Security Incidents: Re: info

[Michel Arboi <arboi () yahoo com>]

 --- "Joe T." <auximini () yahoo com> a écrit : 
> - /var/log is gone
Your hacker looks lame, so I'd bet they did not wipe the log files.
You can probably read the old logs by accessing the raw disk device.
e.g. something like :
strings /dev/hdXX | less

> - any other recommendations?
Unplug the machine from internet, boot from a floppy
(http://www.toms.net/rb/ is your friend) or CDROM (or at least, remount
your partitions read only)


___________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Mail : http://fr.mail.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com