Re: odd `ps` behavior

[paul@mackinney.net]

Patrick Wiseman declaimed:
> Whenever one of the basic utilities behaves weirdly, I worry I may have
> been hacked, but this is on a 2-day old Debian install:
> 
> ~$ ps
> {module_list} {module_list_R__ver_module_list}
> Warning: /boot/System.map-2.2.20-compact does not match kernel data.
> 
> I've made no kernel changes on that system.  Any idea what might be up?
> 
> Patrick
> 

When my RedHat system was hacked by a 'sub7' attack, the primary symptom
was that ps displayed weird output. I believe that the vulnerability was
in the ftp server (something I no longer run). However, the output was
quite different that what you're getting.

I'd check your log files carefully, if you've only been running for two
days you should have everything since the install. A dead giveaway for
being hack is a bunch of ^A chars, other control characters, or weird
omissions in the logs.

Here's a listing of my 'ps' on a Testing system:

-rwxr-xr-x    1 root     root        57164 Mar 31 17:23 /bin/ps

HTH, PM
-- 
Paul Mackinney
paul@mackinney.net