How to delete RootKit from your Linux System

Article Title: how to delete RootKit from your Linux system. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Last time, I told you how to find out if any intruders have placed rootkit on your UNIX system. Rootkit is a collection of UNIX System Core Command replacement programs. It is used to clear traces after successful intrusion and maintain access to the affected system.
　　
You can use commercial or open-source programs, such as Tripwire or chkrootkit, to check whether rootkit exists on your system. However, it is one thing to discover that someone has broken your UNIX system-and clearing this mess is completely another thing.
　　
Removing rootkit is complicated. UNIX does not have a uniform (Program) package standard, which means that reinstalling the entire operating system is a common recovery method.
　　
This is not good news for many people, especially when the victim system contains irreplaceable data. With the help of data backup, you can clean up many systems without stopping them.
　　
Linux systems using Red Hat Package Manager (RPM) can run rpm with root user permissions? Va command to quickly check the integrity of system files. This command will output a list of files and directories that have changed since the original version, but this does not mean that a rootkit has been installed. Note that changing command files such as netstat, ifconfig, ps, and chsh is a typical practice of rootkit, regardless of the UNIX operating system used.
　　
If you suspect that rootkit has been installed, the first thing to do is to unplug the network connection, turn off the victim machine as soon as possible, and start it in single-user mode. If you have a "first aid" boot disk or CD, you need to use it.
　　
Once the machine is started in single-user mode, you can start the recovery process. If there is no "first aid" disk for your Linux system, you need to search for one on Google.
　　
Intruders usually change the attributes of rootkit files on Linux to prevent others from replacing them. Running the lsattr command on suspicious files or directories will show their differences with other executable program files.
　　
Files marked with "unchangeable" mark ("I") are always suspicious. This flag means that someone has used the chattr command to change the rootkit file to prevent you from deleting or replacing the file.
　　
The key to recovery is to be sure that you have not corrected the file. Rootkit often replaces files under/bin,/sbin,/usr/bin, and/usr/sbin. These files are mainly used by UNIX commands. Rootkit also places directories and files out of these places, but unless you are absolutely sure that these files belong to rootkit rather than a legitimate application, you should leave them alone.
　　
If you find a suspicious rootkit file, you need to replace it with a valid file. If you use RPM in Linux, you need to use rpm-q-f {file} to find a package to replace the victim file. When you use RPM, the best way to replace the affected file is to reinstall the entire package, so you need to install the CD or the program file of the same Linux version.
　　
However, before you can replace the package, you must "unlock" the victim file marked as unchangeable ". In Linux, chattr? The I command is used to unlock, so that you can delete or replace them. (For more information about these commands, see the lsattr and chattr user manual .) After unlocking the affected file, you can use the rpm-Uvh {package} command to reinstall the package. This will replace the affected file.
　　
Replacing the affected file does not mean that you have solved this problem, but if you need to restore the system as soon as possible, this is a method. Sometimes, it is more important to restore the machine as soon as possible than to understand how intruders break down the victim machine. However, this kind of investigation should be your next step, or someone may break your machine again.