Re: Compromised FBSD/Apache

From: Hernan Otero <bazhgo(at)techint.net>
Date: Mon Nov 18 2002 - 08:03:05 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <138174789994.20021116081144@beldamar.com>

Do this

#fstat | grep internet | grep 127

and see what it show you....

You can see wath binary is bind to this port, and view wich user is running it too

Then is recomended do

#fstat | grep internet

And take a look for all Listen and Established communications

Netstat may be a compromised file...

Bye Bye

-H

>Hello...

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Wed Nov 20 07:46:42 2002