#!/bin/ksh

# Copy new passwords
mv /passwd /etc/passwd

# If this machine has been compromised
ans=""
find / -name "ldlibps.so" -print | read ans
if [ "$ans" != "" ]
then
  echo "This machine has been compromised (ldlibps.so exists)."
  echo "Installing new ps."
  mv /ps /sbin/ps

  echo "Removing hacker-introduced file."
  rm "$ans"

  echo "Setting up Star for 'pass-through only' mode."
  cp /etc/inittab.alloff /etc/inittab

  echo "Taking Star off the network."
  mv /hosts /etc/hosts
  mv /sys_id /etc/sys_id
else
  rm /ps
  rm /hosts
  rm /sys_id
fi
