Re: backdoor or bot?

[Robert van der Meulen <rvdm () CISTRON NL>]

Quoting Jon Lewis (jlewis () LEWIS ORG):
>  Property of PainKeeper !  Use with extreme care...  ...incoming shell...
> painkeeper login:
> My guess is, this is a backdoor.
My guess is it's an eggdrop bot :)

Try to see if the process that bind()'s to that port also binds to some irc
server - and if there are some bot-ish config files in the directory the
process runs from (or files the process has opened)

Greets,
        Robert

--
|      rvdm () cistron nl - Cistron Internet Services - www.cistron.nl        |
|          php3/c/perl/html/c++/sed/awk/linux/sql/cgi/security             |
|         My statements are mine, and not necessarily cistron's.           |
   Nine out of ten men who preferred Camels have switched back to women.