[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: is this result of keylogger? am i hacked?

On 07/21/2010 06:39 AM, Sergey Spiridonov wrote:
> I found yesterday that some files in /etc/ (/etc/shells and
> /etc/default/default/schroot) are changed. They contain data which I was
> typing on keyboard. Strange enough, this files are not overwritten, but
> contain data they should contain + somewhere in the middle or at the
> beginning of the file they contain something I typed in browser or in
> command line in X window system.
> This looks like that I am hacked and somebody try to get my passwords.
> But may be there is another explanation, like broken package? Or can
> somebody suggest, how can I check it? Reinstalling everything from
> scratch is a lot of work...
> System is squeeze, upgraded from lenny few weeks ago.

Check 'last' and 'lastb' to see if there are any other logins or login
attempts other than yourself.

. O .   O . O   . . O   O . .   . O .
. . O   . O O   O . O   . O O   . . O
O O O   . O .   . O O   O O .   O O O

Attachment: signature.asc
Description: OpenPGP digital signature

Reply to: