ja daft_dutch, dat is ook mijn vermoeden...
User mode rootkits usually incorporate Trojanized versions of standard programs which mask the existence of their components in the system, and a backdoor, which provides stealthed access to the system. Some examples of user mode rootkits are lkr, trOn, ark and others. Let's take trOn as an example of a user mode rootkit. In order to mask its presence in the system, the rootkits performs a number of actions. When installed, it stops the syslogd daemon, and then replaces the following system utilities with its own, Trojanized, version: du, find, ifconfig, login, ls, netstat, ps,
top, sz. In addition to this, a Trojan version of the sshd daemon is added to the system. Finally, a sniffer is launched in background mode; launch of telnetd, rsh, and finger daemons is added to inetd.conf, inetd is relaunched and syslogd is rebooted.
using the following utilities which can help to detect the presence of a rootkit in the system: Saint Jude, Chrootkit, RkScan, Carbonite, Kstat, Rootkithunter, Tripware, Samhain and others.
http://www.viruslist.com/en/analysis?pubid=168740859
:strip_icc():strip_exif()/u/17313/_IGP1526kl2.jpg?f=community)
/u/100867/crop5601ca928ac47_cropped.png?f=community)
:strip_exif()/u/4086/avatar3.gif?f=community){kind=avatar}
:strip_exif()/u/52709/firelogo_s.gif?f=community)
:strip_exif()/u/24521/gotroot.gif?f=community)
:strip_icc():strip_exif()/u/91018/dgtw.jpg?f=community)
:strip_icc():strip_exif()/u/49556/Liegebeest-small.jpg?f=community)
:strip_exif()/u/25859/test2.gif?f=community)