24 Dec
2009
24 Dec
'09
1:07 p.m.
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Manu Verhaegen Sent: Thursday, December 24, 2009 7:04 AM To: CentOS mailing list Subject: Re: [CentOS] attack
at the moment everiting is solved i have block the IP adress but i d'ont have found the script
So you are the attacker. Happened to me a couple weeks ago.
Check your tmp directory and subdirectory for std, udp.pl. Also check /etc/passwd and /etc/shadow for unusual users. Should be at the very bottom of those files.