Re: yes, its t0rn again

hola,

Just wondering if anyone has some sort of fix or
report of this kit ? I think my machines maybe
infected with this kit to.. i was only able to find one
directory, /lib/ldlib.tk which had the t0rn ssh with ssh
listening on 47011, login was not backdoored and I
was unable to locate config files (shdcf) with help of
strings /bin/ps | grep / - which usually worked on lrk*
kit's (old t0rn too), lsof also not help much.

I didnt have md5 checksum's recorded so i was not
able to compare with old ones..

Ciao,
Roberto
Received on Jan 08 2001