Check integrity of Debian system after possible rootkit?

Posted by artvolk on Server Fault See other posts from Server Fault or by artvolk
Published on 2010-03-19T06:45:36Z Indexed on 2010/03/19 6:51 UTC
Read the original article Hit count: 358

Filed under:

debian

|

rootkit

Good day!

I have a system that was possible rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from 4.0. I'm afraid that something in folders I've mentioned was modified. I can't reinstall the box, so if there any way to check integrity of the system?

P.S. I have already checked rkhunter and chrootkit.

Thanks in advance!

© Server Fault or respective owner

Related posts about debian

Trying to update debian not working

as seen on Super User - Search for 'Super User'
As root i type this command apt-get update and get these error messages. > Err http://security.debian.org lenny/updates Release.gpg Could not resolve 'security.debian.org' Err http://security.debian.org lenny/updates/main… >>> More
Trouble with dns and debian update

as seen on Server Fault - Search for 'Server Fault'
I tried to update my debian dreamplug server with the command running as root apt-get update and recieved these errors. Err http://security.debian.org lenny/updates Release.gpg Could not resolve 'security.debian… >>> More
Errors when installing Open Office

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I followed the first set of instructions on this page to install Open Office: How to install Open Office? However, the last step which says to change the CHMOD of a folder, I got an error saying that the directory does not exist. Open Office now appears in my Ubuntu start menu, but clicking… >>> More
Installing PHP4 on a Debian (lenny) 7 32bit box

as seen on Server Fault - Search for 'Server Fault'
I am trying to install PHP4 on a Debian 7 32bit box but I ran into the following root@php4:~# apt-get update Get:1 http://snapshot.debian.org lenny Release.gpg [189 B] Hit http://snapshot.debian.org lenny Release Ign http://snapshot.debian.org lenny Release Hit http://snapshot.debian.org lenny/main… >>> More
Debian keyring error: "No keyring installed"

as seen on Server Fault - Search for 'Server Fault'
I have a Debian Squeeze EC2 AMI. On booting up an instance with it and trying to install packages with apt-get I get errors saying there is no keyring installed. Here is the error with apt-get update: root@ip:~# apt-get update Get:1 http://ftp.us.debian.org squeeze Release.gpg [1672 B] Ign http://ftp… >>> More

Related posts about rootkit

Rkhunter 122 suspect files; do I have a problem?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 warnings. Please advise. casey@Shaman:~$ sudo rkhunter -c [ Rootkit Hunter version 1.4.0 ] Checking… >>> More
Microsoft Says Rootkit Causes XP 'Blue Screens'

as seen on Internet.com - Search for 'Internet.com'
After a week-long investigation, Microsoft bug sleuths claim they've hunted down the cause of multiple reboots and crashes inflicted on Windows XP users. >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Latest Microsoft Patch Aims To Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
Patch meant to kill off 17-year-old bug was suspected of causing multiple crashes and continuous reboots, but the problems were traced to a rootkit. But since the patch won't install on infected systems, what will users do now? >>> More
Microsoft Redux: Windows XP Patch Back to Block Rootkit

as seen on Internet.com - Search for 'Internet.com'
The software giant re-releases the bug patch that some Windows XP users blamed for repeated restarts and blue screen crashes following February's Patch Tuesday release. >>> More