[SunHELP] Possibly hacked?

[Thomas.Cameron at CameronTech.com]

Yes, it sounds flaky.

Have you checked all the scripts in /etc/rcX.d?
-- 
Regards,
Thomas Cameron, RHCE, CNE, MCSE, MCT
Cameron Technical Services, Inc.
http://www.camerontech.com

Matt Goebel wrote:

> Hello,
> 
>   One of our solaris 7 boxes exhibited a sudden (according the users)
> behavior change.  They had been using $USER to set their prompts
> and some other stuff during the login process.  Now $USER is being 
> set to root, but $LOGNAME is still being set correctly.
>   I've checked (inetd, in.telnetd, login, etcetc) and everything seems 
> to be okay.  Does this sound particularly ominous to anybody else?
> 
> Thanks for any help,
> Mattias