RE: [cobalt-users] Services - Raq3

["John Cordeiro" <jcordeiro@xxxxxxxxxxxxxxx>]

SSH to raq
su to root
type ps -ax
Are there two cron processes running, if so, Remove the one named "CRON" its
all caps. to remove get the PID from ps -ax, its the left most column and
type kill "PID"

then simply close the two ports. Look for a rootkit on your system!
John Cordeiro

-----Original Message-----
From: cobalt-users-admin@xxxxxxxxxxxxxxx
[mailto:cobalt-users-admin@xxxxxxxxxxxxxxx]On Behalf Of Wayne Sagar
Sent: Monday, February 19, 2001 2:24 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: RE: [cobalt-users] Services - Raq3


>i thought i was on top of my recent hack attack(s?).
>i have a whole load of these running, i rebooted, they are still there.
>any idea how to kill these?
>
>tcp        0      0 *:7937                  *:*                     LISTEN
>tcp        0      0 *:54320                 *:*                     LISTEN
<snip>

Zero idea how to kill them but would greatly appreciate information on where
to look for similar on my machine.

TIA

Wayne Sagar
http://aafo.com

_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users