[Help]Netstat[Help]

[Guy Shanny]

Hi,
I just want to know if there is a way to chmod/own/mv the netstat (/bin).

why? every 10 min it comes in the top of my top and takes 50% cpu...I don't know why he is going up...

Ideas?

Thanks.

 

[nobaloney]

Yes, but you'd be better off finding why it's happening; it could be a sign of your server being hacked.

First find the path to the netstat daemon:

locate netstat

Then cd to that directory.

To remove netstat simply name it something else:

mv netstat netstat-off[/mv]
To make it so only root can run it:
[code]chmod 700 netstat

Jeff

 

[Guy Shanny]

[root@server bin]# chmod 700 netstat
chmod: changing permissions of `netstat': Operation not permitted
[root@server bin]# mv netstat netstat-off
mv: cannot move `netstat' to `netstat-off': Operation not permitted

 

[floyd]

You have probably been hacked because what a hacker does is replace the file and then change the file attributes so that it cannot be deleted easily. If you compare the file size with a known good version you will probably see the size difference is great.

To change the file attributes:

chattr = netstat

Then you will be able to rename it. But you will probably need to take it down and format the drive and start over. That is the only way to know for sure that all traces of the hacker are gone.