Re: '(no

[Giacomo Mulas <gmulas@ca.astro.it>]

On Sat, 15 Sep 2001, Dimitri Maziuk wrote:

> If you suspect your machine was r00ted,
> 1. Take it off the net _now_.

This may be dangerous: some rootkits run a sort of heartbeat utility
that detects that the box was disconnected from the net and run something
nasty (i.e. rm -rf /) in that case. This is one of those very few cases in
which sync'ing two or three times and then pulling the power plug may be
the safest bet...

just my .01 euros...
Giacomo

-- 
_________________________________________________________________

Giacomo Mulas <gmulas@ca.astro.it, giacomo.mulas@tin.it>
_________________________________________________________________

OSSERVATORIO ASTRONOMICO DI CAGLIARI
Str. 54, Loc. Poggio dei Pini * 09012 Capoterra (CA)

Tel.: +39 070 71180 216     Fax : +39 070 71180 222
_________________________________________________________________

"When the storms are raging around you, stay right where you are"
                         (Freddy Mercury)
_________________________________________________________________