<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 11/20/2012 02:18 PM, David Tomaschik
wrote:<br>
</div>
<blockquote
cite="mid:CAOy4Vzf0pHH5RV7M7bLnjEXUL13UABWVJRJZ42i_HE9TfekSKw@mail.gmail.com"
type="cite">Looks like it's targeting 64-bit Debian: <a
moz-do-not-send="true"
href="https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012">https://threatpost.com/en_us/blogs/new-linux-rootkit-emerges-112012</a><br
clear="all">
<div><br>
</div>
-- <br>
David Tomaschik<br>
OpenPGP: 0x5DEA789B<br>
<a moz-do-not-send="true" href="http://systemoverlord.com"
target="_blank">http://systemoverlord.com</a><br>
<a moz-do-not-send="true" href="mailto:david@systemoverlord.com"
target="_blank">david@systemoverlord.com</a><br>
</blockquote>
Quick question - how does determine if the rootkit is running? I
tried ps -u foo and did not see any listings for its processes.
Also, the article was some what confusing about who is at risk. The
kernel mentioned is used by Debian but it is an older version (2
something) not a 3 series and it is not clear to me if that is
important.<br>
<br>
I am using Mint 13 64 bit<br>
<pre class="moz-signature" cols="72">--
Jay Lozier
<a class="moz-txt-link-abbreviated" href="mailto:jslozier@gmail.com">jslozier@gmail.com</a></pre>
</body>
</html>