New answers tagged intrusion
Assuming the root account has not been compromised (and this is not a good assumption -- the attacker may have used a privilege escalation attack without leaving traces), you can trust the log files and the system utilities. In this case, I'd dump the program memory for analysis (eg. by triggering a core dump), archive the user's files and the temporary ...
Top 50 recent answers are included