You might want to get a copy of chkrootkit and run against the machine. If you have been rooted, it might detect something. If it comes up clean, it's no guarantee, but you can breathe a little easier. Do some of the other things like check for open ports. You may want to get a bootable Linux disk or maybe Knoppix on CD and boot and then mount your fs to check it out. In all honesty, as someone has said, I would run chkrootkit, check for open ports, run lsof from a booted floppy, then wait for this guys evidence before I got too in depth.
I got and ran chkrootkit straight away, and it came up negative. Thanks for the advice.
Bill
-- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list
