Security Incidents: Fw: Help with compromised linux box.---- [updated] ----

[Anthony Coley <beta_1_0 () HOTMAIL COM>]

Thanks to all for offering to help.  You can find the requested files at:
http://www.angelfire.com/linux/beta10/

Thanks,

Anthony



----- Original Message -----
From: "Anthony Coley" <beta_1_0 () HOTMAIL COM>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Saturday, September 16, 2000 12:00 AM
Subject: Help with compromised linux box.


My Linux box was compromised a couple of weeks ago.  Once I noticed this I
removed it from the Internet
and began trying to figure out what this person did.  I've found a program
that was hidden in /dev/chr/stachel/
and I want to know if someone would be willing to take a look at what I've
found to help me identify what this
person did?  I've tar-ed the directory and it's about 650k, so it small.

If this is not the correct forum for this please advise.

Thanks in advance,

Anthony