full-disclosure - searching for Showtee docu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051120112014.GA19954@melpomene.jschipper.dynalias.net>
Date: Sun Nov 20 11:20:23 2005
From: j.schipper at math.uu.nl (Joachim Schipper)
Subject: searching for Showtee docu

On Sun, Nov 20, 2005 at 03:19:49AM +0100, Herr Zobel wrote:
> Hello,
> 
> im searching for more information about Showtee rootkit.
> 
> I have a system commpromised by some LKM and Showtee rootkit according to
> chkrootkit.
> 
> I got rid of libproc.a modifications but dont know where to begin
> searching for Showtee information.
> 
> Can someone direct me to any links regarding Showtee?
> 
> Thanks in advance
> Michel Zobel

There are two reasons for asking this. The first is that you have saved
the offending system's drives, and want to find out exactly what
happened after you rebuilt the system in a more secure way. In that
case, I am afraid I won't be much help, as I don't know that much about
rootkits.

The second case is that you seem to believe you can clean the box. That
is not the case. Wipe and rebuild, (more) securely this time.

		Joachim