Re: system compromised
Chris wrote:
> On Sun, 5 Sep 2010 15:21:50 +0800
>>
>
> Probably not. Have you done updates recently? After you installed
> rkhunter, did you run it with the --propupd switch?
>
> Odd though, my which resides in /usr/bin opposed to your /bin.
> This could be a difference from your Deb 5 and my Sid though.
>
I have the similar problem:
> Warning: The file properties have changed:
> File: /bin/bash
> Current inode: 1297223 Stored inode: 2594446
> Warning: The file properties have changed:
> File: /bin/cat
> Current inode: 1297207 Stored inode: 2594414
> Warning: The file properties have changed:
> File: /bin/chmod
> Current inode: 1297184 Stored inode: 2594368
> Warning: The file properties have changed:
> File: /bin/chown
> Current inode: 1297182 Stored inode: 2594364
> Warning: The file properties have changed:
> File: /bin/cp
> Current inode: 1297206 Stored inode: 2594412
> Warning: The file properties have changed:
> File: /bin/csh
> Current inode: 1296846 Stored inode: 2593692
> Warning: The file properties have changed:
> File: /bin/date
> Current inode: 1297187 Stored inode: 2594374
> Warning: The file properties have changed:
> File: /bin/df
> Current inode: 1297190 Stored inode: 2594380
> Warning: The file properties have changed:
> File: /bin/dmesg
> Current inode: 1297211 Stored inode: 2594422
> Warning: The file properties have changed:
> File: /bin/echo
> Current inode: 1297172 Stored inode: 2594344
> Warning: The file properties have changed:
> File: /bin/ed
> Current inode: 1297197 Stored inode: 2594394
> Warning: The file properties have changed:
> File: /bin/egrep
> Current inode: 1297221 Stored inode: 2594442
> Warning: The file properties have changed:
> File: /bin/fgrep
> Current inode: 1297228 Stored inode: 2594456
> Warning: The file properties have changed:
> File: /bin/fuser
> Current inode: 1297180 Stored inode: 2594360
> Warning: The file properties have changed:
> File: /bin/grep
> Current inode: 1297216 Stored inode: 2594432
> Warning: The file properties have changed:
> File: /bin/ip
> Current inode: 1297175 Stored inode: 2594350
> Warning: The file properties have changed:
> File: /bin/kill
> Current inode: 1297176 Stored inode: 2594352
> Warning: The file properties have changed:
> File: /bin/login
> Current inode: 1297255 Stored inode: 2594510
> Warning: The file properties have changed:
> File: /bin/ls
> Current inode: 1297247 Stored inode: 2594494
> Warning: The file properties have changed:
> File: /bin/lsmod
> Current inode: 1297252 Stored inode: 2594504
> Warning: The file properties have changed:
> File: /bin/mktemp
> Current inode: 1297241 Stored inode: 2594482
> Warning: The file properties have changed:
> File: /bin/more
> Current inode: 1297196 Stored inode: 2594392
> Warning: The file properties have changed:
> File: /bin/mount
> Current inode: 1297188 Stored inode: 2594376
> Warning: The file properties have changed:
> File: /bin/mv
> Current inode: 1297242 Stored inode: 2594484
> Warning: The file properties have changed:
> File: /bin/netstat
> Current inode: 1297231 Stored inode: 2594462
> Warning: The file properties have changed:
> File: /bin/ps
> Current inode: 1297230 Stored inode: 2594460
> Warning: The file properties have changed:
> File: /bin/pwd
> Current inode: 1297210 Stored inode: 2594420
> Warning: The file properties have changed:
> File: /bin/readlink
> Current inode: 1297213 Stored inode: 2594426
> Warning: The file properties have changed:
> File: /bin/sed
> Current inode: 1297218 Stored inode: 2594436
> Warning: The file properties have changed:
> File: /bin/sh
> Current inode: 1297217 Stored inode: 2594434
> Warning: The file properties have changed:
> File: /bin/su
> Current inode: 1297208 Stored inode: 2594416
> Warning: The file properties have changed:
> File: /bin/touch
> Current inode: 1297185 Stored inode: 2594370
