CentOS - Apr 2005 - Need some help (been hacked)...

Hey guys...

I've recently been hacked ( or atleast I think so) and need some help 
getting my company's server back up agian.

What I need is a complete directory listing of /lib from a fully 
up-to-date 3.4 distribution.

Also, if someone could email over the libc file to erik.douglas (at) 
gmail (dot) com that would be greatly appreicated.

Thanks in advance.

On Sat, 2005-04-09 at 12:34 -0400, Erik Douglas wrote:
> Hey guys...
> 
> I've recently been hacked ( or atleast I think so) and need some help 
> getting my company's server back up agian.
> 
> What I need is a complete directory listing of /lib from a fully 
> up-to-date 3.4 distribution.
The contents of the /lib directory are unique for each install, and
totally based on the items you have installed.
> 
> Also, if someone could email over the libc file to erik.douglas (at) 
> gmail (dot) com that would be greatly appreicated.
libc isn't really a file, but there are several rpms that you might
consider libc ... the rpms: glibc and libc-client ... and maybe libstdc+
+ are all releated to libc.

If you have been hacked, you should probably not clean up the computer,
but should backup data and re-install from scratch.  If someone has
hacked you, they can have installed binary files that look like the
original but contain Trojan listeners for remote login that are hidden
from the installed programs. 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://lists.centos.org/pipermail/centos/attachments/20050409/63238f4f/attachment-0001.sig>

Johnny Hughes wrote:

[snip]
>If you have been hacked, you should probably not clean up the computer,
>but should backup data and re-install from scratch.  If someone has
>hacked you, they can have installed binary files that look like the
>original but contain Trojan listeners for remote login that are hidden
>from the installed programs. 
>  
>
That is absolutely the way to handle a hacked machine.  Unless you've 
got MD5 fingerprints of each file on the system (a la tripwire), there 
is no way of knowing where the naughty people may have stashed future 
surpises for the original poster.

Cheers,

C