Ayaz Ahmed Khan <ayaz@redirect.devnull> writes:

> "René Berber" typed:
>> Todd H. wrote:
>>> Yup. It's the only way to get back to a known state. Wiping and
>>> reinstalling from original media.
>>
>> But that's not needed, you can find which process is using that
>> particular port and kill it (use lsof). Then run a rootkit
>> detection and/or anti-virus detection to try to find out where that
>> process came from (there are several to choose from). Before that I
>> would harden ssh access, no access except your user.
>
> Reinstalling (and rebuilding) a system is far easier and quicker than
> figuring out how deep and thorough the compromise is and cleaning the
> system to some reasonable extent.

If the OP's like me, they are loathe to do this not for the basic OS
install, but for the dozens or perhaps hundreds of other
upgrades/applications/tweaks that they've performed since they first
installed their OS. If i had to re-install, it would probably chew
up a week of my time to reconfigure everything back just the way it
was.
--
% Randy Yates % "How's life on earth?
%% Fuquay-Varina, NC % ... What is it worth?"
%%% 919-577-9882 % 'Mission (A World Record)',
%%%% <yates@ieee.org> % *A New World Record*, ELO
http://home.earthlink.net/~yatescr