Hi,
I am pretty sure it is the lion worm.
Please check out the link below
http://www.itworld.com/Comp/2362/itw01323worm/
> On Wednesday 02 May 2001 14:28, Rupesh wrote:
> > This is no Virus, you've been hacked. Check your system,
> > especially your password & shadow files for new id's.
>
> Somehow I feel that this is a worm than a hacker:
> 1. Looks like a script job - output of ifconfig + password+ shadow
> 2. If I hacked a machine I wouldn't bother sending a mail. There are easier
> and less detectable methods to get information off the computer than mail. In
> any way, I could easier send it off directly to the MTA of my mailbox rather
> than rely on the local MTA to do it.
>
> My suggestion:
> Check all linux boxes on the network. Don't think for even a while that this
> is the only infected system. Backup - reinstall - upgrade - check - then get
> back on the network.
>
> -Faisal
>
> --
> -====----====----====----====----====----====----====---
> ____
> / \
> "@'| '..` |`@" L I N U X
> /__| \__/ |__\ May the source be with you
> \__U_/
>
> --------------------------------------------------------
> DON'T PANIC!
> -The Hitchhiker's Guide To The Galaxy.
> -====----====----====----====----====----====----====---
>
>
>
> _______________________________________________
> linux-india-help mailing list
> [EMAIL PROTECTED]
> http://lists.sourceforge.net/lists/listinfo/linux-india-help
---------------------------------------------
This message was sent using Endymion MailMan.
http://www.endymion.com/products/mailman/
_______________________________________________
linux-india-help mailing list
[EMAIL PROTECTED]
http://lists.sourceforge.net/lists/listinfo/linux-india-help
