Fix linux system tampered with by Relaxscan

Fix the linux system tampered with by Relaxscan-Linux Enterprise Application-Linux server application information. The following is a detailed description. Yesterday, I tried to test a software: relaxscan on a production server. It is a small tool for brute force ssh password cracking. The author of the original article said it is recommended to test it in a virtual machine. The original Article is as follows: "If you are interested, you can play it. It is best to run it on a virtual machine. I cannot guarantee that the software has a backdoor. Because it is not compiled by source code. So, good luck !"

You directly added the executable permission and ran it. The result is that ls is not working, and Segmentation fault is reported. Then restart the system to find that the loop back interface is started, and the system cannot be entered. It's so big.

The following is a brief description of my repair process for your reference. Log on to the single-user mode and start the network manually. lo still cannot start normally. Then, you are prohibited from starting the network and starting the system properly. Manual ifup lo, successful, manual ifup ifcfg-eth0, make the network normal. Sit down in your seat and log on remotely. Which ls; found in/bin, rpm-qf/bin/ls, found in the fils-utils package, reinstall this package, ls can use. Check ls/bin-t again. Good guy, many files have been replaced! Rpm-Va> chanage. list. Check if all packages have been replaced, and reinstall them one by one. It is found that the file date in this file is normal, and it is no longer reported to be replaced with rpm-V, and then the service network restart can start the network normally. However, I found that scp is not available again. I checked it. It is also replaced. Download the openssh, openssh-client, and openssh-server packages and reinstall them. OK. Now everything works. Use chkrookit to check whether an error is returned.

Thank God. It's okay. After a long time, I am kindly reminded that nothing should be done. Don't test any unverified programs on the production system at will!