We had a machine rooted on Saturday. While I watched in fact, but there wasn't anything I could do about it; it happened too quickly <frown>. I noticed it when I couldn't get pop email anymore. EVERY command-line utility was replaced. So you couldn't see anything wrong if you used them.
So how did you know you were compromised? How did they get in? (I'm asking because I'm trying to learn to identify the signs....)
I have a copy of the rootkit, it was left on the machine for others to download <frown>, but I don't think I'm going to give it to anyone.
Did you/are going to just do a fresh restore? Thanks Brandon _________________________________________________________________ Chat with friends online, try MSN Messenger: http://messenger.msn.com