Re: tools to run on compromised linux box

["linux.gheek" <linux.gheek () gmail com>]

Hello,
First let us know whether the said system is still up and running or not.

If it is up its good for live analysis. You may come to know what 
exactly happening on the system.  You may use any live CD and boot in 
parallel and try to find out what ports are listening, run nessus or 
other vulnerability scanners, check what files are open for what ports etc..

If you have earlier installed any integrity checker on the said system 
you may check it also.

If the system id down you have to use dead analysis tools like sleuthkit 
and autopsy etc.

Thanks,
Mukesh




lister () lihim org wrote:
> Can anyone recommend some tools to run on a compromised linux
> box to determine if there is further infestation? (rootkits, etc).
>
>