Re: [linux-security] Re: Bind Overrun Bug and Linux

[The Nolander <nolander krixor xy org>]

On Tue, 19 May 1998, Leigh Porter wrote:

> It seems that the purpotrator used ncftp to get a file called "hide" from various
> systems which no longer seem to have this. This file contained an archive of
> the trojan's that were inserted into the compromised system - does anybody know
> what is in these trojans?

Check the Linux RootKit ... (LRK)..

Typically LRK to use config-files.. (and typically LRK-users to place
files in /dev.. find /dev -type f | grep -v MAKEDEV.. examine results)

ps
ls
top
netstat
ifconfig
linsniff
login

I think those are the ones included in LRK..