Once upon a time, [EMAIL PROTECTED] wrote :
>
> There's also the Lyon (or Lion) worm that came after Ramen.
> You can download chkrootkit from www.chkrootkit.org to test for them
(it's
> also useful to learn some security things).
> Best regards
>
> Miguel Dilaj
The only rootkited machine I've encountered so far was infected with the
"t0rn" kit, so I don't know wether the Lion or Ramen worm are more
intelligent, but this one did not compromise nor change anything in the
rpm database.
A simple "rpm -Va" reported many file changes on binaries like "ps" and
others ;-)
As often, rpm is your friend! ;-)))
Matthias
--
Matthias (Thias) Saou http://www.marmotte.net/
--------------------- French - Canadian - Spanish resident
http://rpmforge.net/ - Hairy and scary RPM related projects
http://freshrpms.net/ - RPMs just like mom used to make them
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
