Scary Stuff

Discussion in 'Server Operation' started by dayjahone, Sep 9, 2008.

  1. dayjahone

    dayjahone Member

    I got an email from my ISP that said the following:

    Code:
    We've received the following complaint in regards to your account.  It
    indicates that one or more computers using the address space assigned 
    to your account are infected by a worm or virus, or that a server in
    your IP space may have become rooted. 
    
    Such infections not only affect the performance of your computer, but
    often use network resources to spread infection to other computers via
    email. Other infections will allow your computer to participate in a
    botnet for malicious use. Usually denial of service attacks against
    other websites or false websites to gain credit card and other personal
    information. 
    ...
    
    If you are running a server, please discuss this matter with your server
    administrator or IT staff. Most rootkits will hide information such as
    running processes and have been known to hide or completely alter system
    logs to hide themselves.
    Any way to check to see what the problem is?

    Thanks.
     
  2. sjau

    sjau Local Meanie Moderator

    I think that email is a hoax. Are you sure it's from ISP?
     
  3. dayjahone

    dayjahone Member

    Yeah, it's legit. I called my ISP.
     
  4. chipsafts

    chipsafts New Member

    are you running a server?
    if so, which email server program are you using?
     
  5. dayjahone

    dayjahone Member

    Yes, I'm running a server set up according to the perfect setup. Postfix?
     
  6. falko

    falko Super Moderator Howtoforge Staff

  7. dayjahone

    dayjahone Member

    chkrootkit seemed to work fine.

    rkhunter gave me the following at the end:

    However, rkhunter also gave me the following:

    and

     
  8. edge

    edge Active Member Moderator

    Are you running this server on a LAN with other computers in it?
    If so. Are you sure that the server is the problem? It could also be othe PC's in your LAN.
     
  9. dayjahone

    dayjahone Member

    It's linked to the machine's IP address.
     

Share This Page