Security Incidents mailing list archives

Ramen Worm removal instructions


From: Mihai Moldovanu <mihaim () PROFM RO>
Date: Thu, 18 Jan 2001 18:27:07 +0200

Ramen Worm removal instructions
=======================

1) Edit /etc/rc.d/rc.sysinit and remove the following line from file:
    On RedHat 6.x
      /usr/src/.poop/start62.sh
    On RedHat 7.0
      /usr/src/.poop/start7.sh

2) Remove the directory /usr/src/.poop/

3) On RedHat 6.x edit /etc/inetd.conf and remove the following line:
      asp stream tcp nowait root /sbin/asp
   On RedHat 7.0 remove the following file /etc/xinetd.d/asp

4) Delete /sbin/asp

5) At this point you have 2 options.  Restart the system or kill manualy
all
   synscan , start.sh , scan.sh , hackl.sh , hackw.sh processes .
   I would recomend a reboot if is possible .

--
Lead programmer,
Mihai Moldovanu (mihaim () profm ro)
WEB:    http://tfm.profm.ro/
        http://www.developers.ro/


Current thread: