RE: Rooted? Could anything innocently alter the "i" flag?
> -----Original Message-----
> From: Anthony Campbell [mailto:ac@acampbell.org.uk]
> Sent: 22 March 2004 20:07
>
> I can't find anything else, so far, that's unusual apart from this, so
> I'm rather reluctant to go to radical steps like reinstalling
> everything. I compared /bin/ps on another machine which is
> OK; this was
> exactly the same length and date.
Which machine did you do the compare on? If ps has been changed, its
concievable that ls has been changed too.
Download a known good (recent) copy of chkrootkit to the box, run it and see
if it gives you anything.
I'd strongly recommend isolating the box from the net until your _sure_ your
not rooted.
Mark.
Salamis Group of Companies - WWW.SALAMISGROUP.COM
This communication contains information which is confidential and may
also be privileged. It is for the exclusive use of the intended
recipient(s). If you are not the intended recipient(s) be advised
that any form of distribution, copying or use of this communication
or the information it contains is strictly prohibited and may be
unlawful. We apologise if you have received this communication in
error. Please return it to the sender immediately, delete this
communication from your computer and destroy any copies of it. Any
views/opinions expressed in this email are that of the author and may
not reflect the views of Salamis (M&I)Ltd.
Reply to: