RE: Hacked too?

[Stephen Ryan <taketwoaspirin@deepthought.dartmouth.edu>]

On Fri, 2002-01-11 at 17:49, Igor Balusov wrote:
> What is mean:
> "If you're running PortSentry/klaxon or another program that binds itself to 
> unused ports probably chkrootkit will give you a false positive on the 
> bindshell test (ports .. 31336/tcp, 31337/tcp ...)."?
> It is from http://www.chkrootkit.org/
> My PC is really hacked or no? How I can determine it?
> When I run "netstat -an" I get 
> "udp        0      0 0.0.0.0:31337           0.0.0.0:*"
> How I can stop this? 
> Billy

Try "netstat -anp" to find out which program is listening on that port. 

You should also check to see whether you have portsentry installed or
anything like it.  ("dpkg -s portsentry" if you installed it via Debian;
I don't know what others might be installed or where to look if you
installed them from source instead.)