find trace of attacks

abd_bela · 12-30-2008, 01:24 AM

Hi,
I fear that an attack or an entry in my PC has occured, how to find the trace of the attacks.

thanks a lot

farslayer · 12-30-2008, 09:38 AM

This would be better suited in the Security forum.. requesting relocation.

What leads you to believe your system has been compromised ?

Do you have any evidence to support your suspicions ? Log entries, etc..

Have you run any tools to see if there is a rootkit on your system ?

http://www.chkrootkit.org/ - Check Rootkit
http://www.rootkit.nl/projects/rootkit_hunter.html - rootkit hunter

If you can verify your system has been compromised have you pulled it offline ?
Image the system for later analysis,wipe the system completely and reload clean.

XavierP · 12-30-2008, 10:42 AM

Moved: This thread is more suitable in Linux-Security and has been moved accordingly to help your thread/question get the exposure it deserves.

win32sux · 12-30-2008, 11:08 AM

Yes, it would be a great start if you could tell us exactly what has made you suspect that your box has been compromised. In addition to farslayer's requests, please let us know what kind of applications/services your box is running.