Need urgent help regarding security

Mark Jayson Alvarez jay2xra at
Thu Nov 17 05:26:55 GMT 2005

Marco Wertejuk <wertejuk at> wrote:
 try sockstat | grep 6667 to see which process is
connecting to irc and try to see what this process
is doing with lsof, but depending on what backdoor
or rootkit is used, it's possible to see nothing
because intelligent rootkits hide themself
Ok done this... and I found something
 First the output of nestat:     SYN_SENT     SYN_SENT
 Then sockstat
 root     adjkernt  4926  445 tcp4
 So.. is it the adjkernt that has been replaced? What should I do with it? 
 P.S. I just plugged this server into our private network in order to access it from my workstation.

 Yahoo! FareChase - Search multiple travel sites in one click.  

More information about the freebsd-questions mailing list