[wplug] root password isn't working :(

[Jason Carr]

Russ Schneider wrote:
> On Mon, 26 Sep 2005, Greg Akins wrote:
> 
> 
>>Mandrake also offers boot options right at startup linux, failsafe and something
>>else?  I think failsafe gives a "boot:" prompt.
> 
> 
> That was it!
> 
> Ok, I have root password back (thanks guys), now the real work begins...
> 
> What should I be checking to see if someone other than my own stupidity 
> (changing the password and forgetting I did it) did this?  
> 
> 

There are some rootkit checkers out there, but look in your log files 
first, check user accounts, new files, stuff like that.  The real thing 
you should have been running is a rootkit finder or something that makes 
hashes of the files so that you know what's changed week to week or day 
to day, but that's too late now.  If you do find something of if you 
still have any doubts, erase everything and reinstall.  That's the only 
good way to make sure there's no weird voodoo going on.

- Jason