[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

RE: Rooted? Could anything innocently alter the "i" flag?

> -----Original Message-----
> From: Anthony Campbell [mailto:ac@acampbell.org.uk] 
> Sent: 22 March 2004 20:07
> I can't find anything else, so far, that's unusual apart from this, so
> I'm rather reluctant to go to radical steps like reinstalling
> everything. I compared /bin/ps on another machine which is 
> OK; this was
> exactly the same length and date.

Which machine did you do the compare on? If ps has been changed, its
concievable that ls has been changed too.

Download a known good (recent) copy of chkrootkit to the box, run it and see
if it gives you anything. 

I'd strongly recommend isolating the box from the net until your _sure_ your
not rooted.


Salamis Group of Companies -  WWW.SALAMISGROUP.COM

This communication contains information which is confidential and may 
also be privileged. It is for the exclusive use of the intended 
recipient(s). If you are not the intended recipient(s) be advised 
that any form of distribution, copying or use of this communication 
or the information it contains is strictly prohibited and may be 
unlawful. We apologise if you have received this communication in 
error. Please return it to the sender immediately, delete this 
communication from your computer and destroy any copies of it. Any 
views/opinions expressed in this email are that of the author and may 
not reflect the views of Salamis (M&I)Ltd. 

Reply to: