Re: yes, its t0rn again

[Roberto <cinini () TERRA ES>]

hola,

Just wondering if anyone has some sort of fix or 
report of this kit ? I think my machines maybe 
infected with this kit to.. i was only able to find one 
directory, /lib/ldlib.tk which had the t0rn ssh with ssh 
listening on 47011, login was not backdoored and I 
was unable to locate config files (shdcf) with help of 
strings /bin/ps | grep / - which usually worked on lrk* 
kit's (old t0rn too), lsof also not help much. 

I didnt have md5 checksum's recorded so i was not 
able to compare with old ones..

Ciao,
Roberto