What you asked for is unchanges programs. By installing the RPMS (again) you restore the original versions. That's what you wanted, didn't you ?
Anyway, if I were you, I'd store my data somewhere safe and restore the box. Taco ----- Original Message ----- From: "Christopher Lange" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, December 02, 2001 22:09 Subject: Re: [cobalt-security] root kitted :( > Taco, > > By reinstalling these RPMS' from the ftp site, would we need to reinstall > any packages such as the kernel package that was distributed? > > -- > Christopher Lange > > ----- Original Message ----- > From: "Taco Scargo" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Saturday, December 01, 2001 2:18 PM > Subject: Re: [cobalt-security] root kitted :( > > > Get the rpms and install them with rpm -U --force from > ftp.cobaltnet.com/pub/products/raq4/RPMS > See what rpm you need with rpm -qif /path/to/file > > With regards, > > Taco Scargo > Professional Services Manager, EMEA > > Sun Microsystems > Sun Cobalt Server Appliances > ----- Original Message ----- > From: "Mike Jeffers" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Saturday, December 01, 2001 5:41 > Subject: [cobalt-security] root kitted :( > > > > I have reason to believe that I am a victim of a root kit and have false > > copies of the following binaries: > > > > w > > ps > > ls > > > > I have since thrown up a few ipchains rules as a temporary stop gap, but > > would like to further investigate the perpetrator's kit before I format > > and restore. Without having good copies of these files, finding where > > on my file system he dropped off his kit is like looking for a needle > > in a hay stack. > > > > I'm looking to get known good copies of these binaries, could anyone lend > > a hand and get me good copies? (I'm on a RaQ4, BTW) > > > > Many thanks in advance, > > > > -Mike > > > > _______________________________________________ > > cobalt-security mailing list > > [EMAIL PROTECTED] > > http://list.cobalt.com/mailman/listinfo/cobalt-security > > > > _______________________________________________ > cobalt-security mailing list > [EMAIL PROTECTED] > http://list.cobalt.com/mailman/listinfo/cobalt-security > > > _______________________________________________ > cobalt-security mailing list > [EMAIL PROTECTED] > http://list.cobalt.com/mailman/listinfo/cobalt-security > _______________________________________________ cobalt-security mailing list [EMAIL PROTECTED] http://list.cobalt.com/mailman/listinfo/cobalt-security
