızı bilmek istiyorlar vede son olarak bunun serverden silinip silinmediğini soruyorlar. Buna yaptığınız işleme göre cevap verin yoksa bugun tekrar kapatılacaklar sunucunuzu.

merhaba ; Server'imle ilgili önemli bir problemim var. Layeredtech'den aldıgım server'a perl dosyaları upload edilip, spam mail atılıyor server'ımdan. Layered bu sorunu halledin kapatırız demiş. Bende maili geç okuyunca kapatmışlar. Sonra yeniden açtırdım, rootkit hunter kurdum. Ama sunucu yönetiminden pek anlamıyorum. Bahsi geçen perl dosyalarınıda sildim. Daha doğrusu maillerin icinde bulundugu txt dosyaları. Herneyse ; mail attım layered'e, sanırım hallettim birde siz kontrol edin diye. Simdi bana 3 tane mail gelmis : Greetings! You have mentioned nothing regarding the abuse issue which was scanning other computers/networks for vulnerabilities. One of your responses indicates rkhunter found a rootkit on your system. Has the rootkit been successfully removed? Did you find the specific script used for this scanning incident? Has it been removed from the server?

Rootkit'i kurdum kurmasına ; çalıştırdım da.. Bir kaç tane zararlı dosya buldu. Fakat bu dosyaları nasıl yok edeceğim? Silmek istediğimde yetkiniz yok diyor. Öyle demesi de normal. Çünkü sıradan dosyalar değil. Bakın rkhunter'in verdiği sonuçları göstereyim : Rootkit Hunter 1.2.8 is running Determining OS... Ready Checking binaries Selftests Strings System tools Info: prelinked files found Performing 'known good' check... /bin/cat /bin/chown /bin/df /bin/echo /bin/egrep /bin/fgrep /bin/grep /bin/kill /bin/login /bin/ls /bin/more /bin/mount /bin/netstat /bin/ps /bin/sort /bin/su /sbin/depmod /sbin/ifconfig /sbin/init /sbin/insmod /sbin/ip /sbin/ksyms /sbin/lsmod /sbin/modinfo /sbin/modprobe /sbin/rmmod /usr/bin/chattr /usr/bin/file /usr/bin/find /usr/bin/kill /usr/bin/last /usr/bin/lastlog /usr/bin/less /usr/bin/logger /usr/bin/lsattr /usr/bin/md5sum /usr/bin/passwd /usr/bin/pstree /usr/bin/sha1sum /usr/bin/size /usr/bin/slocate /usr/bin/strace /usr/bin/strings /usr/bin/test /usr/bin/top /usr/bin/w /usr/bin/whereis /usr/bin/which /usr/bin/who /usr/sbin/chroot /usr/sbin/useradd /usr/sbin/vipw /usr/sbin/xinetd Rootkit Hunter found some bad or unknown hashes. This can be happen due replaced binaries or updated packages . Be sure your hashes are fully updated . If you're in doubt about these hashes, contact the author . Check rootkits Default files and directories Rootkit '55808 Trojan - Variant A'... ADM Worm... Rootkit 'AjaKit'... Rootkit 'aPa Kit'... Rootkit 'Apache Worm'... Rootkit 'Ambient Rootkit'... Rootkit 'Balaur Rootkit'... Rootkit 'BeastKit'... Rootkit 'beX2'... Rootkit 'BOBKit'... Rootkit 'CiNIK Worm '... Rootkit 'Danny-Boy's Abuse Kit'... Rootkit 'Devil RootKit'... Rootkit 'Dica'... Rootkit 'Dreams Rootkit'... Rootkit 'Duarawkz'... Rootkit 'Flea Linux Rootkit'... Rootkit 'FreeBSD Rootkit'... Rootkit 'Fuck`it Rootkit'... Rootkit 'GasKit'... Rootkit 'Heroin LKM'... Rootkit 'HjC Kit'... Rootkit 'ignoKit'... Rootkit 'ImperalsS-FBRK'... Rootkit 'Irix Rootkit'... Rootkit 'Kitko'... Rootkit 'Knark'... Rootkit 'Li0n Worm'... Rootkit 'Lockit / LJK2'... Rootkit 'MRK'... Rootkit 'Ni0 Rootkit'... Rootkit 'RootKit for SunOS / NSDAP'... Rootkit 'Optic Kit '... Rootkit 'Oz Rootkit'... Rootkit 'Portacelo'... Rootkit 'R3dstorm Toolkit'... Rootkit 'RH-Sharpe's rootkit'... Rootkit 'RSHA's rootkit'... Sebek LKM Rootkit 'Scalper Worm'... Rootkit 'Shutdown'... Rootkit 'SHV4'... Found parts of this rootkit/trojan by checking the default files and directories Please inspect the available files, by running this check with the parameter --createlogfile and check the log file . Rootkit 'SHV5'... Found parts of this rootkit/trojan by checking the default files and directories Please inspect the available files, by running this check with the parameter --createlogfile and check the log file . Rootkit 'Sin Rootkit'... Rootkit 'Slapper'... Rootkit 'Sneakin Rootkit'... Rootkit 'Suckit Rootkit'... Rootkit 'SunOS Rootkit'...

