Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Machine compromised

Status
Not open for further replies.

deltamail

Technical User
Oct 2, 2006
1
IN
Hello,
My machine is compromised. Can anyone guide me how to fix it.
I ran rootcheck it gives me

[FAILED]: Process '8921' hidden from ps. Possible trojaned version installed.
[FAILED]: Excessive number of hidden processes. It maybe a false-positive or something really bad is going on.

How can I unhide the process?

When I start the Iptables it blocks all the ports and I can't even SSH to server.
I tried installing the apf but i get following error

iptables v1.2.11: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Please suggest.
Thanks.
 
The 'I'm rooted three step'.

Remove this machine from any network.
Boot from knoppix or some purpose built forensics
bootable.
Do forensics analysis and follow up.

HTH
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top