Re: we were attacked

[Andrew Miehs <andrew@2sheds.de>]

Shane Chrisp wrote:

> On Tuesday 11 April 2006 09:16, danilo lujambio wrote:
>  
>
> > find user id ..... . Now I just found that we have a / directory
> > changed to mode 700 and tmp directory to 1700
> >    
>
> Reinstall time would be the safest choice here if your not that skilled. Even 
> a skilled admin will generally opt to reinstall the box at this point after 
> duplicating the drive or replacing it so they can analyze it later. Good luck 
> though.
>
> Shane
>  

100% Agreement on that one...

Regards

Andrew