<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
I completely agree with Chris - the backdoor that was used to gain access in the first place may still be there. Plus, any rootkits installed are still there. THAT is a dangerous situation.
<br />
<br />I'd recommend keeping that box off-line while you do cmuExports of all sites. Build a new box and cumImport them all into that new box. Before you import - make sure that the new box is fully up-to-date to minimize vulnerabilities.
<br />
<br />And after importing everything/getting it working - make a complete box backup before putting it back on line. That way, you've got a emergency restore in case it happens again. After all - the vulnerability/exploit may have been in something in one of those sites. And as soon as you put it back on line - this could happen again.
<br />
<br />I'd wait till after I got the box and sites back up - but you need to carefully check the logs to see if you can spot how this happened. If not - you're just putting that rebuilt box out there and crossing your fingers that it doesn't happen again.
<br />
<br />
<br />
<br />Chuck
<br />
<br /><font size="2">
<br /><b>---------- Original Message
-----------</b>
<br />
From: Chris Gebhardt - VIRTBIZ Internet <cobaltfacts@virtbiz.com>
<br />
To: BlueOnyx General Mailing List <blueonyx@blueonyx.it>
<br />
Sent: Sun, 12 Dec 2010 12:48:10 -0600
<br />
Subject: [BlueOnyx:06089] Re: cant run any commands on one of
our BlueOnyxboxes
<br />
<br />> Peter Robbins - Bridgewater Software Group wrote:
<br />>
> Not bad for 16 hours continuous work all through the night and next
<br />>
> day. Iam off to bed now.
<br />>
<br />>
So if I understand correctly, you loaded in a new /lib and /usr/lib onto
<br />>
the broken box (or virtual, as the case may be), then put it right back
<br />>
to work?
<br />>
<br />>
If I haven't missed something that sounds fairly dangerous, especially
<br />>
if you've not located what caused the issue in the first place. I hope
<br />>
you're not in for another round of this.
<br />>
<br />>
--
<br />>
Chris Gebhardt
<br />>
VIRTBIZ Internet Services
<br />>
Access, Web Hosting, Colocation, Dedicated
<br />>
<a target="_blank" href="http://www.virtbiz.com/">www.virtbiz.com</a> | toll-free
(866) 4 VIRTBIZ
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>