.mech

[Fedora User]

There has been a lot of traffic on a machine lately.
Someone noticed a .mech/.stealth directory in /var/tmp/...
which looks kind of like a virus.  It does suspicious
things.  There is a file called cyc.pid which contains
a process id.  When I did a ps on the ID I found only
"ps" was running.  However, in that same directory I noticed
an executable called "ps".  The ps on ps showed it had been
running for the last 4 or 5 days, and a regular linux ps runs
no more than a few seconds.  There is also an executable there
called "pico" and several server files all pointing to undernet.org.

Has anyone else run into this?  Is it a virus?  Is like an
IRC bot.  What can be done?

Tony

[Mark Haney]

Fedora User wrote:
>  There has been a lot of traffic on a machine lately.
>  Someone noticed a .mech/.stealth directory in /var/tmp/...
>  which looks kind of like a virus.  It does suspicious
>  things.  There is a file called cyc.pid which contains
>  a process id.  When I did a ps on the ID I found only
>  "ps" was running.  However, in that same directory I noticed
>  an executable called "ps".  The ps on ps showed it had been
>  running for the last 4 or 5 days, and a regular linux ps runs
>  no more than a few seconds.  There is also an executable there
>  called "pico" and several server files all pointing to undernet.org.
>  
>  Has anyone else run into this?  Is it a virus?  Is like an
>  IRC bot.  What can be done?
>  
>  Tony
>  
>   
If those files are pointing to undernet, it's quite likely that the 
system doesn't have a virus on it, it's been compromised via (possibly) 
by an unpatched security hole.    What does checkrookit say?  Do you 
have that on the box at all?

I have to say your best bet is to take that system off the network so it 
can't communicate it with the controller and blow it away and reinstall. 
  That's especially true if you don't have a lot of forensic experience 
trying to track down either the security hole or the b*stard that 
compromised it.

As it is, it looks like the ps executable is being redirected to the one 
in /var/tmp and pico is (was) a vi/emacs editor that I've not used in 
ages and ages.

Seems like they have enough control to edit root config files and do 
pretty much what they want.



-- 
Libenter homines id quod volunt credunt -- Caius Julius Caesar


Mark Haney
Sr. Systems Administrator
ERC Broadband
[phone]

Call (866) ERC-7110 for after hours support

[Tim]

On Mon, 2008-07-07 at 08:49 -0500, Fedora User wrote:
>  There has been a lot of traffic on a machine lately.
>  Someone noticed a .mech/.stealth directory in /var/tmp/...
>  which looks kind of like a virus.  It does suspicious
>  things.  There is a file called cyc.pid which contains
>  a process id.  When I did a ps on the ID I found only
>  "ps" was running.  However, in that same directory I noticed
>  an executable called "ps".  The ps on ps showed it had been
>  running for the last 4 or 5 days, and a regular linux ps runs
>  no more than a few seconds.  There is also an executable there
>  called "pico" and several server files all pointing to undernet.org.
>  
>  Has anyone else run into this?  Is it a virus?  Is like an
>  IRC bot.  What can be done? 
I Googled cyc.pid and found:
http://www.webhostingtalk.com/showthread.php?t=423617  It doesn't sound
good.  But you should do more research than I did.

The other doesn't like nice, either:
http://www.google.com.au/search?q=%2Fvar%2Ftmp%2F+mech+stealth

Once you've worked out what to do about them (*try* and repair, and
possibly miss something, or wipe out and start again), look into making
your web server more secure *BEFORE* you make it accessible.

-- 
[tim@localhost ~]$ uname -r
2.6.25.9-76.fc9.i686

Don't send private replies to my address, the mailbox is ignored.  I
read messages from the public lists.

[Michael Schwendt]

On Mon, 7 Jul 2008 08:49:37 -0500, Fedora User wrote:

>  There has been a lot of traffic on a machine lately.
>  Someone noticed a .mech/.stealth directory in /var/tmp/...
>  which looks kind of like a virus.  It does suspicious
>  things.  There is a file called cyc.pid which contains
>  a process id.  When I did a ps on the ID I found only
>  "ps" was running.  However, in that same directory I noticed
>  an executable called "ps".  The ps on ps showed it had been
>  running for the last 4 or 5 days, and a regular linux ps runs
>  no more than a few seconds.  There is also an executable there
>  called "pico" and several server files all pointing to undernet.org.
>  
>  Has anyone else run into this?  Is it a virus?  Is like an
>  IRC bot.  What can be done? 
You've got an intruder. Take the machine off the network. Create a backup
for further analyzation. Don't trust the output of installed binaries
like ps. Examine the installation from within a rescue mode.
Also see what "chkrootkit" and "rkhunter" find.  
Reinstall unless you really really *really* think you can repair it.

Btw, what version of Fedora is this? And what kind of service is it?