Information about the "Cback" linux worm

This rootkit or worm was found on many systems running a broken version of
of the PHP xmlrpc or similar insecure PHP code.
More information at:
http://isc.sans.org/diary.php?storyid=823


Files to search:

• /tmp/cback
• /tmp/derfiq
• */cback

*All files with an "*" need to be search in all system
**If you have any more information, send to: mail1, or to mail2.




$RootCheck: cback.php, v1.0 2006/02/21, Daniel B. Cid$