OT. Have I been hacked? IRCD?

[Rich Burroughs]

mark wrote:
> I am just trying to figure out if I have to re-install.  It look like 
> it.  Vulnerability in PHP or PHPBB I think.
> 
> 
> I found the perl script in /tmp
> 
> Or maybe secure /tmp and take the below steps.
> 
> Thoughts on this all?

It's clearly hacker activity.

Beyond closing whatever vulnerability caused this, have you checked to 
see if the system has been trojaned? It's not perfect, but "rpm -Va" is 
a quick and dirty way to do it.

A better way is to check using Tripwire or a similar tool, if you 
installed one.


Rich