[nSLUG] big problems with Ubuntu

billdavidson at eastlink.ca billdavidson at eastlink.ca
Tue Sep 19 09:32:24 ADT 2006


On Tue, 19 Sep 2006, Dop Ganger wrote:

> My first guess would be that you've been rootkitted - try "strings 
> /sbin/udevplug | less" to see if there's anything suspicious. If you can 
> manage to get an ethernet interface up ("sudo dhclient eth0" or to manually 
> configure, "sudo bash ; ifconfig eth0 up x.x.x.x ; route add default gw 
> y.y.y.y" where x.x.x.x is your IP address, and y.y.y.y is your gateway) then 
> you can possibly reinstall with "sudo apt-get install --reinstall udev".

I once had to deal with a box that had been rootkitted, ad several files 
in /sbin, /usr/sbin, and /bin had not only been changed, their extended 
attributes had been changed -- the "undeletable" and "immutable" flags had 
been set.  So you might want to use lsattr to check those attributes 
before you attempt to reinstall, because apt-get will fail with mysterious 
permission errors if those flags are set.

Bill Davidson
billdavidson at eastlink.ca


More information about the nSLUG mailing list