[plug] Re: plug-digest Digest V2000 #173

[Niall Young]

On Sat, 30 Sep 2000, Oliver White wrote:

> Hi folks... I hope some of you are up late. I have a feeling some script
> kiddy has root on my box.
> 
> Can anyone suggest what action I should take right now?

Format and reinstall.

Once a machine is compromised, you can't really trust anything - logs, output
from binaries like ps/netstat.  It's unlikely they'd go to that much effort
unless you have a fixed IP, but you really can't be sure without complete
filesystem checksums protected/read-only media.

--                                                              
Niall Young						
             Linux Solutions -- www.linuxsolutions.net.au
     Providing Internet and Audio/Video Solutions and Consulting
 PH: 0407 421 537 -- PO BOX 1117, Gwelup WA 6018 -- GPG ID: 8B3AE631