Re: IRC bot on MacOS
Eric Pancer <[email protected]> Fri, 22 Apr 2005 08:49:38 -0500
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Organization | DePaul University Computer Security Response Team |
| Message-ID | <[email protected]> |
Andrew Daviel wrote on Fri, 2005-04-22 at 02:12:11 -0700... > I could post network logs, but I think it's all boring IRC and > SSH encrypted control stuff. Still looking for file timestamps etc., but > as I say I think it's before the rollover so I'm out of luck unless > there's more than one guy been trying. > > Anyone seen anything like this ? Any hints on tracing Mac bootup (I'm > basically a Linux person...) ? Try putting a "set -x" atop all of the /etc/rc* files. Also, check crontab files for "@reboot" statements. -- Eric Pancer :.: Computer Security Response Team :.: DePaul University http://security.depaul.edu/ .:`:.:':.:`:. [email protected] pgp: 1024D/7ACBCFF3 C022 4991 41E5 51E7 683C F765 62F7 7F8E 7ACB CFF3 _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions