Re: [cobalt-users] bind: Address already in use

["Arsalan Mahmud" <arsalan@xxxxxxxxxxxx>]

Hi,
 Go to http://www.chkrootkit.org and download it. Run it on your server. It
will reveal a lot more then you would find out by asked for something
specific to look for since not all rootkits are alike. Also check the
version of your named server via telnet. To see if the pkg file was
installed properly or not.

Arsalan





----- Original Message -----
From: "Clint Decker" <nim1998@xxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Tuesday, February 20, 2001 1:20 AM
Subject: Re: [cobalt-users] bind: Address already in use


> What type of things do I look for... and why do you instantly think that
> means it was hacked?  That error wont come up unless you get hacked?
>
> Where do I look for more proof?
>
> ----- Original Message -----
> From: <flash22@xxxxxxx>
> To: <cobalt-users@xxxxxxxxxxxxxxx>
> Sent: Sunday, February 18, 2001 10:27 PM
> Subject: Re: [cobalt-users] bind: Address already in use
>
>
> On Sun, 18 Feb 2001, Clint Decker wrote:
>
> > My server has been acting up A LOT lately... and I just checked my admin
> > email account and I got 1 mail like the one below every 5 minutes for
> about
> > 3  hours from like 7:09 pm - 9:59 pm.
> > From: "Cron Daemon" <root@xxxxxxxxxxxxxx>
> > To: <root@xxxxxxxxxxxxxx>
> > Sent: Sunday, February 18, 2001 7:19 PM
> > Subject: Cron <root@www> /usr/sbin/init
>                            ^^^^^^^^^^^^^^^^^^
> Guess what....you got nailed
>
> time to look for evil things...
> >
> > bind: Address already in use
>
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>