Re: SSH attack
Jared Hall (<email@example.com>) wrote:
> It looks like I am being rooted right now. How do I toss this guy off
> of my system. he has an IP address of 220.127.116.11
> Please get back to me fast. I took the compilers off of the system,
> and it's only running dns... so there's no firewall or anything. I
> can't shut down ssh because that's my only connection to the system.
Make an image of the hard disk if you can to find out how that guy came
in, and reinstall. You don't know what he changes on your system, so
there is hardly a way to safely revert everything he did.
Andreas Janssen <firstname.lastname@example.org>
PGP-Key-ID: 0xDC801674 ICQ #17079270
Registered Linux User #267976