> Warning: The file properties have changed:
> File: /bin/uname
> Current inode: 1297199 Stored inode: 2594398
> Warning: The file properties have changed:
> File: /bin/which
> Current inode: 1297246 Stored inode: 2594492
> Warning: The file properties have changed:
> File: /bin/tcsh
> Current inode: 1297235 Stored inode: 2594470
> Warning: The file properties have changed:
> File: /usr/bin/awk
> Current inode: 1655623 Stored inode: 3311246
> Warning: The file properties have changed:
> File: /usr/bin/basename
> Current inode: 1658664 Stored inode: 3317328
> Warning: The file properties have changed:
> File: /usr/bin/chattr
> Current inode: 1658810 Stored inode: 3317620
> Warning: The file properties have changed:
> File: /usr/bin/cut
> Current inode: 1658385 Stored inode: 3316770
> Warning: The file properties have changed:
> File: /usr/bin/diff
> Current inode: 1658630 Stored inode: 3317260
> Warning: The file properties have changed:
> File: /usr/bin/dirname
> Current inode: 1658619 Stored inode: 3317238
> Warning: The file properties have changed:
> File: /usr/bin/dpkg
> Current inode: 1658463 Stored inode: 3316926
> Warning: The file properties have changed:
> File: /usr/bin/dpkg-query
> Current inode: 1658714 Stored inode: 3317428
> Warning: The file properties have changed:
> File: /usr/bin/du
> Current inode: 1658639 Stored inode: 3317278
> Warning: The file properties have changed:
> File: /usr/bin/env
> Current inode: 1658304 Stored inode: 3316608
> Warning: The file properties have changed:
> File: /usr/bin/file
> Current inode: 1658322 Stored inode: 3316644
> Warning: The file properties have changed:
> File: /usr/bin/find
> Current inode: 1658466 Stored inode: 3316932
> Warning: The file properties have changed:
> File: /usr/bin/GET
> Current inode: 1658826 Stored inode: 3317652
> Warning: The file properties have changed:
> File: /usr/bin/groups
> Current inode: 1658372 Stored inode: 3316744
> Warning: The file properties have changed:
> File: /usr/bin/head
> Current inode: 1658418 Stored inode: 3316836
> Warning: The file properties have changed:
> File: /usr/bin/id
> Current inode: 1658765 Stored inode: 3317530
> Warning: The file properties have changed:
> File: /usr/bin/killall
> Current inode: 1658395 Stored inode: 3316790
> Warning: The file properties have changed:
> File: /usr/bin/last
> Current inode: 1658363 Stored inode: 3316726
> Warning: The file properties have changed:
> File: /usr/bin/lastlog
> Current inode: 1658334 Stored inode: 3316668
> Warning: The file properties have changed:
> File: /usr/bin/ldd
> Current inode: 1659800 Stored inode: 3319600
> Warning: The file properties have changed:
> File: /usr/bin/less
> Current inode: 1658757 Stored inode: 3317514
> Warning: The file properties have changed:
> File: /usr/bin/logger
> Current inode: 1658663 Stored inode: 3317326
> Warning: The file properties have changed:
> File: /usr/bin/lsattr
> Current inode: 1658572 Stored inode: 3317144
> Warning: The file properties have changed:
> File: /usr/bin/lsof
> Current inode: 1658865 Stored inode: 3317730
> Warning: The file properties have changed:
> File: /usr/bin/lynx
> Current inode: 1655656 Stored inode: 3311312
> Warning: The file properties have changed:
> File: /usr/bin/mail
> Current inode: 1655640 Stored inode: 3311280
> Warning: The file properties have changed:
> File: /usr/bin/md5sum
> Current inode: 1658453 Stored inode: 3316906
> Warning: The file properties have changed:
> File: /usr/bin/newgrp
> Current inode: 1658451 Stored inode: 3316902
> Warning: The file properties have changed:
> File: /usr/bin/passwd
> Current inode: 1658901 Stored inode: 3317802
> Warning: The file properties have changed:
> File: /usr/bin/perl
> Current inode: 1658715 Stored inode: 3317430
> Warning: The file properties have changed:
> File: /usr/bin/pstree
> Current inode: 1658565 Stored inode: 3317130
> Warning: The file properties have changed:
