ひとまず、クリーンインストールは面倒くさいので、復旧作業をやってみる。
※以下のURLを参考にしました
http://www.reddit.com/r/netsec/comments/en650/details_of_the_root_kit_that_got_installed_on_my/
まず、こないだ見つけた変なファイル類を削除。
$ chattr -ai /usr/include/sslv3/dropbear
$ chattr -ai /usr/include/sslv3/mig
$ rm -rf /usr/include/sslv3
$ update-rc.d -f xfs3 remove
$ rm -rf /etc/init.d/xfs3
$ rm -rf /usr/include/mysql/mysql.hh1
$ chattr -ai \
/sbin/sysctl \
/bin/kill \
/bin/ps \
/usr/bin/free \
/usr/bin/pgrep \
/usr/bin/pkill \
/usr/bin/pmap \
/usr/bin/pwdx \
/usr/bin/skill \
/usr/bin/slabtop \
/usr/bin/snice \
/usr/bin/tload \
/usr/bin/top \
/usr/bin/uptime \
/usr/bin/vmstat \
/usr/bin/w \
/usr/bin/watch
$ rm -rf /usr/bin/w
$ rm -rf /var/spool/exim4/setuid* /var/spool/exim4/a.conf /var/spool/exim4/e.conf
$ rm -rf /var/spool/exim4/.bash_history
これで、procpsを入れ直す。
$ aptitude reinstall procps
できたっぽい！
使えなかったコマンドも使えるようになった！
netstatも使える！
$ netstat -nta | grep LISTEN
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:59997 0.0.0.0:* LISTEN
ぷぎゃー。バックドア発見。
治ったばかりのkillコマンドで、プロセス削除っと。
$ aptitude update
$ aptitude upgrade
Reading package lists... Done
Building dependency tree... Done
Reading extended state information
Initializing package states... Done
Reading task descriptions... Done
Building tag database... Done
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0B of archives. After unpacking 0B will be used.
うーん、更新されてない気がする・・・。
なんでだろう？
$ aptitude reinstall exim4
Reading package lists... Done
Building dependency tree... Done
Reading extended state information
Initializing package states... Done
Reading task descriptions... Done
Building tag database... Done
The following packages will be REINSTALLED:
exim4
0 packages upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 2080B of archives. After unpacking 0B will be used.
Writing extended state information... Done
Get:1 http://archive.debian.org
etch/main exim4 4.63-17 [2080B]
Fetched 2080B in 0s (3626B/s)
Preconfiguring packages ...
(Reading database ... 22384 files and directories currently installed.)
Preparing to replace exim4 4.63-17 (using .../archives/exim4_4.63-17_all.deb) ...
Unpacking replacement exim4 ...
Setting up exim4 (4.63-17) ...
あ、もしやそういうものなの？
もうecthでは新しいバージョン出ないってこと？
もう使うなと？
そうですか。