Reporter.pl

Mirror zainfekowanej strony, która pojawiła sie na serwisie reporter.pl. A ponizej dowód na to, że to właśnie Lion stał się przyczyną problemów Reportera – na podobnym przykładznie.

Zobacz również: Lion is back

From: allan (@netvigator.com)
Subject: worm
Newsgroups: alt.linux
Date: 2001-04-18 07:34:04 PST

Hi,

I have a worm problem in my Linux 6.2. It has been 2 times in 3 days that my the index.html file in my webpages have been defaced by this worm.

The worm defaces webpages by replacing my index.html with their own index.html and the contents are as follows:

1i0n Crew

powered by

c001—–H.U.C.—-1i0n

I was wondering has anyone encountered this problem or does anyone know how to get rid of this worm?

Thanks.
Peter

——————————

From: David (thunderbolt01@netscape.net)
Subject: Re: worm
Newsgroups: alt.linux
Date: 2001-04-18 09:22:07 PST

Backup your data and then:

!!!!WARNING!!!!
THIS WILL DELETE ALL PARTITIONS AND
WIPE THE DRIVE CLEAN!!!!

!!!!YOU HAVE BEEN WARNED!!!!

To remove all partitions and wipe the drive clean.

cat /dev/zero >/dev/hdX

Then reinstall being sure to get the updates that have been out for a couple of months. Update bind, wu-ftp, LPRng and even the kernel to version 2.2.19 for starters then secure the system with a firewall.

——————————

From: Bob Martin (bmartin@ayrix.net)
Subject: Re: worm
Newsgroups: alt.linux
Date: 2001-04-18 18:32:03 PST

Sounds like you have the lion worm. check here, you may be able to clean it. http://www.chkrootkit.org
—
Bob Martin