2 Nov
2002
2 Nov
'02
10:47
Ian Laws wrote:
Hi All,
I wonder if someone has got access to my computer as in the wtmp log file I have the following 'user'. I thought at first that my logs were corrupted so I recreated wtmp on 30 Oct 2002. The 'user' is there again!
X******* ****X******* X*******X******* Sun Apr 7 02:37 still logged in
My Machine :- Linux Tango 2.4.4 #2 Mon Oct 7 03:36:57 CEST 2002 i586 unknown using SuSE 7.2 installation was done at the back-end of August 2002.
let me guess, you're using reiserfs, right? thats a more or less known bug. Sometimes scary entrys show up in the last/wtemp logs. You can cool down :) To be sure that your box isn't compromised, run chkrootkit (www.chkrootkit.org). regards, Sven