From owner-freebsd-questions@FreeBSD.ORG  Sat Jun 23 06:15:32 2012
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E7E971065672
	for <freebsd-questions@freebsd.org>;
	Sat, 23 Jun 2012 06:15:32 +0000 (UTC)
	(envelope-from erich@alogreentechnologies.com)
Received: from alogreentechnologies.com (alogreentechnologies.com
	[67.212.224.110])
	by mx1.freebsd.org (Postfix) with ESMTP id BC8758FC08
	for <freebsd-questions@freebsd.org>;
	Sat, 23 Jun 2012 06:15:32 +0000 (UTC)
Received: from x220.ovitrap.com ([122.129.201.75]) (authenticated bits=0)
	by alogreentechnologies.com (8.13.1/8.13.1) with ESMTP id
	q5N6FTW6003911; Sat, 23 Jun 2012 00:15:31 -0600
From: Erich Dollansky <erich@alogreentechnologies.com>
Organization: ALO Green Technologies
To: RetspaN Code <silent24_2007@yahoo.com>, freebsd-questions@freebsd.org
Date: Sat, 23 Jun 2012 13:15:28 +0700
User-Agent: KMail/1.13.7 (FreeBSD/10.0-CURRENT; KDE/4.8.3; amd64; ; )
References: <1340379530.49640.YahooMailNeo@web190402.mail.sg3.yahoo.com>
	<201206231121.07892.erich@alogreentechnologies.com>
	<1340431166.52870.YahooMailNeo@web190402.mail.sg3.yahoo.com>
In-Reply-To: <1340431166.52870.YahooMailNeo@web190402.mail.sg3.yahoo.com>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201206231315.28209.erich@alogreentechnologies.com>
Cc: 
Subject: Re: I have a problem to my server running under FreeBSD 8.1 p-1
	release
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 23 Jun 2012 06:15:33 -0000

Hi,

On Saturday 23 June 2012 12:59:26 RetspaN Code wrote:
> Hello,
> 
> Yes I'm still have a root access... that is why i right you a letter for a
> help regarding to this problem on my server which is running freebsd 8.1
> p1 release... i did paste the error that i encounter on the server on my
> first email.

this only shows that you have an intruder. It would be close to impossible to 
diagnose it right from distance.
> 
> Please help me to fix.

Get either a boot 8.3 media or 9.0 and make a fresh install which even 
overwrites the filesystem. Of course, make a backup of your user data. Use 
different passwords and - most important - keep the machine offline until the 
new system is installed.

I cannot think of a faster way to get rid of the problem.

Erich
> 
> Thanks Erich,
> 
> Regards,
> 
> FredFoxs
> 
> 
> ________________________________
>  From: Erich Dollansky <erich@alogreentechnologies.com>
> To: RetspaN Code <silent24_2007@yahoo.com>; freebsd-questions@freebsd.org
> Sent: Saturday, June 23, 2012 12:21 PM
> Subject: Re: I have a problem to my server running under FreeBSD 8.1 p-1
> release
> 
> Hi,
> 
> On Saturday 23 June 2012 09:47:35 RetspaN Code wrote:
> > Hello,
> > 
> > Since you all the responsible of freebsd source and updates... Is there
> 
> you are the only one responsible for the break in. So, what was the
> problem?
> 
> > anyway to fix my server without re install the system?
> 
> Oh yes, you can find out what was done with your system and revert all
> changes.
> 
> But you must be really sure what you are doing then.
> 
> And you can do this only as long as you still have root access. Do you
> still have it?
> 
> Erich