Re: think I may have been rootkitted

From: charadeur (charadeur@spamsucks.nym.alias.net)
Date: 06/09/02

  • Next message: Macbrush: "Script for removing blocked IP in a list"

    From: charadeur <charadeur@spamsucks.nym.alias.net>
    Date: 8 Jun 2002 17:59:23 -0500
    
    

    On 23 May 2002 09:08:49 -0700, jared@hwai.com (Jared) wrote:

    >Chkrootkit gave me some bad news:

    When I was rootkited recently the tip off for me was when I ran ps I
    could not see processes I knew were running. I am using RedHat and
    noted I could see some directories and file with dir that I could not
    see with ls. In these directories I found the hackers rootkit and
    other tools. I ended up reinstalling because I could not get some of
    the rpms to reinstall.