OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Hacked?

From: Fernando Gleiser (fgleisercactus.fi.uba.ar)
Date: Fri May 09 2003 - 15:47:46 CDT

On Fri, 9 May 2003, Bjoern A. Zeeb wrote:

>
> this asumes that truss is ok ;-) perhaps take the truss from your
> other 4.7 machine ...

Better yet, move the disk to some off-line, clean system and mount
the compromised disk there. You don't know if the rootkit messed with the
system libraries or if it loaded a KLD.

Or boot from CD and use the CD's binaries.

                        Fer

_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"