On Sun, 21 Jan 2001, Adrian Hunt wrote:
> All,
>
> The hacker who gained access to our system has me
> baffled.. I can't delete many files on the FS as root
> even using a clean copy of rm. At first I thought
> perhaps chattr.. but a clean copy of lsattr shows
> they're not locked. Yet I still can't delete their
> hacked versions of /bin/login, etc. Is there anything
> else I can do to delete these files? I need to
> reinstall some key RPM's to cleanse the system for
> now... and RPM dies 'cause it can't delete the files
> either. This is becoming more than a major problem
> for us :-(
>
Use a boot floppy such as Tom's Root / Boot disk and then
mount the affected partition. Chances are they've changed
"root" to be just a user and the "real" root user is a
different name.
John
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
