There's NOTHING that can be done once root kitted

1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User

Welcome to IWETHEY!

Post #284,182 by crazy 5/7/07 11:48:53 PM Reply	There's NOTHING that can be done once root kitted Format from known media. Well, maybe boot from CD, walk the dir tree, comparing checksums, yadda yadda. But I really don't trust a rebuild at that point.
Post #284,199 by andread 5/8/07 10:22:15 AM Reply	Don't agree Play I Some Music w/ Papa Andy Saturday 8 PM - 11 PM ET All Night Rewind 11 PM - 5 PM Reggae, African and Caribbean Music [link\|http://westcottradio.org\|Tune In]
Post #284,214 by pwhysall 5/8/07 12:44:09 PM Reply	You're wrong. The security community is agreed on this. A rooted box can never be trusted again. Peter [link\|http://www.no2id.net/\|Don't Let The Terrorists Win] [link\|http://www.kuro5hin.org\|There is no K5 Cabal] [link\|http://guildenstern.dyndns.org\|Home] Use P2P for legitimate purposes! [link\|http://kevan.org/brain.cgi?pwhysall\|A better terminal emulator] [image\|http://i66.photobucket.com/albums/h262/pwhysall/Misc/saveus.png\|0\|Darwinia\|\|]

Spyware running IE - (andread) - (18) - May 7, 2007, 03:48:55 PM EDT

Re: Spyware running IE - (pwhysall) - May 7, 2007, 12:14:48 PM EDT

Creating dummy accounts on message boards and spamming. -NT - (inthane-chan) - May 7, 2007, 12:24:05 PM EDT

perhaps a click thru trojan to generate ad revenue -NT - (boxley) - May 7, 2007, 12:41:34 PM EDT

Hehehe - (crazy) - (9) - May 7, 2007, 08:28:53 PM EDT

Wrong - (andread) - (8) - May 7, 2007, 09:35:20 PM EDT

Watch it as it runs - (crazy) - (7) - May 7, 2007, 10:00:01 PM EDT

tcpdump is your friend, works under winders -NT - (boxley) - May 7, 2007, 11:29:38 PM EDT

remind me of that the next time you get root kitted :-) -NT - (boxley) - (3) - May 7, 2007, 11:30:23 PM EDT

There's NOTHING that can be done once root kitted - (crazy) - (2) - May 7, 2007, 11:48:53 PM EDT

Don't agree -NT - (andread) - (1) - May 8, 2007, 10:22:15 AM EDT

You're wrong. - (pwhysall) - May 8, 2007, 12:44:09 PM EDT

So you can be helpful after all - (andread) - (1) - May 8, 2007, 10:21:37 AM EDT

The reason you fond nothing on that .exe.... - (folkert) - May 8, 2007, 12:26:55 PM EDT

Do you know the actual spyware? - (static) - (3) - May 9, 2007, 02:03:06 AM EDT

Re: Do you know the actual spyware? - (andread) - (2) - May 10, 2007, 09:38:48 AM EDT

I like their eula - (boxley) - May 10, 2007, 09:50:49 AM EDT

WinZix is clearly the problem. - (static) - May 10, 2007, 09:58:40 PM EDT

another link to your issue - (boxley) - May 10, 2007, 01:32:44 PM EDT

Goose-bumps for any who Know.
68 ms