Re: [tlug] Have I been hacked?

[Jim Breen <jwb@example.com>]

[Christopher SEKIYA (Re: [tlug] Have I been hacked?) writes:]
>> 
>> > 15:55:51.083588 eth0 > 0:0:0:0:0:0 0:10:a4:11:30:2a 66: CPE-144-132-16-104.vic.bigpond.net.au.1333 > proximity.globalgold.co.uk.www: tcp 0 (DF)
>> 
>> Huh.  That's not good.

I didn't think so.

Thanks for your suggestions, and also to Jim Tittsler and Mario Luoni
for theirs.

I'll poke a round a off-line to see if I can see what has been infected.

I was intending to do a complete re-installation of a later release,
probably RH7.2, and I think this has just forced my hand.

I am thinking of making a tgz of /home (while off-line), copying it away 
elsewhere (I think I have enough space in the Windblows partition), then
doing a repartition and fresh install. Presumably that would be pretty
safe.

Jim

-- 
Jim Breen  [j.breen@example.com  http://www.csse.monash.edu.au/~jwb/]
Computer Science & Software Engineering,                Tel: +61 3 9905 3298
P.O Box 26, Monash University,                          Fax: +61 3 9905 5146
Clayton VIC 3800, Australia      ジム・ブリーン@モナシュ大学