From owner-freebsd-security Tue Apr 30 21:18: 5 2002 Delivered-To: freebsd-security@freebsd.org Received: from hotmail.com (f26.pav0.hotmail.com [64.4.32.210]) by hub.freebsd.org (Postfix) with ESMTP id 233D937B419 for ; Tue, 30 Apr 2002 21:18:03 -0700 (PDT) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 30 Apr 2002 21:18:03 -0700 Received: from 24.217.8.73 by pv0fd.pav0.hotmail.msn.com with HTTP; Wed, 01 May 2002 04:18:02 GMT X-Originating-IP: [24.217.8.73] From: "Chest Rockwell" To: security@freebsd.org Subject: newbie. possibly got hacked. need help. Date: Tue, 30 Apr 2002 23:18:02 -0500 Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 01 May 2002 04:18:03.0009 (UTC) FILETIME=[2F8E2F10:01C1F0C7] Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org i have everything pretty much turned off except for ftp. anon ftp is off tho. i tried to add a user and it said that the partition was full. i do have a cron job stats program running. /dev/ad0s1e 257998 257822 -20462 109% /var i found a /var/games/phantasia and a couple other dirs in there. i can't seem to locate the files that are filling that partition. as i try to locate anything to tell me if i was really hacked or not, i do 'df' again and my var dir is down to 10%. any idea why? _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message