[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: SSH attack


Jared Hall (<jrhall@gmail.com>) wrote:

> It looks like I am being rooted right now.  How do I toss this guy off
> of my system.  he has an IP address of
> Please get back to me fast.  I took the compilers off of the system,
> and it's only running dns... so there's no firewall or anything.  I
> can't shut down ssh because that's my only connection to the system.

Make an image of the hard disk if you can to find out how that guy came
in, and reinstall. You don't know what he changes on your system, so
there is hardly a way to safely revert everything he did.

best regards
        Andreas Janssen

Andreas Janssen <andreas.janssen@bigfoot.com>
PGP-Key-ID: 0xDC801674 ICQ #17079270
Registered Linux User #267976

Reply to: