Re: URGENT: cannot able to change the password attacked by lion..

[wilson claborn net (Jonathan Wilson)]

Sorry I misspelled that BTW.

Coroner's Toolkit:
http://www.porcupine.org/forensics/tct.html
http://www.antioffline.com/TCT/ 

At 03:31 AM 6/1/2001 +0530, you wrote:

>Thanks for your mail. I got the temp. solution for my problem. I am still
>analysing the machine.
>
>Thanks,
>Kiran
>
>On Thu, 31 May 2001, Jonathan Wilson wrote:
>
>> Sounds like you've got a root kit installed.
>> 
>> You're going to have to reinstall all critical packages off of your RedHat cd
>> 
>> If I were you I'd download a rootkit detector like Coroner's Toll Kit.
>> 
>> Also, please take that box off the Net until you have it secured.
>> 
>> The best thing to do is wipe it clean and start from scratch - otherwise, you can never really be sure you got the system cleaned up enough.
>> 
>> Also, do you know how you got cracked? If not, you're likely to still have the same hole, and you'll just be cracked again.
>> 
>> At 03:08 AM 6/1/2001 +0530, you wrote:
>> 
>> >Hi,
>> >
>> >I was attacked by hacker, and I cleaned up whereever illegal files are
>> >there.
>> >
>> >Now I am unable to change the password, and not able to use userdel and
>> >useradd commands.
>> >
>> >Can you any one please suggest me how can I use those commands.
>> >
>> >The error I am getting while using passwd command is:
>> >
>> >passwd: Critical error - Immediate abort
>> >
>> >while using userdel :
>> >
>> >userdel: Cann't open passwd file
>> >
>> >(I checked the permissions of passwd, shadow, group, all are seems to be
>> >normal)
>> >
>> >Please suggest me what to do now.. Its very urgent..
>> >
>> >Thanks,
>> >Kiran
>> >
>> >
>> >
>> >
>> >
>> >
>> >_______________________________________________
>> >Redhat-list mailing list
>> >Redhat-list redhat com
>> >https://listman.redhat.com/mailman/listinfo/redhat-list 
>> 
>> ----------------------------------------------------
>> Jonathan Wilson
>> System Administrator
>> 
>> Cedar Creek Software     http://www.cedarcreeksoftware.com
>> Central Texas IT     http://www.centraltexasit.com
>> 
>> 
>> 
>> _______________________________________________
>> Redhat-list mailing list
>> Redhat-list redhat com
>> https://listman.redhat.com/mailman/listinfo/redhat-list
>> 
>
>
>
>_______________________________________________
>Redhat-list mailing list
>Redhat-list redhat com
>https://listman.redhat.com/mailman/listinfo/redhat-list 

----------------------------------------------------
Jonathan Wilson
System Administrator

Cedar Creek Software     http://www.cedarcreeksoftware.com
Central Texas IT     http://www.centraltexasit.com