From owner-freebsd-security@FreeBSD.ORG  Sun Apr 13 07:07:20 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6F37C37B401
	for <freebsd-security@freebsd.org>;
	Sun, 13 Apr 2003 07:07:20 -0700 (PDT)
Received: from mail-pm.star.spb.ru (mail-pm.star.spb.ru [217.195.82.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E3AED43F93
	for <freebsd-security@freebsd.org>;
	Sun, 13 Apr 2003 07:07:18 -0700 (PDT)
	(envelope-from nkritsky@internethelp.ru)
Received: from pink.star.spb.ru ([217.195.82.10])
	by mail-pm.star.spb.ru (8.12.9/8.12.8) with ESMTP id h3DE7GSr074140;
	Sun, 13 Apr 2003 18:07:16 +0400 (MSD)
Received: from IBMKA ([217.195.82.7]) by pink.star.spb.ru with SMTP (Microsoft
	Exchange Internet Mail Service Version 5.5.2653.13)
	id HTTQ4CY9; Sun, 13 Apr 2003 18:07:16 +0400
Date: Sun, 13 Apr 2003 18:07:46 +0400
From: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
X-Mailer: The Bat! (v1.49) Personal
X-Priority: 3 (Normal)
Message-ID: <11418603780.20030413180746@internethelp.ru>
To: Alexandru Balan <Alexandru.Balan@iNES.RO>
In-reply-To: <1050241980.32076.26.camel@BSD.iNES.RO>
References: <1050241980.32076.26.camel@BSD.iNES.RO>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
cc: freebsd-security@freebsd.org
Subject: Re: chfn, chsh, ls, ps - INFECTED
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 14:07:20 -0000

Hello Alexandru,

Sunday, April 13, 2003, 5:53:00 PM, you wrote:

AB> My machine got hacked a few days ago through the samba bug. I
AB> reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM
AB> but still...
AB> Can anyone please advise ?

AB> bash-2.05b# chkrootkit | grep INFECTED
AB> Checking `chfn'... INFECTED
AB> Checking `chsh'... INFECTED
AB> Checking `date'... INFECTED
AB> Checking `ls'... INFECTED
AB> Checking `ps'... INFECTED

This was mentioned on this list before. Is your system 5.x ?

;-------------------------------------------
; NKritsky
; mailto:nkritsky@internethelp.ru