On Tue, 15 Apr 2003 21:34:11 +0200
"Tage Danielsen"
Hello.
I have a server running 7.2 and today it started to jam on the net, i maked a reboot, but it will not come up, it sayes kernel panic atemted to kill init.
I found in /sbin a init program on 15K with tha same rights as a renamed initrZ9 on 470K
Is that a hackning of my server?
I tryed to move it back but the new init was write proteced even for root.
somebody know?
As root, you can easily change the permissions, but......
Your system has been seriously compromised. You don't know what files
might have been changed. Just fixing init might allow you to reboot, but
I would want to rebuld the system just to be safe. And, try to find the
hack before you put the system back up, otherwise you'll get hacked
again.
--
Jerry Feldman