have i been hacked?

dave dmehler26 at woh.rr.com
Wed Apr 14 09:04:45 PDT 2004


Hello everyone,
    Ok, i am almost certain i've been hacked now. I just checked the system
for some strange accounts or things i didn't recognize. I didn't see
anything in /etc/passwd, /etc/group, /etc/master.passwd, and so forth. I
however ran chkrootkit and got two very disturbing errors, firstly it was
going along reporting items as uninfected, then when it hit sniffer, the
first of several files it died with the error:
"Abort Trap"
I'm going to take this machine down, back it all up, and do a reinstall.
Also, an nmap scan of the machine from another box showed no unidentified
open services.
    Keep the suggestions coming.
    Thanks.
Dave.



More information about the freebsd-questions mailing list