UnrealIRCd Forums

No doubt. It was hacked.

He reconnected about one hour ago, this is what he tried:

w
lastlog
suid
id
uname 0a
uname -a
lastlog
cd /tmp
ls
cd .,
ls -a
exit

I had deleted his changes at /tmp before, so he exited. I have just changed password of "c".

Now I have to try to recover system status and ...

Hi,

I need help about this topic. Hope anybody can tell me something!

I noticed this morning that my root password has changed. After recovering it, I saw a new user in my server called "c". This is what i found in bash_history of that user:

cd /tmp
wget http://www.unrealircd.com/downloads ...