Security Incidents mailing list archives
Re: info
From: Michel Arboi <arboi () yahoo com>
Date: Sat, 4 May 2002 10:56:56 +0200 (CEST)
--- "Joe T." <auximini () yahoo com> a écrit :
- /var/log is gone
Your hacker looks lame, so I'd bet they did not wipe the log files. You can probably read the old logs by accessing the raw disk device. e.g. something like : strings /dev/hdXX | less
- any other recommendations?
Unplug the machine from internet, boot from a floppy (http://www.toms.net/rb/ is your friend) or CDROM (or at least, remount your partitions read only) ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com