Friday, February 25, 2011

Ok, so a server was root kit'ed. Not mine, a client's. It was on a xenserver. All the /bin files hosed. Because of this (/bin/basename /bin/hostname /bin awk, etc) was out, I couldn't get the server back online to grab all the files off of it. I am grateful the client had a near identical build to one of mine. So I copied my /bin directory to a thumb drive, and copied the files over the /bin/ directory. reboot, and system came back online, then was able to use the rootkit checker to verify, and yes, there was a rootkit. The VM still has to be re-imaged, but because it could get online, we could then backup the server of its content, and re-import them when its done.