[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: something overwrites my shadow - was: can't get pass login!

On Jun 15, 2002 at 12:01 +0200, Sven wrote:
> I have get pass login thanks to init=/bin/bash
>   But now (pure curiosity), a program overwrited my shadow with
>   string containnig word UMASTER (I attached the shadow file),
>   I can only login if not using file shadowing - because it is stil
>   overwriting the /etc/shadow again and again, while saving untouched
>   file as shadow-.
>   ps -aux command shows nothing,
>   but most of my logs are gone and syslogd is not anymore on my tty8.
>   I face with this kind of problem for a first time in my life -
>   no telnet nor ssh services were on, and remote user could not login
>   as a root.
>   So, what happened???

Virus or worm?  Sounds suspicious...

Thatcher Ulrich

To UNSUBSCRIBE, email to debian-laptop-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: