Message-Id: <200403111957.i2BJvWA29773@tag.witbe.net>
Reply-To: <rol@as2917.net>
From: "Paul Rolland" <rol@as2917.net>
To: <Valdis.Kletnieks@vt.edu>, "'pg smith'" <pete@linuxbox.co.uk>
Cc: <linux-kernel@vger.kernel.org>
Subject: Re: LKM rootkits in 2.6.x 
Date: Thu, 11 Mar 2004 20:57:25 +0100
Organization: AS2917
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
In-Reply-To: <200403111939.i2BJdxrx004553@turing-police.cc.vt.edu>
Thread-Index: AcQHoQUa8lUwoGkSQLCJpBcB9039NwAAfHJA
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 781
Lines: 26

> 
> Subject: Announcing full functional adore-ng rootkit for 2.6 Kernel
> From: stealth <stealth@segfault.net>
> Date: Thu, 11 Mar 2004 10:27:00 +0000
> To: bugtraq@securityfocus.com
> 
> Hi,
> 
> At http://stealth.7350.org/rootkits/adore-ng-0.41.tgz you find
> the complete port of adore-ng for the Linux kernel 2.6. All
> of the stuff you know from earlier kernel 2.4 versions such

>From the FEATURES file :
 o does not utilize sys_call_table but VFS layer

Seems to be that easy... Should we hide VFS layer now :-)

Regards,
Paul


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/