[cobalt-users] Address already in use (logfile messages ?)

["Robin Edgar - Tripany" <red@xxxxxxxxxxx>]

Look for the following files:
/tmp/core/*
/etc/cron.d/core
/.sushi
//tmp/.tmp/*

And the following processes:

httpd    10125     1  0 Aug29 ?        00:00:00 [sh]
httpd    10658 10125  0 Aug29 ?        00:00:00 [backwget]
httpd    10983 10125  0 Aug29 ?        00:01:24 sh raq4lrex.sh

If you can find any of the above you have been hacked, and your startup
scripts have been buggered. You can restore functionality by killing the
above processes and starting the new ones, but beware: as soon as you
reboot, you will not come up! You will have to go single user mode and
reinstall the entire damn thing, followed by replacing your backups and
running through all the upgrades by hand

Good luck
Robin Edgar
Tripany
------------------------------
From: "Herby K" <mad1.z@xxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Date: Tue, 8 Oct 2002 09:10:15 +0200
Subject: [cobalt-users] Address already in use (logfile messages ?)
Reply-To: cobalt-users@xxxxxxxxxxxxxxx

Hi there,

as I have installed logcheck and get these reports by mail, I didnt check
logfiles manually that often - but today morning, what is this crap all in
my messages logfile? Is this due to a patch? My complete logfile is full of
these messages, hour by hour minute by minute.

Oct  8 08:46:52 cr02 inetd[28654]: imap/tcp: bind: Address already in use
Oct  8 08:46:52 cr02 inetd[28654]: pop-3/tcp: bind: Address already in use
Oct  8 08:46:52 cr02 inetd[28654]: ftp/tcp: bind: Address already in use
Oct  8 08:49:36 cr02 inetd[28110]: imap/tcp: bind: Address already in use
Oct  8 08:49:36 cr02 inetd[28110]: pop-3/tcp: bind: Address already in use
Oct  8 08:49:36 cr02 inetd[28110]: ftp/tcp: bind: Address already in use
Oct  8 08:56:52 cr02 inetd[28654]: imap/tcp: bind: Address already in use
Oct  8 08:56:52 cr02 inetd[28654]: pop-3/tcp: bind: Address already in use
Oct  8 08:56:52 cr02 inetd[28654]: ftp/tcp: bind: Address already in use
Oct  8 08:59:36 cr02 inetd[28110]: imap/tcp: bind: Address already in use
Oct  8 08:59:36 cr02 inetd[28110]: pop-3/tcp: bind: Address already in use
Oct  8 08:59:36 cr02 inetd[28110]: ftp/tcp: bind: Address already in use

Any advice ?

rgds,
Herby