Trojan Horses

[mysterygang]

--sorry for that newbie question, but I'm really excited to keep my vps in good condition.

I've checked and found 18 trojan horses on my vps system.
All of 18 are real trojan? How can I remove them?

thanks

MG

Trojan Scanner

Main >> Security >> Scan for Trojan Horses

Appears Clean


/dev/stderr


Scanning for Trojan Horses.....

Possible Trojan - /usr/bin/xsltproc
.
Possible Trojan - /usr/bin/cpan
.
Possible Trojan - /usr/bin/instmodsh
.
Possible Trojan - /usr/bin/pstruct
.
Possible Trojan - /usr/bin/splain
.
Possible Trojan - /usr/bin/dbiprof
.
Possible Trojan - /usr/bin/xmlcatalog
.
Possible Trojan - /usr/bin/xmllint
.
Possible Trojan - /usr/bin/xslt-config
.
Possible Trojan - /usr/lib/libexslt.la
.
Possible Trojan - /usr/lib/libxslt.la
.
Possible Trojan - /usr/lib/python2.3/site-packages/libxml2mod.la
.
Possible Trojan - /usr/lib/python2.3/site-packages/libxml2mod.so
.
Possible Trojan - /usr/bin/curl
.
Possible Trojan - /usr/lib/libcurl.so.3.0.0
.
Possible Trojan - /usr/bin/xml2-config
.
Possible Trojan - /usr/lib/libxml2.la
.
Possible Trojan - /usr/bin/curl-config
.
18 POSSIBLE Trojans Detected

[Gwaihir]

That's WHM's Trojan scanner? That test is known to give a LOT of false positives. At first glance these look like normal files needed for various system functions. Don't delete any of them without thorough verification first.

Advises about it via Google and in places like this are mainly to:
- Keep a note of this result of your first scan. Then when you run it again and you see new entries pop up, you can consider those new ones suspect and look into them.
- Use a better tool for the job.

[mysterygang]

Yes, that is whm's scanner.
Can you suggest me a better tool?

[Vin DSL]

Sorry for butting in, but here's the way it is...

Forget the tools! You do the best you can -- you get hacked -- you figure out how they squeezed through your defenses -- and you plug the hole... and you wait for the next hack attack.

The crutches you are seeking are things ppl like me come up with to save ppl like you from ppl like them. They're usually effective for a month or so, then it's onto the next crisis!

Bottom line: Depend on yourself!

WoW! What a bunch of crap, huh -- depending on yourself, to protect yourself?!?!?

Okay, let's put it a different way... would you depend on someone like me to protect you? A lot of ppl do, but I wouldn't trust me -- even though I'm forced to...

Hrm...

Are you starting to get a feel for the situation?

Okay, your turn...