syntholik wrote:
>
> I am thinking this must be hardware-related?
>
> reboot system boot Mon Jul 19 13:59
> root pts/5 nat201.247.mpowe Mon Jul 19 12:19 - crash (01:39)
> syn pts/4 nat201.247.mpowe Mon Jul 19 12:15 - crash (01:44)
> syn pts/1 nat201.247.mpowe Mon Jul 19 12:13 - crash (01:45)
> root pts/3 nat201.247.mpowe Mon Jul 19 12:06 - crash (01:53)
> syn pts/1 nat201.247.mpowe Mon Jul 19 11:51 - 12:13 (00:22)
One. I am 99% sure that the devices /dev/pts* are created
by hackers when they put in a rootkit. I am not 100% sure,
but I am 99% sure.
This looks like a script kiddie owns you machine. If doing
an ls -la | more of your /dev directory does not show these
devices, your ls program may have been replaced with one that
does not list this stuff.
Also, nat201.247.mpowe looks like the beggining of a
internet address which is not being displayed in its entirety.
Translation, these entries look like what you get from the
w command, and it looks like a user is logged in with that
username (nat201....) at various times, and crashing you.
If its not you, then who?
Check it out....let us know.
--
Ramon Gandia ================= Sysadmin ================ Nook Net
http://www.nook.net [EMAIL PROTECTED]
285 West First Avenue tel. 907-443-7575
P.O. Box 970 fax. 907-443-2487
Nome, Alaska 99762-0970 ========== Alaska Toll Free. 888-443-7525
