help analyzing an attack

[Dave Cramer]

Well, rootkit hunter returns too many connections on their mysql box. :(

chkrootkit doesn't find anything

Thanks
Dave
On 18-Apr-07, at 9:22 AM, Jason Shein wrote:

> Try rkhunter
> http://www.rootkit.nl/
>
> And chkrootkit
> http://www.chkrootkit.org/
> --  
> ______________________________________________________________________ 
> _________
>
> Jason Shein
> Network Administrator – Linux Systems
> Iovate Health Sciences Inc.
> 5100 Spectrum Way
> Mississauga, ON L4W 5S2
> ( 905 ) - 678 - 3119   x 3136
> 1 - 888 - 334 - 4448,    x 3136 (toll-free)
> ( 416 ) - 272 - 7998  Blackberry
> jason.shein-V7Ve2fXh0sTQT0dZR+AlfA at public.gmane.org
>
> Customer Service. Collaboration. Innovation. Efficiency.
> Iovate's Information Technology Team
> ______________________________________________________________________ 
> _________
>
> CONFIDENTIALITY NOTICE:
> THIS ELECTRONIC MAIL TRANSMISSION IS PRIVILEGED AND CONFIDENTIAL  
> AND IS
> INTENDED ONLY FOR THE REVIEW OF THE PARTY TO WHOM IT IS ADDRESSED. THE
> INFORMATION CONTAINED IN THIS E-MAIL IS CONFIDENTIAL AND IS  
> DISCLOSED TO
> YOU UNDER THE EXPRESS UNDERSTANDING THAT YOU WILL NOT DISCLOSE IT  
> OR ITS
> CONTENTS TO ANY THIRD PARTY WITHOUT THE EXPRESS WRITTEN CONSENT OF AN
> AUTHORIZED OFFICER OF IOVATE HEALTH SCIENCES SERVICES INC. IF YOU HAVE
> RECEIVED THIS TRANSMISSION IN ERROR, PLEASE IMMEDIATELY RETURN IT  
> TO THE
> SENDER.
> ______________________________________________________________________ 
> _________
> --
> The Toronto Linux Users Group.      Meetings: http://gtalug.org/
> TLUG requests: Linux topics, No HTML, wrap text below 80 columns
> How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists

--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists