http://www.fish.com/tct/help-when-broken-into http://www.dpo.uab.edu/~kalyan/incidentchecklist.html http://www.sans.org/rr/catindex.php?cat_id=27
HTH, Harry
--On Monday, August 25, 2003 11:34:35 AM +0200 Bas Benschop <[EMAIL PROTECTED]> wrote:
This weekend several systems at our site were hacked. In /var/spool/.test/ several programs were installed, log, pscan, x and xscan.
Also some system utilities were replaced with older versions. Is it possible to check the versions of programs and compare them with the versions in the package database?
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
