full-disclosure - Removing ShKit Root Kit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3FE63AC7.8070200@cr-secure.net>
From: chris at cr-secure.net (Chris)
Subject: Removing ShKit Root Kit

Can anyone reccomend some links or useful information for removing the 
"ShKit Rootkit". CHKROOTKIT detected this thing on a RedHat 8.0 server 
owned by a client of mine.

"Searching for ShKit rootkit default files and dirs... Possible ShKit 
rootkit installed" <== chkrootkit output

I have only read limited information on this rootkit from a honeypot 
report where it was used, no cleaning information. Ive googled a bunch 
of times, dont go out of your way to answer this, the box will be redone 
anyway. Im just curious to find out what this rootkit is about, not even 
packetstorm has a copy to look at :)

Thanks,

ChrisR-
http://www.cr-secure.net