Mailing List Archive

Support open source code!


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [tlug] Have I been hacked?



On Sat, Mar 02, 2002 at 04:04:17PM +1100, Jim Breen wrote:

> 15:55:51.083588 eth0 > 0:0:0:0:0:0 0:10:a4:11:30:2a 66: CPE-144-132-16-104.vic.bigpond.net.au.1333 > proximity.globalgold.co.uk.www: tcp 0 (DF)

Huh.  That's not good.

> Any suggestions what I should look for, if there are any nasty surprises
> installed?

Boot from a rescue floppy, use its included ls and cat, see what binaries
on your hard drive have been altered recently.  You can no longer trust
any binary on your system.

-- Chris "tripwire would have prevented this" Sekiya


Home | Main Index | Thread Index

Home Page Mailing List Linux and Japan TLUG Members Links