Symtomps
/lib/ld-linux.so.1: bad ELF interpreter: No such file or directory
Or
error while loading shared libraries: libc.so.5: cannot open shared object file: No such file or directory
Confirm the presence of T0rnkit
Ok I think enough evidence
Full T0rnkit Finger Prints
Advanced users click here to see full installation script of t0rnkit rootkitclick here to see the list of files included in this original rootkit
It replace these command files
/usr/bin/find
/bin/login
/sbin/ifconfig
/bin/ps
/bin/ls
/bin/netstat
/usr/bin/pstree
/usr/bin/top
/usr/sbin/in.fingerd
Configuration files related to trojanized ssh daemon are saved to
/usr/info/.t0rn/shdcf
/usr/info/.t0rn/shhk
/usr/info/.t0rn/shhk.pub
/usr/info/.t0rn/shrs
Trojanized ssh daemon itself will be moved to "/usr/sbin/nscd", and then started. It is also added to the end of the "/etc/rc.d/rc.sysinit" along with the following comment:
# Name Server Cache Daemon..
This way the trojanized sshd will be executed when system restarts. By default it uses port number 47017 for it. This is configurable, and the port number is saved to "/usr/info/.t0rn/shdcf".
The kit creates following configuration files and executables:
/usr/src/.puta/t0rns (standard linux sniffer)
/usr/src/.puta/t0rnp (snifferlog parser)
/usr/src/.puta/t0rnsb (log cleaner)
/usr/src/.puta/.1file (Files list to hide from ls command)
/usr/src/.puta/.1proc (Process list to hide from ps command)
/usr/src/.puta/.1logs (Log to hide)
/usr/src/.puta/.1addr (Address list to hide from netstat)
Tornkit also starts a sniffer in background,
It enables telnetd, rsh and finger daemons in "/etc/inetd.conf", restarts inetd to activate changes made and starts syslogd.