Notice I use netstat, but I don't know if the rootkit replaces
it. I have no infected system to test.
The script can be found at http://www.pine.nl/~patrick/chopstix.pl, please post any improvements/commants/rants. YMMV
p.
--
Patrick Oonk - PO1-6BONE - [email protected] - www.pine.nl/~patrick
Pine Internet - PAT31337-RIPE - Hushmail: [email protected]
Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://security.nl PGPID 155C3934 fp DD29 1787 8F49 51B8 4FDF 2F64 A65C 42AE 155C 3934
* looking for modules for a USR TotalSwitch *
Excuse of the day: The salesman drove over the CPU board.
------- End of forwarded message -------
generated by msg2page 0.06 on Jul 21, 2006 at 19:04:53