[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Can't reboot, shutdown, or init 3 [I've been root-kitted, please advise]



Tom Diehl wrote:

On Sun, 3 Apr 2005, Arthur Pemberton wrote:



Arthur Pemberton wrote:



I can't reboot, shutdown, or init 3. And I keep gettign sgmentation fault errors

On any of these attempts i get:

/dev/null
RK_Init: idt=0xc03a3000, FUCK: IDT table read failed (offset 0xc03a3000)

I'm going to bring my server down now, please advise.



Looks like i've been root ktited :(

My googling turned up this, which shows a case of my symptoms.

:(

How do I recover from this



If you have been rooted, you need to reinstall. It is the only way to be sure you got rid of it. If there is stuff you need, I would suggest installing another disk and install to it. Then you could install the old drive and mount the partitions with your data on it and retreive it. You can also do some inspection to try to figure out what happened. Just be careful not to run anything from the old drive or you might be in trouble again.

If what I just suggested makes no sense to you, you might be better off just
reinstalling and move on with life. The problem is you will never know what you
did wrong and you WILL lose everything on the old installation. If you decide
to reinstall just be sure to format the partitions. Again keep im mind you will
lose EVERYTHING!!



I'm assuming an install of FC3 will properly format the drive, so that's what I'm going to do as soon as I download, burn, and use knoppix to get my latest maildirs. I guess i should copy over /var/log too.

HTH,

Tom Diehl tdiehl rogueind com Spamtrap address mtd123 rogueind com





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]