From the second link I posted above, you could try these steps to check if you're really infected.
http://forums.gentoo.org/viewtopic-t...ht-suckit.html
- The SucKIT rootkit allows an attacker to hide malicious files by giving them a particular ending. The current attacker is hiding code that ends in xrk or mem. To test for the presence of the rootkit, create a file whose name ends in xrk or mem, then execute an "ls -l". If the files you just created are not shown in the output of ls, it means that the rootkit is hiding them, ie. your system is compromised and needs to be rebuilt.
- Change directories to /sbin and execute an "ls -l init" -- the link count should be 1. Create a hard link to init using ln, and then execute the "ls -l init" again. If the link count is still 1, the SK rootkit is installed.
- Rooted systems send usernames and passwords to other compromised machines using TCP port 55, so if you keep records of network connections, traffic to destination port TCP/55 merits further investigation.
If your box really is infected and a rootkit is among the 'trusted' packages in the repos, it merits a closer look, and the Ubuntu repo package maintainers ought to be notified.
Edit: Noob's guide
To do this, in a terminal type in
Code:
cd /sbin
ls -l init
you ought to get an output like
-rwxr-xr-x
1 root root 125704 2010-08-13 04:40 init
The one(I've highlighted it in red here) is the count you want
Now
Code:
sudo mkdir /sbin/test
sudo ln init /sbin/test/init
ls -l init
The output should now look something like
-rwxr-xr-x
2 root root 125704 2010-08-13 04:40 init
If you still get a count of one, that means something in the background is hiding stuff- possibly a rootkit.
