From: kevin lyda (kevin at domain suberic.net)
Date: Mon 20 Aug 2001 - 14:17:44 IST
On Mon, Aug 20, 2001 at 11:54:47AM +0100, Niall O Broin wrote:
> On Mon, Aug 20, 2001 at 10:58:06AM +0100, Fred Cummins wrote:
> > found it by using 'locate puta', as t0rn and its attendant files
> > generally live in a directory called '.puta' which doesn't show up using
> > 'ls -a'. I had an up-to-date set of BIND utilities, so I don't know how
> Why would a directory called .puta not show up in a ls -a listing ? (Unless
> of course the cracker had installed a customised ls)
it could be a kernel module. essentially this box needs to be completely
reinstalled to be trusted. alternatively it could be booted from
something like the ilug bbc and then picked over piece by piece, but
reinstallation would be safer.
kevin
-- kevin at domain suberic.net simple four line sigs - fork()'ed on 37058400 bandwidth friendly; nice to do. meatspace place: home some admins clueless. http://suberic.net/~kevin --netiquette haiku 2001
This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:11:44 GMT