Re: rootkit

[Grigory Fateyev <greg@anastasia.ru>]

Hello Grigory Fateyev!
On Wed, 4 Jan 2006 20:42:39 +0300 you wrote:

> Что это всё значит? Это нормально?

Извините, нашёл в google объяснение:


Important Note: If you see 'Checking `bindshell'... INFECTED
(PORTS:  465)' read on.

I'm running PortSentry/klaxon. What's wrong with the bindshell test?

If you're running PortSentry/klaxon or another program that binds
itself to unused ports probably chkrootkit will give you a false
positive on the bindshell test (ports 114/tcp, 465/tcp, 511/tcp,
1008/tcp, 1524/tcp, 1999/tcp, 3879/tcp, 4369/tcp, 5665/tcp, 10008/tcp,
12321/tcp, 23132/tcp, 27374/tcp, 29364/tcp, 31336/tcp, 31337/tcp,
45454/tcp, 47017/tcp, 47889/tcp, 60001/tcp).


-- 
Всего наилучшего!
greg [at] anastasia [dot] ru Григорий.