Re: [cobalt-users] Raq3 Server being crack

["Zeffie" <cobaltlist@xxxxxxxx>]

> I run chkrootkit and got the following results. I don't know if it's >
problem be solve just by deleting the .packlist files? What should I do?

no no no.... those are good files.....

>
> eth0 is not promisc
> eth0:0 is not promisc
> eth0:3 is not promisc
> eth0:1 is not promisc
> eth0:2 is not promisc

This is a good thing

> Checking `lkm'... You have     4 process hidden for readdir command
> You have     4 process hidden for ps command
> Warning: Possible LKM Trojan installed

I have heard complaints like this for a while and in all the systems I
checked, I found nothing.  Upload a clean ps and take a look.  YMMV
otherwise it looks ok....  btw you need to install some security like
portsentry and logcheck if you haven't already.

Zeffie
http://www.zeffie.com/
If this message helps you please help others with just a click!
http://www.thehungersite.com/