New answers tagged

1

That highly depends on the complexity of the attack. If it's a simple backdoor, you have a chance of finding/eliminating the backdoor with the following method: 1. netstat -antp search for the sending port/program and remember the pid + ip. 2. lsof -p <the pid> look up the dies which are showing up. (These are the files used by the sending ...


4

To expand on @tlng05's point, rootkit authors are professionals, often with decades of experience. Unless you have decades of experience fighting rootkits, then they'll know about more hiding places than you do :P If you suspect there's a rootkit, then your only choice is to wipe the system. This is a classic example of Ken Thompson's reflection on ...



Top 50 recent answers are included