Strange occurence...

[Christopher Wagner]

Excellent, thank you gentlemen.  I can now rest easy. :)

- Christopher Wagner
chrisw at pacaids.com

Packaging Aids Corporation - Information Systems
P.O. Box 9144
San Rafael, CA 94912-9144
http://www.pacaids.com/
(415) 454-4868 x116


-----Original Message-----
From: Scott Doty [mailto:scott at sonic.net]
Sent: Tuesday, October 29, 2002 8:53 PM
To: talk at nblug.org
Subject: Re: Strange occurence...


On Tue, Oct 29, 2002 at 06:00:17PM -0800, Eric Eisenhart wrote:
> On Tue, Oct 29, 2002 at 05:21:51PM -0800, Christopher Wagner wrote:
> > I ran up2date yesterday on my Redhat 7.2 box..  Today I see a new user
was
> > added that I did not create..  My paranoia kicked in BIG TIME..  I'm
> > wondering whether this user is part of the updates I received or whether
> > this machine has been compromised:
> > --
> > vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
> > --
>
> I'll bet that /dev/vcsa* is all owned by vcsa; I think it's part of the
dev
> or MAKEDEV update.

Yes indeed -- my Redhat 7.3 workstation has the vcsa owner and /dev/vcsa* is
owned by the wily rascal.

 -Scott


SPAM: ---- Start SpamAssassin results
SPAM: -4.4 hits, 5 required;
SPAM: * -4.4 -- 'In-Reply-To' line found
SPAM:
SPAM: ---- End of SpamAssassin results