My machine been hacked, I need help

[Daniel O'Connor]

On Sat, 14 Jan 2006 14:35, anchor (sent by Nabble.com) wrote:
> My machine been hacked. The message file was modified. Old dated backup
> files are deleted. The last log was truncated. You are gurus. Would you
> please tell me where I can find out other trace file or  logfiles to figure
> out where the hacker come from?

1) Turn it off
2) Put a new hard disk in it and install FreeBSD freshly on the new disk
3) Mount the old disk read only and recover all the data you can (no   
   executables)
4) Do forensics on the old disk, and/or back it up to tape.
5) Nuke the contents of the old disk.

Basically it is really hard to trust any code run from the old disk although 
as someone suggested DDB is most likely to be OK, but you never know :)

-- 
Daniel O'Connor software and network engineer
for Genesis Software - http://www.gsoft.com.au
"The nice thing about standards is that there
are so many of them to choose from."
  -- Andrew Tanenbaum
GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20060114/b734cc4e/attachment.bin