Re: [cobalt-security] are these worm files?

["Tsukaeru.net Webmaster" <webmaster@xxxxxxxxxxxx>]

I had the same t0rn put on my server not long ago..Probably will require
that you reburn your server to ensure it is totally cleaned...

Jason Frisch

----- Original Message -----
From: "Loryan Strant" <cobalt-security@xxxxxxxxxx>
To: <cobalt-security@xxxxxxxxxxxxxxx>
Sent: Saturday, March 24, 2001 9:42 AM
Subject: [cobalt-security] are these worm files?


> Hi,
>
> I've just run Lionfind on my Cobalt RaQ4, and it says the following are
> suspicious files:
>
> /usr/src/.puta/.1addr /usr/src/.puta/.1file /usr/src/.puta/.1proc
> /usr/src/.puta/.1logz /usr/src/.puta/ /usr/src/.puta/ /usr/info/.t0rn/
>
> I find those a little odd too, so I'm wondering if I can delete this whole
> directory.
> Does anyone have any suggestions?
>
> Thanks,
>
> Loryan
>
>
>
> *******************************************************************
> Loryan Strant
> IT Director
> ExaSites Pty Ltd
> Email://loryan@xxxxxxxxxx
> Web://www.exa.com.au
> Disclaimer:
> Nothing in this correspondence:
> 1. should be interpreted as being legal advice;
> 2. shall be construed as a solicitation of any kind;
> 3. should be interpreted as a signature or mark that can create a legally
> binding commercial relationship;
> 4. should be omitted in any fair use of this correspondence; and
> 5. is necessarily the opinion of ExaSites Pty Ltd
>
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
>