[cobalt-users] paranoid

["Sean Chester" <seanc@xxxxxxxxxxxxxxxxxxxxxx>]

im trying to recover after beeing r00ted,

so far all i have found was a rootshell on port 9705.
there was a .bash_history in my / dir, but it was all scrambled txt i
(id guess they got in, created a backdoor, and left)

ive done md5sums on files and they seem ok, i ran chkrootkit and it reported
i had an infected 'bindshell'

whats bindshell and how do i fix this?

i also have a couple of odd names in my /etc/passwd file

pop:x:17:17:APOP:/etc:
named:x:25:25:Named:/etc/named:/bin/false

do these look ok?