or through anything like rpc, ssh, bind. also, if the attacker is clever, he already removed the logs.
----- Original Message ----- From: "Jim Crippen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 16, 2002 4:22 PM Subject: RE: Re: help!! help!! > I'd start with the FTP or WWW logs. It's not hard to get hacked through > your FTP server. > > -----Original Message----- > From: Teodor Georgiev [mailto:[EMAIL PROTECTED]] > Sent: Friday, August 16, 2002 6:54 AM > To: [EMAIL PROTECTED] > Subject: Re: Re: help!! help!! > > > > and then the hacker is going to hack you again :) > better than reinstalling - sit on your a*s, read some security tutorials. > browse through the hacked system and look what the "hacked" did. > > -------------------------------------------------------------------------- -- > ------------------------- > Teodor Georgiev Technical Support PlanetSky Ltd. > Tel: +357 22454898 * Fax: +357-22518022 > www.planetsky.com * [EMAIL PROTECTED] > > > ----- Original Message ----- > From: "shyam " <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, August 16, 2002 2:55 PM > Subject: Re: Re: help!! help!! > > > > thanks boss!! i am going to reinstall > > > > > > On Fri, 16 Aug 2002 Teodor Georgiev wrote : > > > > > >90% I am sure that you've been hacked. > > >and the script-kiddie installed some buggy rootkit on your > > >system. > > > > > >Congratulations :) > > > > > >cd /usr/bin > > >lsattr > > > > > > > > > >--------------------------------------------------------------------------- > - > > >------------------------- > > >Teodor Georgiev Technical Support PlanetSky Ltd. > > >Tel: +357 22454898 * Fax: +357-22518022 > > >www.planetsky.com * [EMAIL PROTECTED] > > > > > > > > >----- Original Message ----- > > > From: "shyam " <[EMAIL PROTECTED]> > > >To: <[EMAIL PROTECTED]> > > >Sent: Friday, August 16, 2002 2:32 PM > > >Subject: help!! help!! > > > > > > > > > > hi friends > > > > > > > > i am wondering how these are all happend ,i am running > > >internet > > > > proxy server on Rh7.2 system .till yesterday its OK suddenly > > >/bin > > > > , /lib and /sbin have been locked i cant create copy or move > > >files > > > > to these dirs . so many important commands under these dirs > > >like > > > > df,ps,netstat,ifconfig... etc are not working,giveing error > > > > "/bin/ps file or directory not found ",even though i am root > > > > user,file size and permissions and all are ok . and size of > > > > lost+found in /root became 16K,i am not able to open > > > > konsole,konqueror,help , > > > > i am not using any ipchains > > > > > > > > can anybody help me to solve > > > > > > > > any help is precious > > > > shyam > > > > > > > > > > > > > > > > > > > > -- > > > > redhat-list mailing list > > > > unsubscribe > > >mailto:[EMAIL PROTECTED]?subject=unsubscribe > > > > https://listman.redhat.com/mailman/listinfo/redhat-list > > > > > > > > > > > >-- > > >redhat-list mailing list > > >unsubscribe > > >mailto:[EMAIL PROTECTED]?subject=unsubscribe > > >https://listman.redhat.com/mailman/listinfo/redhat-list > > > > > > > > > > > > -- > > redhat-list mailing list > > unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe > > https://listman.redhat.com/mailman/listinfo/redhat-list > > > > -- > redhat-list mailing list > unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe > https://listman.redhat.com/mailman/listinfo/redhat-list > > > > -- > redhat-list mailing list > unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe > https://listman.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list
