Try running chkrootkit and rkhunter<br><br><div><span class="gmail_quote">On 9/8/05, <b class="gmail_sendername">STYMA, ROBERT E (ROBERT)</b> <<a href="mailto:stymar@lucent.com">stymar@lucent.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
><br>> Hello,<br>><br>> I installed a new server on Tuesday using Fedora Core 4 and<br>> today the shadow<br>> file was deleted three times. Since nothing was being done on<br>> the box at<br>> those times, I believe I was hacked.
<br>><br>Since it is a new install, I would look into running the<br>badblocks command just to be safe. There is always the chance<br>something is wrong with the disk where the inode for the shadow<br>file is stored. This is a long shot, but easy to do.
<br><br>Bob Styma<br><br>--<br>fedora-list mailing list<br><a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a><br>To unsubscribe: <a href="http://www.redhat.com/mailman/listinfo/fedora-list">http://www.redhat.com/mailman/listinfo/fedora-list
</a><br></blockquote></div><br>