help analyzing an attack

[Robert Brockway]

On Wed, 18 Apr 2007, Dave Cramer wrote:

> Well, rootkit hunter returns too many connections on their mysql box. :(
>
> chkrootkit doesn't find anything

www.chkrootkit.org eventually came up for me but it is slow at the moment.

Hint: don't accept a copy of chkrootkit (or any other software for that 
matter) from an untrusted source.  I always pull it down from the home 
site an examine the signature (yeah they could both be compromised but at 
some point we need to trust something).

Rob

-- 
Robert Brockway B.Sc.        Phone:          +1-905-821-2327
Senior Technical Consultant  Urgent Support: +1-416-669-3073
OpenTrend Solutions Ltd      Email:          support-wgAaPJgzrDxH4x6Dk/4f9A at public.gmane.org
                              Web:            www.opentrend.net
Contributing Member of Software in the Public Interest
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists