[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [cobalt-security] Chkrootkit
- Subject: Re: [cobalt-security] Chkrootkit
- From: Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
- Date: Sat, 3 Aug 2002 23:04:07 -0400
- Organization: Front Street Networks LLC
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
On Saturday 03 August 2002 04:00 pm, Keith Medhurst wrote:
> Hello,
>
> Hope this is the right place to mention this. I've just been running the
> latest chkrootkit (.36?) and it gives the following message..
>
> Checking `bindshell'... INFECTED (PORTS: 1524 31337)
>
> I cant seem to find anything on these ports using 'netstat' - Anyone with
> any ideas, or what a bindshell is for it to become infected?
>
netstat -tupan
will show that port sentry is listening on those ports
--
Gerald Waugh
http://frontstreetnetworks.com SOHO Networks & Web Site Hosting
Front Street Networks LLC voice +1 203 785 0699 * fax +1 203 785 1787
229 Front Street, Ste. #C, New Haven CT 06513-3203