On Thu, Apr 08, 2004 at 10:22:02PM +0200, Niels S.Eliasen wrote:
> Have taken ethernet off, done....
> Well... looks the gury have had on h... of a time... the system was  
> by-the-looks of it compromised the 22-Jan-2004... at that time the  
> accounting file got wiped... and apparently the super user has this  
> entry "Charlie &" in the comment filed and daemon has "the devil  
> himself" .....

Well 'Charlie &' and 'The devil himself' are usual names for 'root' and
'daemon'.
What should by-the-look of it mean? How do you tell it was 22-Jan-2004?
Maybe it was just a busy password file?

jj