[cobalt-users] Raq3 Server being Crack

["Cobalt" <wylim@xxxxxxxxxxx>]

Hi all,

I run chkrootkit and got the following results. I don't know if it's being
crack again or from the backup copy that I had restore when my server crash
3 weeks ago. Is there any way to solve this without re-installing? Will the
problem be solve just by deleting the .packlist files? Thanks in advance for
any advice.

eth0 is not promisc
eth0:0 is not promisc
eth0:3 is not promisc
eth0:1 is not promisc
eth0:2 is not promisc
Checking `aliens'... No suspect files
Searching for sniffer's logs, it may take a while... Nothing found
Searching for t0rn's default files and dirs... Nothing found
Searching for Ambient's rootkit (ark) default files and dirs... Nothing
found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.00503/i386-linux/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Devel/Symdump/.packlist

Searching for Ramen Worm files and dirs... Nothing found
Checking `lkm'... You have     4 process hidden for readdir command
You have     4 process hidden for ps command
Warning: Possible LKM Trojan installed


Best Regards