> -----Original Message-----
> From: centos-bounces@xxxxxxxxxx
> [mailto:centos-bounces@xxxxxxxxxx] On Behalf Of Manu Verhaegen
> Sent: Thursday, December 24, 2009 7:04 AM
> To: CentOS mailing list
> Subject: Re: attack
>
> at the moment everiting is solved i have block the IP adress
> but i d'ont have found the script
>
So you are the attacker. Happened to me a couple weeks ago.
Check your tmp directory and subdirectory for std, udp.pl. Also check
/etc/passwd and /etc/shadow for unusual users. Should be at the very bottom
of those files.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
