Re: Malware 4

2014-07-31 Thread Konstantin Olchanski
On Thu, Jul 31, 2014 at 03:45:12PM -0400, Larry Linder wrote: > > The US should just unplug China from Internet and a lot of the problem goes > away. > Nothing like a simple solution 100% guarrantied to resolve every problem. > > To night we will simply unplug the box. > Now you are getting so

Re: Malware 4

2014-07-31 Thread olli hauer
On 2014-07-31 21:45, Larry Linder wrote: > Next It is back: > Removed all of the files that are in / , /boot, usr/, /etc/rc.d/init.d > It has set up files again in /boot. > new IptabLes and IptabLex are now in /etc/rc.d as well as in /etc/rc.c/init.d > > I built and run the "rpm" script and the nu

Re: Malware 4

2014-07-31 Thread Bluejay Adametz
> The bad part is that the major disks containing our engineering files for last > 15 years may also have the program burried somewhere in the 39 G. Can you mount those file systems noexec? _Might_ help... Maybe boot from a live CD and try to scan those file systems?

Re: Malware 4

2014-07-31 Thread Larry Linder
Next It is back: Removed all of the files that are in / , /boot, usr/, /etc/rc.d/init.d It has set up files again in /boot. new IptabLes and IptabLex are now in /etc/rc.d as well as in /etc/rc.c/init.d I built and run the "rpm" script and the number of UNVerified pretty large. The common thing w

Re: Malware 4

2014-07-31 Thread Larry Linder
On Tuesday 29 July 2014 10:07 pm, Brandon Vincent wrote: > On Tue, 2014-07-29 at 17:23 -0400, Larry Linder wrote: > > If anyone is interested I will share the details. > > Larry, > > Are you running Apache Struts, Apache Tomcat, or Elasticsearch by any > chance? Please review CVE-2013-2115, CVE-201