Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

SunOS/Rootkit-A - trojan

by Marianna Schmudlach Mar 23, 2004 12:02AM PST

Date Discovered: 12/12/2003
Date Added: 3/23/2004
Origin: Unknown
Length: multiple components
Type: Trojan

The detection for SunOS/Rootkit-A covers for a set of files containing, both multiple, Script files and Binary files.

A shell script initializes the rootkit as shell scripts are likely to run fine on different unix versions and are not that sensitive to specific versions unlike ELF binary files.

When the rootkit starts, it opens a shell and by making use of exploits it searches for passwords to give an user higher user rights like su and/or root. So a guest user account can thus be upgraded by force to root.

When succesfull, the system can be compromized starting with the replacement of binary files such as as "su , ps , ping , login ".

More: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101126