Ack! I've been rooted...

[Alan]

On Fri, 2 Feb 2007 10:59:57 -0500 (EST)
"Steven W. Orr" <steveo at syslang.net> wrote:
> I read this thread and I have a question on why this problem is not 
> handled in a more direct approach instead of the blood&guts reload 
> approach: If you simply reinstall the rpm package (something like)
> 
> rpm --replacepkgs -vh rpm-4.4.1-22.i386.rpm 
> 
> then you know that the binaries are good. From there all you have to do is 

Because a good rootkit will trojan rpm to ensure that the above merely
reports it is ok and that

> rpm -Va

lies. A really good one does it via patching the kernel so the rpm binary
off CD isn't sufficient either, you need to boot off a trusted source (eg
a rescue CD, and run the rpm off the rescue cd to replace the kernel,
libraries, you name it). Or its easier to shove the disk into another box
and work on it.