Re: Have I been hacked?
On Wed May 07, 2003 at 02:5139PM +0100, Ian Goodall wrote:
> I am running a debian woody server and when I checked the last users
> yesterday I a large number of logins in the list. On running the command
> today I get the following:
>
> dev1:/home/ian# last
> ian pts/0 172.16.3.195 Wed May 7 14:49 still logged in
> team1 pts/0 blue99.ex.ac.uk Wed May 7 13:21 - 13:57 (00:35)
Who is the user "team1"
> I have run chkrootkit but nothing was found.
That's exactly what chkrootkit can tell you - nothing found, but not
nothing installed.
--
Michael Bergbauer <michael@noname.franken.de>
use your idle CPU cycles - See http://www.distributed.net for details.
Visit our mud Geas at geas.franken.de Port 3333
Reply to: