I'd start with the FTP or WWW logs. It's not hard to get hacked through your FTP server.
-----Original Message----- From: Teodor Georgiev [mailto:[EMAIL PROTECTED]] Sent: Friday, August 16, 2002 6:54 AM To: [EMAIL PROTECTED] Subject: Re: Re: help!! help!! and then the hacker is going to hack you again :) better than reinstalling - sit on your a*s, read some security tutorials. browse through the hacked system and look what the "hacked" did. ---------------------------------------------------------------------------- ------------------------- Teodor Georgiev Technical Support PlanetSky Ltd. Tel: +357 22454898 * Fax: +357-22518022 www.planetsky.com * [EMAIL PROTECTED] ----- Original Message ----- From: "shyam " <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 16, 2002 2:55 PM Subject: Re: Re: help!! help!! > thanks boss!! i am going to reinstall > > > On Fri, 16 Aug 2002 Teodor Georgiev wrote : > > > >90% I am sure that you've been hacked. > >and the script-kiddie installed some buggy rootkit on your > >system. > > > >Congratulations :) > > > >cd /usr/bin > >lsattr > > > > > >--------------------------------------------------------------------------- - > >------------------------- > >Teodor Georgiev Technical Support PlanetSky Ltd. > >Tel: +357 22454898 * Fax: +357-22518022 > >www.planetsky.com * [EMAIL PROTECTED] > > > > > >----- Original Message ----- > > From: "shyam " <[EMAIL PROTECTED]> > >To: <[EMAIL PROTECTED]> > >Sent: Friday, August 16, 2002 2:32 PM > >Subject: help!! help!! > > > > > > > hi friends > > > > > > i am wondering how these are all happend ,i am running > >internet > > > proxy server on Rh7.2 system .till yesterday its OK suddenly > >/bin > > > , /lib and /sbin have been locked i cant create copy or move > >files > > > to these dirs . so many important commands under these dirs > >like > > > df,ps,netstat,ifconfig... etc are not working,giveing error > > > "/bin/ps file or directory not found ",even though i am root > > > user,file size and permissions and all are ok . and size of > > > lost+found in /root became 16K,i am not able to open > > > konsole,konqueror,help , > > > i am not using any ipchains > > > > > > can anybody help me to solve > > > > > > any help is precious > > > shyam > > > > > > > > > > > > > > > -- > > > redhat-list mailing list > > > unsubscribe > >mailto:[EMAIL PROTECTED]?subject=unsubscribe > > > https://listman.redhat.com/mailman/listinfo/redhat-list > > > > > > > >-- > >redhat-list mailing list > >unsubscribe > >mailto:[EMAIL PROTECTED]?subject=unsubscribe > >https://listman.redhat.com/mailman/listinfo/redhat-list > > > > > > -- > redhat-list mailing list > unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe > https://listman.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe https://listman.redhat.com/mailman/listinfo/redhat-list
