On Mon, Dec 31, 2001 at 03:18:46PM -0500, Daniel Jacobowitz wrote: > Yep. The fact that it was logged in this particular case means you're > fine. A long time ago a RedHat 6.2 box i had account on was exploited using the same exploit, and it did log that. I'd recommend running chkrootkit or something on that box.. -- Johan Kiviniemi ion at hassers.org http://ion.amigafin.org/