hacked

[Technomage]

On Saturday 15 April 2006 21:40, Bob Holtzman wrote:
> On Fri, 14 Apr 2006, Jason Spatafore wrote:
> > 2. Check /etc/passwd and see if there are any accounts which are
> > suspicious. Also check to see if there is an account with the UID of "0",
> > other than root.
>
> How about an entry like nobody:x:99:99:Nobody:/:/sbin/nologin?

thats a normal entry. I have that here on several machines.
now if it were: nobody:x:0:0:Nobody:/:/bin/sh

*THEN* I would be concerned!