Comments on: SHV5 rootkit http://www.videosharingscript.com/linux/shv5-rootkit/ All about video sharing sites Fri, 21 Nov 2008 11:13:57 +0000 http://wordpress.org/?v=2.6.3 By: admin http://www.videosharingscript.com/linux/shv5-rootkit/#comment-494 admin Wed, 16 Jul 2008 19:47:58 +0000 http://www.videosharingscript.com/?p=114#comment-494 I don't remember the full uninstall steps now. It got started with adding few lines to /etc/inittab, i removed these lines on my local test insllation and rebooted. After this i could not login to the server with SHV5 rootkit port. Running chkrootkit/rkhunter will provide the location of the files in log file, delete that too. I was able to find some files that installed by SHV 5 and delete them. I done the same on the server. Actually i want to avoid an OS reload. So i monitor the server next few days. I have upgraded the kernel and i don't face any hacking after that. I don’t remember the full uninstall steps now. It got started with adding few lines to /etc/inittab, i removed these lines on my local test insllation and rebooted. After this i could not login to the server with SHV5 rootkit port.

Running chkrootkit/rkhunter will provide the location of the files in log file, delete that too. I was able to find some files that installed by SHV 5 and delete them.

I done the same on the server. Actually i want to avoid an OS reload. So i monitor the server next few days. I have upgraded the kernel and i don’t face any hacking after that.

]]> By: Yuda http://www.videosharingscript.com/linux/shv5-rootkit/#comment-489 Yuda Fri, 11 Jul 2008 04:10:02 +0000 http://www.videosharingscript.com/?p=114#comment-489 How you uninstall the rootkit and even verify that it clean ?? How you uninstall the rootkit and even verify that it clean ??

]]>