Linux

Ask something
Discussion Locked

Hacked into

0 helpful
5 replies

by chandras

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Someone has hacked into our Linux RedHat 7 system and luckily has only changed the index files (that I can see right now) for the websites. How can I check who and how it was done. How can I prevent this. I have applied all patches that I know off.

Thanks

5 replies

by joe prochazka

Yep sure does sound like Ramen. Generally it replaces all your index.html files on the infected system with one of its own.

The link below not only offers an in depth description but also the removal instructions.

http://www.linuxsecurity.com/articles/network_security_article-2335.html

Make sure wu-ftp, rpc.statd, and LPRng are updated to with the latest updates from RedHat these are the programs that the worm exploits.

RedHat 7 Security updates can be found at:

http://www.redhat.com/support/errata/rh7-errata-security.html

This discussion is closed to new replies.