Re: [seul-edu] Server hacked via FTP hack... need help...

[Ben Armstrong <synrg@sanctuary.nslug.ns.ca>]

On Fri, May 03, 2002 at 11:01:12AM -0400, Ryan Booz wrote:
> Although root appears to have control of the file (with FTP as 
> group now), I can't do anything with it.  Any suggestions on how I can get 
> this stuff corrected and get ssh back up and running?

It is likely that the file has the "immutable" bit set, a common ploy
to try to prevent the victim from undoing the damage.  See "man chattr".
However, as others have pointed out, a fresh install, with a data recovery
on top of that is probably the best way to proceed at this point.

Ben
-- 
    nSLUG       http://www.nslug.ns.ca      synrg@sanctuary.nslug.ns.ca
    Debian      http://www.debian.org       synrg@debian.org
[ pgp key fingerprint = 7F DA 09 4B BA 2C 0D E0  1B B1 31 ED C6 A9 39 4F ]
[ gpg key fingerprint = 395C F3A4 35D3 D247 1387  2D9E 5A94 F3CA 0B27 13C8 ]