> File: /usr/bin/rkhunter
> Current inode: 1660745 Stored inode: 3321490
> Warning: The file properties have changed:
> File: /usr/bin/runcon
> Current inode: 1658401 Stored inode: 3316802
> Warning: The file properties have changed:
> File: /usr/bin/sha1sum
> Current inode: 1658864 Stored inode: 3317728
> Warning: The file properties have changed:
> File: /usr/bin/size
> Current inode: 1658566 Stored inode: 3317132
> Warning: The file properties have changed:
> File: /usr/bin/sort
> Current inode: 1658499 Stored inode: 3316998
> Warning: The file properties have changed:
> File: /usr/bin/stat
> Current inode: 1658449 Stored inode: 3316898
> Warning: The file properties have changed:
> File: /usr/bin/strings
> Current inode: 1658487 Stored inode: 3316974
> Warning: The file properties have changed:
> File: /usr/bin/sudo
> Current inode: 1660462 Stored inode: 3320924
> Warning: The file properties have changed:
> File: /usr/bin/tail
> Current inode: 1658838 Stored inode: 3317676
> Warning: The file properties have changed:
> File: /usr/bin/test
> Current inode: 1658370 Stored inode: 3316740
> Warning: The file properties have changed:
> File: /usr/bin/top
> Current inode: 1658778 Stored inode: 3317556
> Warning: The file properties have changed:
> File: /usr/bin/touch
> Current inode: 1658516 Stored inode: 3317032
> Warning: The file properties have changed:
> File: /usr/bin/tr
> Current inode: 1658808 Stored inode: 3317616
> Warning: The file properties have changed:
> File: /usr/bin/uniq
> Current inode: 1658343 Stored inode: 3316686
> Warning: The file properties have changed:
> File: /usr/bin/users
> Current inode: 1658652 Stored inode: 3317304
> Warning: The file properties have changed:
> File: /usr/bin/vmstat
> Current inode: 1658795 Stored inode: 3317590
> Warning: The file properties have changed:
> File: /usr/bin/w
> Current inode: 1655661 Stored inode: 3311322
> Warning: The file properties have changed:
> File: /usr/bin/watch
> Current inode: 1658346 Stored inode: 3316692
> Warning: The file properties have changed:
> File: /usr/bin/wc
> Current inode: 1658786 Stored inode: 3317572
> Warning: The file properties have changed:
> File: /usr/bin/wget
> Current inode: 1658297 Stored inode: 3316594
> Warning: The file properties have changed:
> File: /usr/bin/whatis
> Current inode: 1658677 Stored inode: 3317354
> Warning: The file properties have changed:
> File: /usr/bin/whereis
> Current inode: 1658357 Stored inode: 3316714
> Warning: The file properties have changed:
> File: /usr/bin/which
> Current inode: 1658610 Stored inode: 3317220
> Warning: The file properties have changed:
> File: /usr/bin/who
> Current inode: 1658678 Stored inode: 3317356
> Warning: The file properties have changed:
> File: /usr/bin/whoami
> Current inode: 1658571 Stored inode: 3317142
> Warning: The file properties have changed:
> File: /usr/bin/tcsh
> Current inode: 1658885 Stored inode: 3317770
> Warning: The file properties have changed:
> File: /usr/bin/gawk
> Current inode: 1658829 Stored inode: 3317658
> Warning: The file properties have changed:
> File: /usr/bin/lwp-request
> Current inode: 1658437 Stored inode: 3316874
> Warning: The file properties have changed:
> File: /usr/bin/lynx.cur
> Current inode: 1658482 Stored inode: 3316964
> Warning: The file properties have changed:
> File: /usr/bin/bsd-mailx
> Current inode: 1658342 Stored inode: 3316684
> Warning: The file properties have changed:
> File: /usr/bin/w.procps
> Current inode: 1658408 Stored inode: 3316816
> Warning: The file properties have changed:
> File: /sbin/depmod
> Current inode: 1297274 Stored inode: 2594548
> Warning: The file properties have changed:
> File: /sbin/ifconfig
> Current inode: 1297344 Stored inode: 2594688
> Warning: The file properties have changed:
> File: /sbin/ifdown
> Current inode: 1297326 Stored inode: 2594652
