<p>Keep in mind most rootkits replace key binaries to stay hidden. So ps ignores the Trojan apps running, etc. <br>
I keep a static compiled toolkit on cd for just such occasions. </p>
<div class="gmail_quote">On Nov 20, 2012 3:13 PM, "Jay Lozier" <<a href="mailto:jslozier@gmail.com">jslozier@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>On 11/20/2012 02:18 PM, David Tomaschik
wrote:<br>
</div>
<blockquote type="cite">Looks like it's targeting 64-bit Debian: <a href="https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012" target="_blank">https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012</a><br clear="all">
<div><br>
</div>
-- <br>
David Tomaschik<br>
OpenPGP: 0x5DEA789B<br>
<a href="http://systemoverlord.com" target="_blank">http://systemoverlord.com</a><br>
<a href="mailto:david@systemoverlord.com" target="_blank">david@systemoverlord.com</a><br>
</blockquote>
Quick question - how does determine if the rootkit is running? I
tried ps -u foo and did not see any listings for its processes.
Also, the article was some what confusing about who is at risk. The
kernel mentioned is used by Debian but it is an older version (2
something) not a 3 series and it is not clear to me if that is
important.<br>
<br>
I am using Mint 13 64 bit<br>
<pre cols="72">--
Jay Lozier
<a href="mailto:jslozier@gmail.com" target="_blank">jslozier@gmail.com</a></pre>
</div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div>