Subject: Re: system possibly compromised
To: None <rgfisch@excite.com>
From: Dick Davies <rasputnik@hellooperator.net>
List: netbsd-help
Date: 02/24/2004 17:13:12
Roger Fischer wrote:

> How can I determine if a root-kit has been installed or my system has been
> 
> compromised in some other way?
> 
> My ISP  sent me an email about spam comming from my IP address, 

Have you secured your mailserver? Check its logs and see who has been 
using it.


and I also got
> 
> some emails about mail that could not be delivered (that I had not sent).

oh, everyone gets those.



> I did a find looking for a CRON (in caps) and turned up nothing.
That does rook a bit iffy. What version of NetBSD are you running?

What does 'uname -a' say?