Need urgent help regarding security

[Mark Jayson Alvarez]

Marco Wertejuk <wertejuk at mwcis.com> wrote:
 try sockstat | grep 6667 to see which process is
connecting to irc and try to see what this process
is doing with lsof, but depending on what backdoor
or rootkit is used, it's possible to see nothing
because intelligent rootkits hide themself
Ok done this... and I found something
 First the output of nestat:
 
 10.10.8.140.2994       195.204.1.132.6667     SYN_SENT
 10.10.8.140.2993       195.204.1.132.6667     SYN_SENT
 
 Then sockstat
 root     adjkernt  4926  445 tcp4   10.10.8.140:2994      195.204.1.132:6667
 
 
 
 So.. is it the adjkernt that has been replaced? What should I do with it? 
 
 P.S. I just plugged this server into our private network in order to access it from my workstation.


		
---------------------------------
 Yahoo! FareChase - Search multiple travel sites in one click.