On Sat, 24 Mar 2001, Loryan Strant wrote:
> Hi,
>
> I've just run Lionfind on my Cobalt RaQ4, and it says the following are
> suspicious files:
>
> /usr/src/.puta/.1addr /usr/src/.puta/.1file /usr/src/.puta/.1proc
> /usr/src/.puta/.1logz /usr/src/.puta/ /usr/src/.puta/ /usr/info/.t0rn/
>
> I find those a little odd too, so I'm wondering if I can delete this whole
> directory.
> Does anyone have any suggestions?
>
T0rn rootkit. That box is owned. Either spend a loooot of time
reinstalling binaries and cleaning up files, or reinstall the box.
Either way, if you just sit on it you are asking for trouble.
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
