Information about the BMBL rootkit

The BMBL rootkit was found on some "real" servers compromised.
Not much information about it is available. However, the following
document comments about it: Steve_Terrell GSEC.


Files to search:

• /etc/.bmbl
• /etc/.bmbl/sk

*All files with an "*" need to be search in all system
**If you have any more information, send to: mail1, or to mail2.




$RootCheck: bmbl.php, v1.0 2005/10/25, Daniel B. Cid$