neocontrol

[Log in to get rid of this advertisement]

Can anyone give me any info about the dreams rootkit? All I have found is that it exploits a gzip overflow.

Thanks,

unSpawn

Looking at this you can probably figure out functionality:
/dev/ida/.hpd
/usr/bin/initrd
/dev/ttyoa
/dev/ttyof
/dev/ttyop
/usr/bin/sense
/usr/bin/sl2
/usr/bin/logclear
/usr/bin/(swapd)
/usr/bin/snfs
/usr/lib/libsss

neocontrol

I'm not sure if I'm infected or not. So would reading thru those still tell me what I want to know......

unSpawn

I'm not sure if I'm infected or not. So would reading thru those still tell me what I want to know......
Probably not. (BTW, next time better post something along the lines of "My box got infected".) Show us what you've got and for how long this has been going on.

neocontrol

I ran rootkit hunter on the system. It came back with possible dreams rootkit. As for the server itself, lots of files where all highlighted in red. 15 processes where hidden. If i ran a command such as ps -A I would get the help screen for ps. If I ran just ps, it would return about 6 processes, most of them things that I was currently doing, such as, ssh, su, bash, ps.

Some programs such as nagios where not work ing correctly any more.

I think it was more of a problem of our building. They turned off the AC on this incredibly hot 100 degree weekend, and our extra AC units couldnt keep up. My partner came in and said the server room was 95 degrees. Servers shut themselves down and what not.

We didn't know if that was a false positve , so we googled up dreams rootkit, and i searched on here, and found nothing really useful.

We are setting up anohter system, so it's not the biggest deal. Just looking for some info.

unSpawn

Well, I'd still be interested in any output you have.