OT - lionworm

[Yap Kung Leng]

Recently my server is attached by Lion Worm. We have try to update the bind to 8.2.3. And also check the files that is modified by the worm. One of the file that being modified by the worm is login. We seem have difficulty to replace this file with the unaffected one. Since we log into linux using this process, it didnot allow us to just overwrite the file. Is there any way to replace it with the unaffected one ? cheers..  :) KL Yap