[LUG] Compromised :-(

[Mark McRitchie <mark@xxxxxxxxxx>]

After I checked my email and had an unexpected security email informing me
about a change to the open ports on one of my boxes, I discovered a small
program running.

The process was running under the apache user context and was executed as
"./bind" I found the executable at /tmp/.install/bind

Whats the best place to find more information on what this could be?

Bah.
Mark

PS - Yes, I am going to reinstall the box. I've been planning it for a
while, but this just pushed it up my priorities!


--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.