Fedora Core 2 hacked

[Nick D'Angelo]

My fedora core 2 machine got hacked and some commands have stopped working, ie top, ps and netstat.

My pop3 configuration goes down as does my imap.

If I inextd restart then all appears fine but until I do that everything returns a segmentation fault.

Any suggestions?

[Ivan Krastev · Accepted solution]

Take a look at this article:
http://www.ducea.com/2006/07/17/how-to-restore-a-hacked-linux-server/

It may be useful for you.

ivan

[Nick D'Angelo]

That looks like a very good start, thank you.

[Alexander Chuzhoy]

If you can afford to reinstall the system from scratch - then it would be the best.

If not:
boot your system from rescue CD and execute rpm -Va --chroot /path_to_the_mountpoint_of your_system

I hope the syntax is correct, as I don't have Linux system to check it on...

Any attempt to try and find out anything from within the hacked system isn't recommended, as you can't be sure whether the tools you'll use weren't modified also. Furthermore the attacker may see that you're aware of his actions and he can couse you even more damage...

[Nick D'Angelo]

I will not spend/waste much time trying to recover, I don't think. I will probably go for a fresh install.

Thanks a bunch.