RV: I am so sorry!Your hosts was hacked!

["Luis Cova" <lcova poz unexpo edu ve>]

I just recieved this mail....  I want to know if this is true...

Is it Ok to follow the instruccions given in the mail.....
what will happen if i follow the instruccions and remove all the files and
lines that they tell me...
what dos this so called worm do???????
HELP please


----- Original Message -----
From: <huckit china com>
To: <root anakin poz unexpo edu ve>
Sent: Monday, April 02, 2001 1:49 PM
Subject: I am so sorry!Your hosts was hacked!


Hello!Administrator:
I am sorry.
Your DNS server was hacked by my New variation of the ramen worm.
I am bestrow your index.html files only for awoke you path the DNS server.
Please change your password and path the DNS server to version 9.
And some backdoor in your system.
Do this follow me.:)
1.
kill the process of star.sh hack.sh scan.sh pscan ETC.
2.
remove the /tmp/ramen.tgz
3.
find the "/dev/.lib/star.sh" in the /etc/rc.d/rc.sysinit file and remove it.
4.
find the "asp stream tcp nowait root /sbin/asp " in the /etc/inetd.conf file
and remove it.
5.
find the "10008 stream tcp nowait root /bin/sh sh" in the /etc/inetd.conf
file and remove it.
6.
del the /dev/.lib

ok.
Now,You removed the 1i0n worm.
Don't forget to restar yous server.
:)

GoodLuck!

Lion
************************************
×îÐÂÍƳö¡°ÖлªµØͼ¡±
http://map.china.com