odd process running /usr/sbin/sendmail -i -CronDaemon -odi -oem root

2003-06-19 Thread Robert Ebright
I have had some problems with attempted hacks on my box and posted here the last few days. So I've been checking the processing running on my box and I see this. PID TTY STAT TIME COMMAND 28406 ?S 0:00 /usr/sbin/sendmail -i -FCronDaemon -odi -oem root I have postfix installed

odd process running /usr/sbin/sendmail -i -CronDaemon -odi -oem root

2003-06-19 Thread Robert Ebright
I have had some problems with attempted hacks on my box and posted here the last few days. So I've been checking the processing running on my box and I see this. PID TTY STAT TIME COMMAND 28406 ?S 0:00 /usr/sbin/sendmail -i -FCronDaemon -odi -oem root I have postfix installed

Follow up on the NCSDRecover DDOS perl script

2003-06-18 Thread Robert Ebright
uld it ? Cuz if so that would be bad news for a lot of people who got hacked via this. Regardless I upgraded my kernel to the new version, is there anything else I should do to ensure there were no backdoors implemented by this. Also thanks for all of the initial help and responses I received. The de

Follow up on the NCSDRecover DDOS perl script

2003-06-18 Thread Robert Ebright
uld it ? Cuz if so that would be bad news for a lot of people who got hacked via this. Regardless I upgraded my kernel to the new version, is there anything else I should do to ensure there were no backdoors implemented by this. Also thanks for all of the initial help and responses I received. The de

a weird script worm uploaded via php with debian 3.0 ?

2003-06-10 Thread Robert Ebright
Hello, I logged in to my server today to find that /usr/sbin/ncsd was running about 50 copies, since I don't have BIND installed, obviously something was up...they were also running with the user www-data... After a little bit of research I found a new crontab entryFile: /tmp/crontab.LYukbF 0 *

a weird script worm uploaded via php with debian 3.0 ?

2003-06-10 Thread Robert Ebright
Hello, I logged in to my server today to find that /usr/sbin/ncsd was running about 50 copies, since I don't have BIND installed, obviously something was up...they were also running with the user www-data... After a little bit of research I found a new crontab entryFile: /tmp/crontab.LYukbF 0 *