A rootkit is a selection of modified standard programs
that usually replace (among others)
ls
ps
netstat
users
and pretty much everything else you would use to check
your machine. It will also include a backdoor.
Sometimes the primary part of the rootkit is either a
module or a complete replacement of the kernel with
one that does not respond to the normal users (root)
with any info about the new owner.
Rootkits are *INSTALLED* after a successful root
exploit.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
