Re: LKM Trojan installed

on "2-7-2003" "Craig Holmes" writ:

: On February 7, 2003 07:41 am, Rivanor P. Soares wrote:

: If this is true, then your 'ps' binary has been replaced with one that filters : certain processes from your viewing.

: The best, easiest method to determine if this is true,

... i created a directory, copied 'ps' et al to it, and used chattr on them. having a known good binary outside $PATH is something of a comfort ...

-- 
... i'm a man, but i can change,
    if i have to , i guess ...