Re: rooted with lots of files in /dev/sdc0/.nfs01

[felix () BROADBAND HU (Marianovich Felix)]

Hello Jeff!

> Has anyone seen this?
Yes, once I have same thing. I think you have take a look for the other
binaries too. E.g: /bin/login. /bin/ls, ps, netstat, etc. And try move or
delete these files. Maybe it won't work. Than look these files attributes
with lsattr command. With this command you can filter the compromised
files.

> Also, ps showed the programs scan and z0ne. But doing a find for those
> files turned up no results, even after replacing find. However, after
> rebooting, find found the files.
It is interesting... In my system was changed some of the kernel libs too.
Maybe you can change them too.

Good luck for it.

        Felix Marianovich.