Re: ksyslogd

["Frazier, Thomas" <Thomas.Frazier () USA XEROX COM>]

Mamo,

Check the focus-linux list.  There is a discussion going on right now about
this same thing.  It looks like a trojan.

Tom Frazier
Systems Specialist
Corporate Information Security
------------------------------
 Thomas.Frazier () usa xerox com
------------------------------
-----Original Message-----
From: mamo [mailto:mamo () ductape net]
Sent: Thursday, October 12, 2000 3:43 PM
To: INCIDENTS () SECURITYFOCUS COM
Subject: ksyslogd


Hi everybody,

Do you know of a rootkit, or something like that, that install this
line in /etc/inittab:
ld:345:respawn:/usr/sbin/ksyslogd         ?!?

The system is a RedHat 6.2

Thanks in advance
 mamo                          mailto:mamo () ductape net