Re: [cobalt-users] are these worm files?

[flash22@xxxxxxx]

On Sat, 24 Mar 2001, Loryan Strant wrote:
> I've just run Lionfind on my Cobalt RaQ4, and it says the following are
> suspicious files:
> 
> /usr/src/.puta/.1addr /usr/src/.puta/.1file /usr/src/.puta/.1proc
> /usr/src/.puta/.1logz /usr/src/.puta/ /usr/src/.puta/ /usr/info/.t0rn/
> 
> I find those a little odd too,

Yup...rootkit

 so I'm wondering if I can delete this whole
> directory.

I wouldn't do that as the first thing ;) some may be replacements for
network programs, deleting them may make the machine impossible to get
into, i'd be saving important things first....in preperation for
reinstalling the OS ;)

Certainly if at all possible isolate it from the internet...

Not to mention you would be destroying any usefull evidence of what
happened...

gsh