Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I checked my linux server with rkhunter, I got following warning messages,

...

[00:35:35] Found file '/usr/include/gpm2.h'. Possible rootkit: Trojaned SSH daemon

[00:35:35] Found file '/etc/rpm/sshdOLD'. Possible rootkit: Trojaned SSH daemon (original sshd binary)

[00:35:35] Found file '/etc/rpm/sshOLD'. Possible rootkit: Trojaned SSH daemon (original ssh binary)

...

[00:35:57] Found string '/usr/include/gpm2.h' in file '/usr/sbin/sshd'. Possible rootkit: Trojaned SSH daemon

[00:35:57] Found string '/usr/include/gpm2.h' in file '/usr/bin/ssh'. Possible rootkit: Trojaned SSH daemon

...

After I Googled these details, I understood that these all are SSH rootkits. I need to know how to remove these things from server and make it secure (CentOS with SSH remote access).

share|improve this question

marked as duplicate by Adnan, NULLZ, Noordung, Gilles, Terry Chia Jul 13 '13 at 3:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3  
The easiest way is probably the triple-R: reformat, reinstall from known good media and restore (quite possibly selectively) from a known good backup. Also known as "nuke from orbit". Make sure you install all available updates, particularly security-related updates, and preferably do the reinstall from behind a tightly configured firewall (no remote access until everything is up to date!). –  Michael Kjörling Jul 12 '13 at 8:19
    
This question is possibly too localized, but the most common recommendation is indeed to "nuke it from orbit", as it's said in the industry. For more information, you can refer to one of my previous answers to a somewhat similar question, but with much the same recommendations. It lists recommended steps you should take to get rid of the rootkit and also prevent it infecting your server in the future. Hope it helps. ;) –  Noordung Jul 12 '13 at 15:01
    
This question appears to be off-topic because it is too localized and unlikely to help future visitors. The standard recommendation in case of such infections is much discussed throughout our Q&A, and has many answers on similar questions. –  Noordung Jul 12 '13 at 15:03
    

1 Answer 1

up vote 11 down vote accepted

Removal? Forget about it. There is unauthorised root access to your server; anything could have been installed by now and you would have no reliable way to detect it.

Even for a forensic expert with local access, it would take a long time to completely audit a system to ensure no trace of extant malware.

The only reasonable and responsible course is to wipe the disc and reinstall/reimage the OS from a trusted source.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.