Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Redhat question

[BootsSiR]

/bin/ls: unrecognized prefix: do
/bin/ls: unparsable value for LS_COLORS environment variable

I get this everytime I do an ls

The directory still lists, but that preceeds it.

Any idea what causes this? It just started the other day

[Steven]

You are infected with the t0rn rootkit. I suggest hiring someone good with security that knows how to remove it or get a os reinstall. The os reinstall would be better

[BootsSiR]

ewwwww

really?

Anywhere I can find info on this?

[Steven]

http://www.webhostingtalk.com/showth...hreadid=247248

http://www.webhostingtalk.com/showth...hreadid=247298

but be warned if you dont know what you are doing you might not get it all

[BootsSiR]

thanks for the info

[BootsSiR]

Checking `login'... INFECTED
Checking `pstree'... INFECTED


chkrootkit seems to come up clean except for these two files

I've followed the instructions in the other posts and removed all the crap. Any suggestions?

[BootsSiR]

as well, my syslog seems to be giving me grief

syslogd dead but pid file exists
klogd (pid 7839 6202 5986 3845 3145) is running...

[BootsSiR]

I can have my OS reloaded... what can I do to prevent this from happening again??

[BootsSiR]

one last question while I'm at it

Is it safe to say that users home directories are safe to backup and restore when my os reload is complete?

I don't want to carry over any of this crap!