RedHat 6.1 hacked

I seem to have been hacked; chkrootkit reports that ps, tcpd and rexedcs are infected, .bash_history has been linked to another file and there might be an LKM.

If this sounds familiar to anyone I'd be grateful for more info. The most important effect of it seems to be that ftp (wuftp) is broken - no user can log in, it rejects their passwords.

If I could get a quick fix for this to last a couple of weeks until I upgrade to 7.2 I'd be OK. All suggestions gratefully received. I am thinking along the lines of trying to replace the suspect binaries; does anyone have a 6.1 box working?

Thanks

 

 

 

 

Top