Re: Am I hacked?

[Laurent CARON <lcaron@gw.unix-scripts.info>]

Michal Sedlak a écrit :

> Hi all,
> I am nearly sure that my server was hacked, but I want to be sure. Can 
> anybody say me if it is true.
>
> Here is tiger script output. Do you have any ideas how to repair it 
> {no mkfs funny stuff please}
> There are some line interesting. I have one for every critical system 
> command like {login, su, etc}
> --WARN-- [sig004w] None of the following versions of /bin/netstat 
> (-rwxr-xr-x) matched the /bin/netstat on this machine.
> and something like this for some kernel modules
> --FAIL-- [lin005f] Installed file 
> `/lib/modules/2.6.8-2-386/modules.symbols'
> checksum differs from installed package 'kernel-image-2.6.8-2-386'.
>
> Thank you very much for any recommendations
Login ID sashroot has uid == 0.
--WARN-- [pass002w] UID 0 exists multiple times (2) in /etc/passwd.
--WARN-- [pass012w] Home directory /root exists multiple times (2) in
/etc/passwd.

can you please post & copy of /etc/passwd and /etc/group

Thanks

--
Il est aussi vrai de dire que le sujet connaissant est un produit de la
matière que de dire que la matière est une simple représentation du 
sujet connaissant.
	-+- Arthur Schopenhauer (1788-1860) -+-