Re: Removing ShKit Root Kit

["Paul J. Morris" <mole () morris net>]

On Mon, 22 Dec 2003 13:52:57 -0600
"Schmehl, Paul L" <pauls () utdallas edu> wrote:
> This advice is common, and it's always mystified me.  Why would you
> want backups of the "data"?  
    Because you may not hold a master copy of the data elsewhere or have
made a backup copy yet.  There may be data on the compromised machine
that have entered it from the internet such that you only obtain
alternate copies of when you make a backup of the data on that machine. 
The current subscriber base for an email listserver (where new subscribe
and unsubscribe requests may have arrived since the last backup) comes
to mind.  
-Paul
-------------
Paul J. Morris  
Biodiversity Information Manager, The Academy of Natural Sciences
1900 Ben Franklin Parkway, Philadelphia PA, 19103, USA
mole () morris net  1-215-299-1161  AA3SD  PGP public key available

Attachment: _bin
Description: