[SunHELP] Possibly hacked?

[Matt Goebel]

Hello,

  One of our solaris 7 boxes exhibited a sudden (according the users)
behavior change.  They had been using $USER to set their prompts
and some other stuff during the login process.  Now $USER is being 
set to root, but $LOGNAME is still being set correctly.
  I've checked (inetd, in.telnetd, login, etcetc) and everything seems 
to be okay.  Does this sound particularly ominous to anybody else?

Thanks for any help,
Mattias

-- 
Matthew Goebel : goebel at emunix.emich.edu : Unix Jockey @ EMU : Hail Eris
Neo-Student, Net Lurker, Donut consumer, and procrastinating Furry Fan.
 "Always with the negative waves, Moriarty" - Oddball
 "Comfort the troubled, and trouble the comfortable." - Dietrich Bonhoeffer