On Tue, 2005-07-19 at 19:29, Tomas Larsson wrote: > Doing a netstat on my server, I find a strange connection. > > It's a crond-job with Apache as owner, and it seems to go to an > irc-server, called 193.110.95.1:ircd, "carouge.ch.eu.undernet.org", anyone > that knows what this is?? Sounds like you need to disconnect this system from the Internet immediately and do a bare metal install. Don't try to take any half measures. Review the packages you have installed to figure out how they got in to start with. Running phpbb, awstat, or postnuke by chance? -- Scot L. Harris webid@xxxxxxxxxx Yes, but every time I try to see things your way, I get a headache.