> Warning: The file properties have changed:
> File: /sbin/ifup
> Current inode: 1297369 Stored inode: 2594738
> Warning: The file properties have changed:
> File: /sbin/init
> Current inode: 1297364 Stored inode: 2594728
> Warning: The file properties have changed:
> File: /sbin/insmod
> Current inode: 1297294 Stored inode: 2594588
> Warning: The file properties have changed:
> File: /sbin/ip
> Current inode: 1297271 Stored inode: 2594542
> Warning: The file properties have changed:
> File: /sbin/lsmod
> Current inode: 1297368 Stored inode: 2594736
> Warning: The file properties have changed:
> File: /sbin/modinfo
> Current inode: 1297371 Stored inode: 2594742
> Warning: The file properties have changed:
> File: /sbin/modprobe
> Current inode: 1297378 Stored inode: 2594756
> Warning: The file properties have changed:
> File: /sbin/rmmod
> Current inode: 1297298 Stored inode: 2594596
> Warning: The file properties have changed:
> File: /sbin/runlevel
> Current inode: 1297308 Stored inode: 2594616
> Warning: The file properties have changed:
> File: /sbin/sulogin
> Current inode: 1297285 Stored inode: 2594570
> Warning: The file properties have changed:
> File: /sbin/sysctl
> Current inode: 1297317 Stored inode: 2594634
> Warning: The file properties have changed:
> File: /sbin/syslogd
> Current inode: 1297323 Stored inode: 2594646
> Warning: The file properties have changed:
> File: /usr/sbin/adduser
> Current inode: 1430232 Stored inode: 2860464
> Warning: The file properties have changed:
> File: /usr/sbin/chroot
> Current inode: 1430225 Stored inode: 2860450
> Warning: The file properties have changed:
> File: /usr/sbin/cron
> Current inode: 1430291 Stored inode: 2860582
> Warning: The file properties have changed:
> File: /usr/sbin/groupadd
> Current inode: 1430321 Stored inode: 2860642
> Warning: The file properties have changed:
> File: /usr/sbin/groupdel
> Current inode: 1430318 Stored inode: 2860636
> Warning: The file properties have changed:
> File: /usr/sbin/groupmod
> Current inode: 1430341 Stored inode: 2860682
> Warning: The file properties have changed:
> File: /usr/sbin/grpck
> Current inode: 1430229 Stored inode: 2860458
> Warning: The file properties have changed:
> File: /usr/sbin/nologin
> Current inode: 1430359 Stored inode: 2860718
> Warning: The file properties have changed:
> File: /usr/sbin/pwck
> Current inode: 1430361 Stored inode: 2860722
> Warning: The file properties have changed:
> File: /usr/sbin/tcpd
> Current inode: 1430276 Stored inode: 2860552
> Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.
> Warning: The file properties have changed:
> File: /usr/sbin/useradd
> Current inode: 1430266 Stored inode: 2860532
> Warning: The file properties have changed:
> File: /usr/sbin/userdel
> Current inode: 1430285 Stored inode: 2860570
> Warning: The file properties have changed:
> File: /usr/sbin/usermod
> Current inode: 1430258 Stored inode: 2860516
> Warning: The file properties have changed:
> File: /usr/sbin/vipw
> Current inode: 1430364 Stored inode: 2860728
> Warning: The file properties have changed:
> File: /usr/sbin/xinetd
> Current inode: 1430337 Stored inode: 2860674
> Warning: The file '/usr/sbin/unhide-linux26' exists on the system, but it is not present in the rkhunter.dat file.
> Warning: Found enabled xinetd service: /etc/xinetd.d/ftp_psa
> Warning: Found enabled xinetd service: /etc/xinetd.d/poppassd_psa
> Warning: Found enabled xinetd service: /etc/xinetd.d/smtp_psa
> Warning: Found enabled xinetd service: /etc/xinetd.d/smtps_psa
> Warning: Found enabled xinetd service: /etc/xinetd.d/submission_psa
> Warning: No output found from the lsmod command or the /proc/modules file:
> /proc/modules output:
> lsmod output:
I have no updating before it excepting updating the wireshark.
It seems to me that it need update packeges which includes the above
files for changing inodes, not the wireshark.
Reply to: