[hackcheck] net-tools failed checksum test ?????
I think we have been hacked yesterday and we are getting the following two messages from our servers:
IMPORTANT: Do not ignore this email.
This message is to inform you that the rpm
package net-tools did not match the expected checksum. This could mean that
your system was compromised (OwN3D). The offending files have been removed
and replaced with the OS default. To be safe you should verify that your
system has not be compromised.
Modified Files:
S.5..... /bin/hostname
S.5..UG. /bin/netstat
S.5..UG. /sbin/ifconfig
And
IMPORTANT: Do not ignore this email.
This message is to inform you that the rpm
package findutils did not match the expected checksum. This could mean that
your system was compromised (OwN3D). The offending files have been removed
and replaced with the OS default. To be safe you should verify that your
system has not be compromised.
Modified Files:
S.5..UG. /usr/bin/find
We also got an e-mail from CronJob:
awk: fatal error: internal error
/usr/bin/run-parts: line 36: 32134 Done $i 2>&1
32135 Aborted | awk -v "progname=$i" 'progname {
print progname ":\n"
progname="";
}
{ print; }'
awk: fatal error: internal error
/usr/bin/run-parts: line 36: 32141 Broken pipe $i 2>&1
32142 Aborted | awk -v "progname=$i" 'progname {
print progname ":\n"
progname="";
}
{ print; }'
Any idea what that could mean ? We had to delete our DEMO account yesterday to make Apache work back. It stopped working and all htm files stoped displaying.. any help would be appreciated !
