Re: [cobalt-security] Some assistance needed

["Chris Burton" <chris@xxxxxxxxxxxxxxxxxx>]

> I have d/l the latest version of chkrootkit.
> Seems like my system has been comprimised.
> Searching for LPD Worm files and dirs... Possible LPD worm installed
> Checking `lkm'... not tested: can't exec ./chkproc
> Checking `sniffer'... not tested: can't exec ./ifpromisc
> Checking `wted'... not tested: can't exec ./chkwtmp
> Checking `z2'... not tested: can't exec ./chklastlog
>


Firstly read the instructions for chkrootkit, you missed the bit under
installation then re-run it. After that see what the script does .. and see
what it is triping out on..

Taking a quick look at the script it checks for:
A username in /etc/passwd starting with "kork" and/or a service listed in
/etc/inetd.conf on port 666 (or one starting with 666), if you have these
and they wasnt put there from you then you may have a problem.

ChrisB.

--
http://ChrisBurton.info/
http://www.tyneside.lug.org.uk/