şifreleri pm at bana sana uygunsa bakayım

Found parts of this rootkit/trojan by checking the default files and directories Please inspect the available files, by running this check with the parameter --createlogfile and check the log file . Rootkit 'Superkit'... Rootkit 'TBD '... Rootkit 'TeLeKiT'... Rootkit 'T0rn Rootkit'... Rootkit 'Trojanit Kit'... Rootkit 'Tuxtendo'... Rootkit 'URK'... Rootkit 'VcKit'... Rootkit 'Volc Rootkit'... Rootkit 'X-Org SunOS Rootkit'... Rootkit 'zaRwT. KiT Rootkit'... Suspicious files and malware Scanning for known rootkit strings Scanning for known rootkit files Testing running processes... Miscellaneous Login backdoors Miscellaneous directories Software related files Sniffer logs Trojan specific characteristics shv4 Checking /etc/rc. d/rc. sysinit Test 1 Test 2 Test 3 Checking /etc/inetd. conf Checking /etc/xinetd. conf Suspicious file properties chmod properties Checking /bin/ps Checking /bin/ls Checking /usr/bin/w Checking /usr/bin/who Checking /bin/netstat Checking /bin/login Script replacements Checking /bin/ps Checking /bin/ls Checking /usr/bin/w Checking /usr/bin/who Checking /bin/netstat Checking /bin/login OS dependant tests Linux Checking loaded kernel modules... Checking files attributes Checking LKM module path Networking Check: frequently used backdoors Port 2001: Scalper Rootkit Port 2006: CB Rootkit Port 2128: MRK Port 14856: Optic Kit Port 47107: T0rn Rootkit Port 60922: zaRwT. KiT Interfaces Scanning for promiscuous interfaces System checks Allround tests Checking hostname... Found. Hostname is tr. Checking for passwordless user accounts... OK Checking for differences in user accounts... OK. No changes. Checking for differences in user groups... OK. No changes. Checking boot. local/rc. local file... - /etc/rc. local - /etc/rc. d/rc. local - /usr/local/etc/rc. local - /usr/local/etc/rc. d/rc. local - /etc/conf. d/local. start - /etc/init. d/boot. local Checking rc. d files... Processing... ... ... ... ... ... ... ... Result rc. d files check Checking history files Bourne Shell Filesystem checks Checking /dev for suspicious files... Unusual files: /dev/srd0: ASCII text Scanning for hidden files... Application advisories Application scan Checking Apache2 modules... Checking Apache configuration... Application version scan - Exim MTA 4.52 - GnuPG 1.2.3 - Apache - Bind DNS 9.2.2-P3 - OpenSSL 0.9.7a - PHP 4.4.1 - PHP 4.4.1 - Procmail MTA 3.22 - OpenSSH 3.6.1p2 Your system contains some unknown version numbers. Please run Rootkit Hunter with the --update parameter or fill in the contact form Security advisories Check: Groups and Accounts Searching for /etc/passwd... Checking users with UID '0' ... Check: SSH Searching for sshd_config... Found /etc/ssh/sshd_config Checking for allowed root login... Watch out Root login possible. Possible risk! info: Hint: See logfile for more information about this issue Checking for allowed protocols... Check: Events and Logging Search for syslog configuration... Checking for running syslog slave... Info: Cannot find syslog/syslog-ng daemon Checking for logging to remote system... Scan results MD5 MD5 compared: 85 Incorrect MD5 checksums: 9 File scan Scanned files: 342 Possible infected files: 4 Possible rootkits: Flea Linux Rootkit SHV4 SHV5 SunOS Rootkit Application scan Vulnerable applications: 3 Scanning took 53 seconds Do you have some problems, undetected rootkits, false positives, ideas or suggestions? Please e-mail me by filling in the contact form root@tr #

okan23' Alıntı: