On Friday 17 of December 2010, you wrote:
Am 17.12.2010 13:17, schrieb Vladislav Kurz:
On Friday 17 of December 2010, Carlos Alberto Lopez Perez wrote:
On 12/17/2010 12:35 PM, Vladislav Kurz wrote:
On Friday 17 of December 2010, Thorsten Göllner wrote:
Hi,
The other point is that pstree reports a process "zinit" I never saw
in the past:
<snip>
But I do not have any idea what it is. And I can not see the process
with "ps":
If pstree shows zinit and ps does not, it might mean that you are
already rooted (owned, hacked, cracked, etc), and your ps binary was
modified to hide the presence of rootkit named zinit.
Good point.
Try to check the md5sum of ps:
# apt-get install debsums
# debsums procps
just for reference - md5sum of /bin/ps on i386/lenny
(checked from freshly downloaded package)
a6094706266c8ec3b068cf964824afee /bin/ps
Thanks! My package matches.
Hmm, that's strange, cause if it's hacked, it shouldn't match.
Maybe even md5sum is hacked.
Please download procps, and md5sum on some clean computer, get them on
the problem machine, preferably on CD or some other non-writable media
and run those clean binaries.
Or if you can take your server down, reboot from any live-CD and check
md5sums again, using md5sum from live-cd.