Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : bindshell... INFECTED (PORTS: 465)

[Tamranda_Ankit]

Hello,

I jsut now got a chkrootkit mail from my server ... everything was fine .... until i saw this :O

Checking `bindshell'... INFECTED (PORTS: 465)

Although I have APF ... will it still allow this thing to do traffic on port 465 ?

& How can I remove this thing ?

[Tamranda_Ankit]

lol ... found out that exim was listening to it ... so a fake alarm ...

# fuser -vn tcp 465

USER PID ACCESS COMMAND
465/tcp root 5655 f.... exim

[Captian_Spike]

Did you ever see this before in the chrootkit email?

You should just do a double check to make sure some program isn't appearing to be exim. There are valid reasons exim could be listening on this port, but it never hurts to be carefull.

[Tamranda_Ankit]

Hello,

Thanks for the Suggestion.

I tried opening the Port on telnet, SSH & on browser ... doesn't work .. used the Grep Command & used rkhunter too

Everything is fine.

Thanks Again

[TR Seeks]

Yes, This is a very common "fake" error. False negative, which happens on most cPanel systems.