Removing a control kit from the server

Question

The server my site is on was infected using the (pardon my obfuscation)

 Y-E-S E-x-p-l-o-i-t S-y-s-t-e-m

It is a "control kit".

I found out some info about it from http://cassandrasecurity.com/?p=282

How can I remove this control kit and secure the system? Trojan scans reveal an infected GD library.

http://serverfault.com/questions/6190/reinstall-after-a-root-compromise — Zoredache, Nov 02 '09 at 18:43

score 4 · Accepted Answer · answered Nov 02 '09 at 18:19

4

Reinstall the system. It sucks, but that's the only way you'll be sure its secure.

answered Nov 02 '09 at 18:19

Cian

1 Answers1