Strange occurence...

[Scott Doty]

On Tue, Oct 29, 2002 at 06:00:17PM -0800, Eric Eisenhart wrote:
> On Tue, Oct 29, 2002 at 05:21:51PM -0800, Christopher Wagner wrote:
> > I ran up2date yesterday on my Redhat 7.2 box..  Today I see a new user was
> > added that I did not create..  My paranoia kicked in BIG TIME..  I'm
> > wondering whether this user is part of the updates I received or whether
> > this machine has been compromised:
> > --
> > vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
> > --
> 
> I'll bet that /dev/vcsa* is all owned by vcsa; I think it's part of the dev
> or MAKEDEV update.

Yes indeed -- my Redhat 7.3 workstation has the vcsa owner and /dev/vcsa* is
owned by the wily rascal.

 -Scott