intrusion detected

[Brian Walker]

OK - carrying on from the initial intrusion, and searching the disk, I ran

# /usr/sbin/chkrootkit

and most was negative apart from this: 

Checking `bindshell'... INFECTED (PORTS: 1524 31337)

Any ideas on removal and protection? How should I detect who placed it 
there?

Brian
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20050818/dc3dd974/attachment.html>