From owner-freebsd-security  Wed Apr 18 20: 2:27 2001
Delivered-To: freebsd-security@freebsd.org
Received: from obsecurity.dyndns.org (adsl-63-207-60-27.dsl.lsan03.pacbell.net [63.207.60.27])
	by hub.freebsd.org (Postfix) with ESMTP id A94F037B422
	for <freebsd-security@FreeBSD.ORG>; Wed, 18 Apr 2001 20:02:24 -0700 (PDT)
	(envelope-from kris@obsecurity.org)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id CCCF466B38; Wed, 18 Apr 2001 20:02:23 -0700 (PDT)
Date: Wed, 18 Apr 2001 20:02:23 -0700
From: Kris Kennaway <kris@obsecurity.org>
To: fukuda shinichi <fukuda@alles.ad.jp>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: unknown process
Message-ID: <20010418200223.A42227@xor.obsecurity.org>
References: <200104190241.AA00733@fukuda.alles.ad.jp>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="NzB8fVQJ5HfG6fxh"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200104190241.AA00733@fukuda.alles.ad.jp>; from fukuda@alles.ad.jp on Thu, Apr 19, 2001 at 11:41:00AM +0900
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


--NzB8fVQJ5HfG6fxh
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Apr 19, 2001 at 11:41:00AM +0900, fukuda shinichi wrote:
> Hi.
>=20
> I found unknown process name "carko" today.
> This binary find in /usr/share/man/mansps/ddos ,=20
> and i never made such dir like ddos !! (created Apr 18 18:59).
>=20
> Is anyone know about this "carko" ?=20
> And very weird name "ddos" ... please help me.

Take your system off the net and check it for signs of intrusion.

Kris

--NzB8fVQJ5HfG6fxh
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE63lU/Wry0BWjoQKURAlAwAJ40fYE17MVKQFxzBkbEO4SREtw4tQCeLAjE
BB9A06a+etaWXO+LT/okIks=
=o8HH
-----END PGP SIGNATURE-----

--NzB8fVQJ5HfG6fxh--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message