I appear to be attacking others

[tengel at fluid.com (Troy Engel)]

Steve Bergman wrote:
> 
> # rpm -e --nodeps procps
> # find / -name ps -ls
> # find / -name top -ls
> # yum install procps

Another neat trick is let RPM help you find altered executables that it
knows about, in case the rootkit replaced some other things (again,
better to reinstall from scratch):

  rpm -Va

The first three characters are the most important to look at, they'll
tell you if the size/md5sum is off. Here's a quick cheatsheet paste from
the man page:

  S file Size differs
  M Mode differs (includes permissions and file type)
  5 MD5 sum differs
  D Device major/minor number mismatch
  L readLink(2) path mismatch
  U User ownership differs
  G Group ownership differs
  T mTime differs

You'll see a lot of stuff, don't panic -- it's very common to get
changes listed in /etc/ and /usr/share/, among others. Pay keen
attention to anything in bin (/bin, /sbin, /usr/bin, /usr/sbin, etc) as
they are the most likely targets.

-te

-- 
Troy Engel | Systems Engineer
Fluid, Inc | http://www.fluid.com