Off Topic - Can someone help?

[Michael Choo]

On 3 Jan  2008, at 12:22 PM, ajos1 at onion.demon.co.uk wrote:

> ###########
> #### Does anyone have a clue how I might be getting hacked???
> ###########

I've seen this on a customer's server before.

did snort report any outgoing irc traffic?

Close down Sendmail and kill all existing sendmail sessions.

do a "netstat -an" and see what ports and sessions are currently active.
chances are, port 6667 (Irc) is running, and probably got in via an  
insecure user password.

chees
-Mike

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080103/7c2ce816/attachment.html