RE: [cobalt-users] paranoid

["Curtis Ross" <Curtis_Ross@xxxxxx>]

> im trying to recover after beeing r00ted,
> 
> so far all i have found was a rootshell on port 9705.
> there was a .bash_history in my / dir, but it was all scrambled txt i
> (id guess they got in, created a backdoor, and left)
> 
> ive done md5sums on files and they seem ok, i ran chkrootkit and it
reported
> i had an infected 'bindshell'
> 
> whats bindshell and how do i fix this?
> 
> i also have a couple of odd names in my /etc/passwd file
> 
> pop:x:17:17:APOP:/etc:
> named:x:25:25:Named:/etc/named:/bin/false
> 
> do these look ok?
> 
> _______________________________________________
> 

If your running PortSentry, I believe you will get a false-positive
using chrootkit. Check their site I think they mention something about
it.


Curtis