Fixing "ls" command

S

Spectator

Hello,

I don't know much about linux. I am working on a machine with FreeBSD 7.2-RELEASE-p8 installed on it. The problem I am facing is that, my box was compromised and the hacker tried to install a rootkit called shv5 (I found out using rkhunter).

I have follow the steps mentioned here for removing the rootkit:
http://www.kentoyer.com/2009/12/21/removing-the-shv5-rootkit/

I have removed the file /bin/ls but I don't know how to fix it back. Now "ls" command doesn't work. I need help with fixing it.

Thank you.
 
If your machine has been compromised, the only safe option is to rebuild it completely. From now you cannot trust anything, you might have more rootkits installed on your server and you just do not know about them.
 
Spectator said:
I don't know much about linux.
Click to expand...
That's good because you're not using Linux!


Standard procedure after getting your box hacked is to backup all your data, do a wipe and clean install of the entire system. Do NOT trust anything on that box.
 
Thank you very much for your replies and suggestions. I appreciate your valuable suggestions but could anyone please guide me how to solve out the ls command problem only?

Thank you.
 
This will probably fix it, but you do need the OS sources.

Code: 
cd /usr/src/bin/ls
make install
 
You must log in or register to reply here.
Back
Top