[linux-help] Security Issues

[John Alexander <john.alexander@xxxxxxxx>]

I just recieved an interesting piece of e-Mail from on eof the sysadmins at
my DSL provider, telling me that somebody has hijacked one of my machines. I
have identified the processes that they were using to run a port scan
against other networks, and have identified the userid affiliated with the
files used to drop the payload onto my machine. I am not able to find that
userid listed in either the passwd, shadow, or groups file. This being the
case, where should I look now? The group assigned to the files is 'wheel',
so I was wondering if I could just cut that out of the group file?

John Alexander
WorldCom
Senior Network Engineer I
MM NETS (Network Engineering Technical Support)
http://nets.wcomnet.com/
V737-8471
1-800-PAGE-MCI pin 930-0285
316-684-8471
AOL - jralexan1


-- This is the linux-help@xxxxxxxxx list.  To unsubscribe,
visit http://tmp2.complete.org/cgi-bin/listargate-aclug.cgi