Chuck wrote:

> Who's to say the format utility isn't compromised as well? I'd boot from
> a CD-ROM (something non-writable) and do the format from there.

That's how you normally reformat the / partition, where core software
lives.

Now, I'd invest in a second disk if feasible, install the new OS on the
second disk with only critical text configuration files brought over
from backup, very, very carefully, and set aside the first disk for
examining as a spare drive in a safe environment (such as booting from
a Knoppix LiveCD) to apply some analysis to it and look for traces in
the logs.

Assume also that every password and account on that system have been
sniffed and cracked: if you haven't been paying attention to how to
protect your systems from an attack from the inside, you are now very
vulnerable to any accounts that existed on that system.