Pharmacy Alert Security Team : Removal

Pharmacy Alert Security Team
Removal - 2

Verify if your shadow file has been made not-writable (usually the case)

ls -la /etc/shadow
-r-------- 1 root root 1700 Feb 24 19:42 shadow

If that is the case, use busybox to make it writable again:

/root/busybox lsattr /etc/shadow
----i-------- /etc/shadow 
# /root/busybox chattr -i /etc/shadow
# chmod 600 /etc/shadow
# ls -la /etc/shadow
-rw------- 1 root root 1700 Feb 24 19:42 shadow

[We are assuming that you are in a directory called "/root" for the purposes of this example.]

Use busybox to modify your root password:

# ./busybox passwd
Changing password for root
Enter the new password (minimum of 5, maximum of 8 characters)
Please use a combination of upper and lower case letters and numbers.
Enter new password:
Bad password: too weak.
Re-enter new password:
Password changed

Don't remove busybox. You will need it to perform all of your basic functions such as rebooting the server.

Reinstall the deleted binaries.

If the binaries have not been removed, recovery is much simpler.

> Removal Page 3