[NTLUG:Discuss] Have I been Hacked?

[Jack-I-Need-a-Job-Snodgrass]

/USR/BIN/CRON seems weird. 
Do you now have a /USR directory in addition to your /usr directory? 

If you have redhat, you can do 
rpm -V net-tools
rpm -V procps 
to verify that you have the correct netstat and ps command. 
This isn't fool proof... but if those commands show up as being 
different, you can bet you were hacked. 

I am not sure what the find command is doing.

jack




----- Original Message ----- 
From: "Jason Ferguson" <jferg3 at swbell.net>
To: "NTLUG" <discuss at ntlug.org>
Sent: Monday, April 01, 2002 6:53 AM
Subject: [NTLUG:Discuss] Have I been Hacked?