Eben King wrote:
> I just got 6-7 bounces from mail I didn't send. SoI've probably been
> the victim of either a joe-job or a rootkit. I've got the bounce
> messages. How do I tell the difference?
>
Leave a copy of tcpdump running in a terminal, watching outgoing
packets, for several hours, while you are not using your machine. Any
outbound traffic is suspicious (except for NTP or deliberately scheduled
network activity).
--ronan
-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages
posted are those of the author and do not necessarily reflect the
official policy or position of NKS or any of its employees.
This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 15:38:51 EDT