|
This is probably bad news: Your server has been compromised / broken into. Unplug its internet connection NOW!
You can no longer trust your computer.
Probably the best thing to do is remove the disk with the compromised OS, and put it aside for later forensic analysis.
Reinstall to a new disk. Make sure you have a proper, difficult-to-guess root password.
Do not run services you do not need (rsh, ssh, webservers, nfs etc).
Install a firewall.
Mount your compromised disk and try to find out who broke in and how.
Good luck!
|
