Re: What is this? A hacker?

From: @lexandros
Date: 05/27/02


From: "@lexandros" <alexandos@sklavos.de>
Date: Mon, 27 May 2002 20:06:04 +0000 (UTC)


"@lex" <alexandros@sklavos.de> wrote in
news:Xns921B64E9C4D69alexandrossklavosde@131.246.137.51:

> Recently my system (linux SuSE 7.3) crashed several times...
> I found following, quite interesting entry in last:
>
>
>
> ***** 0*******0*** Thu Jan 1 01:00 - crash (11831-01:24
>
>
> Does anybody know what is this?
>
> Notes.
> 1. There are more entries like this one, and the user is still logged
> on 2. Obviously, the dates are not correct. But if one could
> manipulate last, why not completely erase the entry??

I found what it was... Kevin was right, it was a corrupt wtmp file but
the interesting is, how it got corrupted.. with netdate !!!! I have a
netdate cron job running and it writes garbage to the wtmp file each time
it runs.