Here are some links that might help you. http://www.fish.com/tct/help-when-broken-into http://www.dpo.uab.edu/~kalyan/incidentchecklist.html http://www.sans.org/rr/catindex.php?cat_id=27 HTH, Harry--On Monday, August 25, 2003 11:34:35 AM +0200 Bas Benschop <b.benschop@tn.utwente.nl> wrote:
This weekend several systems at our site were hacked. In /var/spool/.test/ several programs were installed, log, pscan, x and xscan. Also some system utilities were replaced with older versions. Is it possible to check the versions of programs and compare them with the versions in the package database?