Re: info

From: Michel Arboi (arboiat_private)
Date: Sat May 04 2002 - 01:56:56 PDT

  • Next message: KJK::Hyperion: "Re: 'rooted' NT/2K boxen?"

     --- "Joe T." <auximiniat_private> a écrit : 
    > - /var/log is gone
    Your hacker looks lame, so I'd bet they did not wipe the log files.
    You can probably read the old logs by accessing the raw disk device.
    e.g. something like :
    strings /dev/hdXX | less
    > - any other recommendations?
    Unplug the machine from internet, boot from a floppy
    ( is your friend) or CDROM (or at least, remount
    your partitions read only)
    Do You Yahoo!? -- Une adresse gratuite et en français !
    Yahoo! Mail :
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Mon May 06 2002 - 10:46:57 PDT