"Cordula's Web" <[EMAIL PROTECTED]> writes: > I've finally found the culprit with a traditional method: > * md5 (binary from an uncompromised machine) on all files > * reinstalling from scratch (not buildworld, but really > installing from FTP) > * md5 again and diff.
[snip] > Ugh... system clean again at last. :) You can't be sure. The attacker probably put an suid binary somewhere besides the normal system binaries, in which case it's still there and you may still be vulnerable. When you know you've been hacked, you need to wipe the disk and *really* reinstall from scratch. And be very careful about what you restore from backups, too. _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
