[유인기]님이 남기신 글:

>안녕하세요 1247번 글을 썼던 사람입니다...
>관리자님의 답변으로 해킹 사실을 알게 되었고요
>현재도 서버 이상으로 ftp/telnet등 웹사이트도 
>바로 열리지가 않고요 자주 끊기고 있답니다...
>
>다시 서버를 셋팅해야 하는데
>현재로선 일때문에 정신이 없고
>제가 빠른 시간에 셋팅하긴 실력이 부족한 상태라
>어떻게 해야 할지 모르겠습니다...
>
>rootkit 검색 결과 아래와 같이 나오던데 
>우선 막는 방법이라도 있습니까?
>
>ROOTDIR is `/'
>Checking `amd'... not infected
>Checking `basename'... not infected
>Checking `biff'... not infected
>Checking `chfn'... not infected
>Checking `chsh'... not infected
>Checking `cron'... not infected
>Checking `date'... not infected
>Checking `du'... not infected
>Checking `dirname'... not infected
>Checking `echo'... not infected
>Checking `egrep'... not infected
>Checking `env'... not infected
>Checking `find'... not infected
>Checking `fingerd'... not infected
>Checking `gpm'... not infected
>Checking `grep'... not infected
>Checking `hdparm'... not infected
>Checking `su'... not infected
>Checking `ifconfig'... not infected
>Checking `inetd'... not tested
>Checking `inetdconf'... not found
>Checking `identd'... not infected
>Checking `killall'... not infected
>Checking `ldsopreload'... not infected
>Checking `login'... not infected
>Checking `ls'... not infected
>Checking `lsof'... not infected
>Checking `mail'... not infected
>Checking `mingetty'... not infected
>Checking `netstat'... not infected
>Checking `named'... not infected
>Checking `passwd'... not infected
>Checking `pidof'... not infected
>Checking `pop2'... not found
>Checking `pop3'... not found
>Checking `ps'... not infected
>Checking `pstree'... not infected
>Checking `rpcinfo'... not infected
>Checking `rlogind'... not infected
>Checking `rshd'... not infected
>Checking `slogin'... not infected
>Checking `sendmail'... not infected
>Checking `sshd'... not infected
>Checking `syslogd'... not infected
>Checking `tar'... not infected
>Checking `tcpd'... not infected
>Checking `tcpdump'... not infected
>Checking `top'... not infected
>Checking `telnetd'... not infected
>Checking `timed'... not found
>Checking `traceroute'... not infected
>Checking `w'... not infected
>Checking `write'... not infected
>Checking `aliens'... no suspect files
>Searching for sniffer's logs, it may take a while... nothing found
>Searching for HiDrootkit's default dir... nothing found
>Searching for t0rn's default files and dirs... nothing found
>Searching for t0rn's v8 defaults... nothing found
>Searching for Lion Worm default files and dirs... nothing found
>Searching for RSHA's default files and dir... nothing found
>Searching for RH-Sharpe's default files... nothing found
>Searching for Ambient's rootkit (ark) default files and dirs... nothing
found
>Searching for suspicious files and dirs, it may take a while... 
>/usr/lib/perl5/5.6.0/i386-linux/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Digest/MD5/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Image/Magick/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Msql-Mysql-modules/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Gimp/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/File/MMagic/.packlist
/usr/lib/perl5/site_perl/5.6.0/i386-linux/auto/Net/SSLeay/.packlist
>
>Searching for LPD Worm files and dirs... nothing found
>Searching for Ramen Worm files and dirs... nothing found
>Searching for Maniac files and dirs... nothing found
>Searching for RK17 files and dirs... nothing found
>Searching for Ducoci rootkit... nothing found
>Searching for Adore Worm... nothing found
>Searching for ShitC Worm... nothing found
>Searching for Omega Worm... nothing found
>Searching for Sadmind/IIS Worm... nothing found
>Searching for MonKit... nothing found
>Searching for Showtee... nothing found
>Searching for OpticKit... nothing found
>Searching for T.R.K... nothing found
>Searching for Mithra... nothing found
>Searching for OBSD rk v1... nothing found
>Searching for LOC rootkit ... nothing found
>Searching for Romanian rootkit ... nothing found
>Searching for anomalies in shell history files... nothing found
>Checking `asp'... not infected
>Checking `bindshell'... not infected
>Checking `lkm'... nothing detected
>Checking `rexedcs'... not found
>Checking `sniffer'... 
>eth0 is not promisc
>Checking `wted'... nothing deleted
>Checking `scalper'... not infected
>Checking `slapper'... not infected
>Checking `z2'... 
>nothing deleted
>
>
>방법 있음 갈쳐주세요...
>빠른 시일에 셋팅은 해야겠는데...
>
>새해 복 많이 받으세요.. 

========================================

check rootkit 은 크래커가 설치해 놓은 rootkit을 찾는 툴에
지나지 않습니다.

위의 결과로 봐서는 다행이 rootkit은 없는것 같군요..

그외에 백도어나 이상한 데몬 같은 것이 떠 있나
찾아 보아야 합니다.

그런데 90% 이상 해킹(크랙이 더 정확)당했다고 생각되면
최우선적으로
다시 설치하는 것이 좋습니다.
(일이 바쁘더라고 최우선이 다시 설치)

자료백업,
다시설치후 암호바꾸고, 보안패키지 업데이터.....

http://www.certcc.or.kr/

에서 관련 자료가 많기 때문에 참조하세요.