From owner-freebsd-security@FreeBSD.ORG  Sun Apr 13 06:53:02 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9567037B401
	for <freebsd-security@freebsd.org>;
	Sun, 13 Apr 2003 06:53:02 -0700 (PDT)
Received: from MailBox.iNES.RO (MailBox.iNES.RO [80.86.96.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A1FA743F75
	for <freebsd-security@freebsd.org>;
	Sun, 13 Apr 2003 06:53:01 -0700 (PDT)
	(envelope-from Alexandru.Balan@iNES.RO)
Received: from [80.86.100.173] (BSD.iNES.RO [80.86.100.173])
	by MailBox.iNES.RO (8.12.8/8.12.5) with ESMTP id h3DDqx5b020081
	for <freebsd-security@freebsd.org>; Sun, 13 Apr 2003 16:52:59 +0300
From: Alexandru Balan <Alexandru.Balan@iNES.RO>
To: freebsd-security@freebsd.org
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="=-2VGb4J8HtQmfUtUaaRDL"
Organization: iNES Advertising 
Message-Id: <1050241980.32076.26.camel@BSD.iNES.RO>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.2.4 
Date: 13 Apr 2003 16:53:00 +0300
X-RAVMilter-Version: 8.4.1(snapshot 20020919) (MailBox.iNES.RO)
Subject: chfn, chsh, ls, ps - INFECTED
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Apr 2003 13:53:02 -0000


--=-2VGb4J8HtQmfUtUaaRDL
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

My machine got hacked a few days ago through the samba bug. I
reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM
but still...
Can anyone please advise ?

bash-2.05b# chkrootkit | grep INFECTED
Checking `chfn'... INFECTED
Checking `chsh'... INFECTED
Checking `date'... INFECTED
Checking `ls'... INFECTED
Checking `ps'... INFECTED



--=20
Jay

--=-2VGb4J8HtQmfUtUaaRDL
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQA+mWu8Xj/84bdgpDIRAp1BAJwOmaWGSfWsS21QHTLYXTy38lGdngCghqve
bV+S6DYKv2AGKqb0EB2Nu1c=
=wyJ/
-----END PGP SIGNATURE-----

--=-2VGb4J8HtQmfUtUaaRDL--