[PLUG] Think I've been hacked

[Michael Rasmussen]

AthlonRob wrote:
> On Mon, 2005-01-24 at 14:49 -0800, Mel Andres wrote:
> > So, what should I do next, to ensure I closed this up and cleaned house?
> 
> 1) Unplug the computer from the LAN, modem, whatever.
> 2) Wipe your disk clean and re-install Linux.

please.  not required.

Mel, how much do you want to learn about your system?
Start by searching the PLUG archives, there is at least one thread covering
how to recover.  Note, I'm the in minority of people who believe that an
infected system can be cleaned and restored to safe behavior.  

Also, check google for chkrootkit and bindshell - there are enough instances
of false positives that this combination receives a special entry in the FAQ.

-- 
    Michael Rasmussen, Portland Oregon  
  Be appropriate && Follow your curiosity
 http://meme.patch.com/memes/BicycleRiding
   Get Fixed:  http://www.dampfixie.org
  The fortune cookie says:
The more control, the more that requires control.