help analyzing an attack

[Pavel Zaitsev]

Jamon Camisso(jamon.camisso-H217xnMUJC0sA/PxXw9srA at public.gmane.org)@Wed, Apr 18, 2007 at 12:24:04AM -0400:
> If it's a compromised root account, you're best off backing up your data 
> and reinstalling.

I agree with Jamon, as long as most of your data is not code. If it is code,
there shall be validation of code, if copy of this code is only on that
system.
Cheers,
Pavel


-- 
Create like God. Command like a King. Work like a Slave.
http://perlpimp.com | http://static.md5.ca/resume.pdf
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists