Yup, your server was definitely compromised. Try an 'rpm -Va' to check which files where compromised, and try to reinstall these RPMs or reinstall the whole box. The file attributes might also be changed so use 'lsattr' or 'chattr' to check.
Mike Blancas <[EMAIL PROTECTED]> Mosaic Communications, Inc. On Thu, 18 Apr 2002, Joel N. Eusebio wrote: > Hi All, > > I did a "chkconfig wu-ftpd on". I forgot to to turn it off. I think my box > was hacked based on the logs that I saw. I can't seem to do a "ps". I tried > to delete the file and replace it but it says: rm -fR ps > > rm: cannot unlink 'ps' : Operation not permitted > > Has anyone encountered this before? I would surely appreciate some help. > > // joel > > > _ > Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph > To leave: send "unsubscribe" in the body to [EMAIL PROTECTED] > > To subscribe to the Linux Newbies' List: send "subscribe" in the body to >[EMAIL PROTECTED] > _ Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph To leave: send "unsubscribe" in the body to [EMAIL PROTECTED] To subscribe to the Linux Newbies' List: send "subscribe" in the body to [EMAIL PROTECTED]
