Re: info

From: Michel Arboi (arboiat_private)
Date: Sat May 04 2002 - 01:56:56 PDT

Next message: KJK::Hyperion: "Re: 'rooted' NT/2K boxen?"

Previous message: W.G. Iyer: "Re: info"
In reply to: Joe T.: "info"
Next in thread: dlaumannat_private: "RE: info"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

 --- "Joe T." <auximiniat_private> a écrit : 
> - /var/log is gone

Your hacker looks lame, so I'd bet they did not wipe the log files.
You can probably read the old logs by accessing the raw disk device.
e.g. something like :
strings /dev/hdXX | less

> - any other recommendations?

Unplug the machine from internet, boot from a floppy
(http://www.toms.net/rb/ is your friend) or CDROM (or at least, remount
your partitions read only)


___________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Mail : http://fr.mail.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: KJK::Hyperion: "Re: 'rooted' NT/2K boxen?"
Previous message: W.G. Iyer: "Re: info"
In reply to: Joe T.: "info"
Next in thread: dlaumannat_private: "RE: info"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon May 06 2002 - 10:46:57 PDT