Re: ping22: can not kill this process

2007-12-30 Thread Bill Marcum - New Address!
On Sun, Dec 30, 2007 at 02:59:33PM -0500, Mike Wang wrote: Hi Recently one of my web server was invaded by something called ping22. it obviously exploited some perl cgi or php holes on this apache2 server. But I do not how it is get exploited. (1) tried to kill -9 it, it is respawn

Re: Rbl

2006-03-31 Thread Bill Marcum
On Fri, Mar 31, 2006 at 11:25:45AM -0300, Thiago Ribeiro wrote: Hi guys, A friend has a problem with rbl. The address is rbl.kropka.net. The company's ip address was added in this list some time ago, before he started working there. Now he fixed the problems with the mail server and would

Re: Shadow passwords

2005-07-07 Thread Bill Marcum
On Thu, Jul 07, 2005 at 09:49:17AM +0200, Johann Spies wrote: I am busy building two new proxy servers. I installed the first from debian-install CD with the normal installer. As an exercise in disaster recovery I decided to install the second from a CD I have build with dfsbuild on the first

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-21 Thread Bill Marcum
On Tue, Jan 18, 2005 at 07:14:29PM -0800, Moe wrote: After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: Part 1 Type: C Encoding: 8bit What mail client are you using,

Re: what process is using a port

2004-05-03 Thread Bill Marcum
On Mon, May 03, 2004 at 07:14:31PM +0200, LeVA wrote: Hi! Is there a way to figure out what program is using a port. For example I want to know which process is using port 80. How can I do this? netstat -np Run it as root, or you will only see the PIDs for your own processes. --

Re: what process is using a port

2004-05-03 Thread Bill Marcum
On Mon, May 03, 2004 at 07:14:31PM +0200, LeVA wrote: Hi! Is there a way to figure out what program is using a port. For example I want to know which process is using port 80. How can I do this? netstat -np Run it as root, or you will only see the PIDs for your own processes. --

Re: Strange 'su' error messages

2004-01-16 Thread Bill Marcum
On Tue, Jan 13, 2004 at 10:29:10AM +0100, Christian Schuerer wrote: Hello! Since updating my debian server yesterday I get the following error messages every hour (generated by logcheck): Jan 13 00:05:01 asterix su[2102]: + ??? root:bin Today there is even an additional line:

Re: Strange 'su' error messages

2004-01-16 Thread Bill Marcum
On Tue, Jan 13, 2004 at 10:29:10AM +0100, Christian Schuerer wrote: Hello! Since updating my debian server yesterday I get the following error messages every hour (generated by logcheck): Jan 13 00:05:01 asterix su[2102]: + ??? root:bin Today there is even an additional line:

Re: suspicious files in /tmp

2004-01-05 Thread Bill Marcum
: /bin/netstat and /usr/bin/env. What exactly did chkrootkit say about those files? Were they writable by non-root users, did they have setuid permission, or what? -- Absurd Procrustean Egghead Cornstarch Variant Bill Marcum -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject

Re: suspicious files in /tmp

2004-01-05 Thread Bill Marcum
: /bin/netstat and /usr/bin/env. What exactly did chkrootkit say about those files? Were they writable by non-root users, did they have setuid permission, or what? -- Absurd Procrustean Egghead Cornstarch Variant Bill Marcum