[ILUG] Possible hack?

[Rick Moen]

Quoting Barry O'Donovan (barry.odonovan at ucd.ie):

[Tripwire log excerpts:]

> Added object name:  /bin/crond 
> Modified object name:  /bin/ps

Prima facia evidence that your system has been cracked, indeed.
Here's a set of suggested recovery steps.  (There are others.)
http://www.cert.mil/techtips/root_compromise.htm

-- 
Cheers,   The difference between common sense and paranoia is that common sense
Rick Moen     is thinking everyone is out to get you.  That's normal; they are.
rick at linuxmafia.com      Paranoia is thinking they're conspiring.  -- J. Kegler