Subject: Re: system possibly compromised
To: None <rgfisch@excite.com>
From: Dick Davies <rasputnik@hellooperator.net>
List: netbsd-help
Date: 02/24/2004 17:13:12
Roger Fischer wrote:
> How can I determine if a root-kit has been installed or my system has been
>
> compromised in some other way?
>
> My ISP sent me an email about spam comming from my IP address,
Have you secured your mailserver? Check its logs and see who has been
using it.
and I also got
>
> some emails about mail that could not be delivered (that I had not sent).
oh, everyone gets those.
> I did a find looking for a CRON (in caps) and turned up nothing.
That does rook a bit iffy. What version of NetBSD are you running?
What does 'uname -a' say?