Re: [cobalt-users] Recent Hacks - Continues

[flash22@xxxxxxx]

On Sat, 10 Feb 2001, fastmedia wrote:

> 
> 
> i've just run nmap (insecure.org has been down all day??) and my machine has
> the following DoS tools, and apparently Elite is probably Back Orifice:
> 
> 27665/tcp  filtered    Trinoo_Master
> 31337/tcp  filtered    Elite
> 
> 
> anybody with any experience ridding these?  I've found some C code but...
> 
> these are probably what was in the crtz.o etc files

Have you rebooted that machine? you can't get rid of crtz without
rebooting (it's a kernel module)

lsof or fuser should tell you where the program is that's holding those
ports, if it's a program and not that stupid module...