Yes, this is a know rootkit, but not a worm (i.e. it not spread itself).
Miguel Dilaj
Matthias Saou <[EMAIL PROTECTED]>@redhat.com on 20/09/2001 07:58:40
Please respond to [EMAIL PROTECTED]
Sent by: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
cc:
Subject: Re: Can Viruses be harmfull to RH ?
Once upon a time, [EMAIL PROTECTED] wrote :
>
> There's also the Lyon (or Lion) worm that came after Ramen.
> You can download chkrootkit from www.chkrootkit.org to test for them
(it's
> also useful to learn some security things).
> Best regards
>
> Miguel Dilaj
The only rootkited machine I've encountered so far was infected with the
"t0rn" kit, so I don't know wether the Lion or Ramen worm are more
intelligent, but this one did not compromise nor change anything in the
rpm database.
A simple "rpm -Va" reported many file changes on binaries like "ps" and
others ;-)
As often, rpm is your friend! ;-)))
Matthias
--
Matthias (Thias) Saou http://www.marmotte.net/
--------------------- French - Canadian - Spanish resident
http://rpmforge.net/ - Hairy and scary RPM related projects
http://freshrpms.net/ - RPMs just like mom used to make them
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
_______________________________________________
Seawolf-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/seawolf-list
