trojan - removal problems

[Billy Verreynne (JW)]

Peter Garrett wrote:
==
root at prospero:/dev # fuser .static/dev/*
.static/dev/fd:      25148
.static/dev/stderr:  22529 25134 25148
.static/dev/stdin:   22529 25134 25148
.static/dev/stdout:  22529 25134 25148
==

Ditto. That is what I see to.

Brian, it is not a great idea deleting stuff in /dev. However, the
/dev tree can be rebuild use /dev/MAKEDEV. But this script differs
from distrib to distrib so better manpage it before trying it.

Hmm.. also maybe a good idea to do this at the console after having
booted into single user mode.


netstat and lsof also may be interesting for you as a trojan will
surely attempt network access - listening on a UDP ot TCP port...?

--
Billy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~