Re: [cobalt-users] kofa\r and kofif\r in base directory.

["Jim Hagani" <jhagani@xxxxxxxxxxx>]

> > these files at /proc/1020. deleted those also. chkrootkit does not show
> > anything wrong.
>
> um..you deleted a file in /proc successfully? that's interesting....
>
> type mount , make sure /proc shown up there


> > I will go from one directory to another, pico every file until I find
them.
>
> How do you know pico is safe? lol
>
> Let the machine help you
>
> /usr/sbin/fuser 22/tcp

> Starting to see how twisted this gets?
>
> > I will appreciate any pointers on this quest.
>
> They have nothing better to do than think up new tricks...
>
> gsh
>

Now I've done it. You were right, you can not delete a dir in proc!
mount gives me this message : none on /proc type proc (rw)

Looks like I've killed the sshd ownership of port 22.


And I do not get the message from Portsentry either.

But, by deleting "/proc/1020" I have messed up the GUI, that's the only
thing I can see.
My Server Management page is the only page not working. And Server
management page of virtual sites.

Now if I could only restore /proc/1020 directory, I think I will be home
free.
Any thoughts.
I have even added port 22  to portsentry tcp list. No allerts.

I really really apreciate your advice.

Jim Hagani