Have taken ethernet off, done....
Well... looks the gury have had on h... of a time... the system was =20
by-the-looks of it compromised the 22-Jan-2004... at that time the =20
accounting file got wiped... and apparently the super user has this =20
entry "Charlie &" in the comment filed and daemon has "the devil =20
himself" .....

....
How can I trace this... ???
The system is offline at the moment... only three users defined on the =20=

system, primarily used as a web-server...
BTW: I noticed something was wrong as I did a "top" and all of a sudden =20=

"root" was doing a "make" and sure as ... it was not me!

How did this guy get in ???
How to figure out ?

Den 8/4-2004, kl. 21.51, skrev Joe Laffey:

> On Thu, 8 Apr 2004, Niels S.Eliasen wrote:
>
>> Someone is in my NetBSD box.......
>> Password file is busy.....
>> How do I get this creep out ?
>
> Step one, unplug the ethernet immediately.
>
> The see how much damage is done. The ONLY 100% safe bet is to =20
> completely
> reinstall.
>
> If you have tripwire hashes of all system binaries and everything loks =
=20
> ok
> then you can be 98% sure it is ok. Otherwise re-install. Bad guys do =20=

> evil
> things like modify w, ps, the kernel, netstat, etc to hide themselves
> (including faking the datae on those files).
>
> Good luck,
>
>
> --
> Joe Laffey              |  Want to convert subnet masks between =20
> different
> LAFFEY Computer Imaging |  notations, or figure the number of IPs in a =
=20
> block?
> St. Louis, MO           |  Whatmask - It's FREE (GPL) - NEW Version =20=

> 1.2!
> USA                     |  http://www.laffeycomputer.com/wm.html
> =
-----------------------------------------------------------------------=20=

> -------
> Mail here will be rejected  -----> "Sigfried Trap" =20
> <s_trap@laffeycomputer.com>
>
>
mvh/kind regards
Niels S. Eliasen
H=F8rhavevej 1
DK-4250, Fuglebjerg
Tel/Cell: +45 46 32 85 27 +45 21 77 95 90
mailto:Niels.Eliasen@delfi-konsult.com