Re: system compromised
James Brown wrote:
> James Brown wrote:
>> Chris wrote:
>>> On Sun, 5 Sep 2010 15:21:50 +0800
>>> Probably not. Have you done updates recently? After you installed
>>> rkhunter, did you run it with the --propupd switch?
>>>
>>> Odd though, my which resides in /usr/bin opposed to your /bin.
>>> This could be a difference from your Deb 5 and my Sid though.
>>>
>> I have the similar problem:
>>> Warning: The file properties have changed:
>>> File: /bin/bash
>>> Current inode: 1297223 Stored inode: 2594446
>>> Warning: The file properties have changed:
>>> File: /bin/cat
>>> Current inode: 1297207 Stored inode: 2594414
>>> Warning: The file properties have changed:
>>> File: /bin/chmod
>>> Current inode: 1297184 Stored inode: 2594368
>>> Warning: The file properties have changed:
>>> File: /bin/chown
>>> Current inode: 1297182 Stored inode: 2594364
>>> Warning: The file properties have changed:
>>> File: /bin/cp
>>> Current inode: 1297206 Stored inode: 2594412
>>> Warning: The file properties have changed:
>>> File: /bin/csh
>>> Current inode: 1296846 Stored inode: 2593692
>>> Warning: The file properties have changed:
>>> File: /bin/date
>>> Current inode: 1297187 Stored inode: 2594374
>>> Warning: The file properties have changed:
>>> File: /bin/df
>>> Current inode: 1297190 Stored inode: 2594380
>>> Warning: The file properties have changed:
>>> File: /bin/dmesg
>>> Current inode: 1297211 Stored inode: 2594422
>>> Warning: The file properties have changed:
>>> File: /bin/echo
>>> Current inode: 1297172 Stored inode: 2594344
>>> Warning: The file properties have changed:
>>> File: /bin/ed
>>> Current inode: 1297197 Stored inode: 2594394
>>> Warning: The file properties have changed:
>>> File: /bin/egrep
>>> Current inode: 1297221 Stored inode: 2594442
>>> Warning: The file properties have changed:
>>> File: /bin/fgrep
>>> Current inode: 1297228 Stored inode: 2594456
>>> Warning: The file properties have changed:
>>> File: /bin/fuser
>>> Current inode: 1297180 Stored inode: 2594360
>>> Warning: The file properties have changed:
>>> File: /bin/grep
>>> Current inode: 1297216 Stored inode: 2594432
>>> Warning: The file properties have changed:
>>> File: /bin/ip
>>> Current inode: 1297175 Stored inode: 2594350
>>> Warning: The file properties have changed:
>>> File: /bin/kill
>>> Current inode: 1297176 Stored inode: 2594352
>>> Warning: The file properties have changed:
>>> File: /bin/login
>>> Current inode: 1297255 Stored inode: 2594510
>>> Warning: The file properties have changed:
>>> File: /bin/ls
>>> Current inode: 1297247 Stored inode: 2594494
>>> Warning: The file properties have changed:
>>> File: /bin/lsmod
>>> Current inode: 1297252 Stored inode: 2594504
>>> Warning: The file properties have changed:
>>> File: /bin/mktemp
>>> Current inode: 1297241 Stored inode: 2594482
>>> Warning: The file properties have changed:
>>> File: /bin/more
>>> Current inode: 1297196 Stored inode: 2594392
>>> Warning: The file properties have changed:
>>> File: /bin/mount
>>> Current inode: 1297188 Stored inode: 2594376
>>> Warning: The file properties have changed:
>>> File: /bin/mv
>>> Current inode: 1297242 Stored inode: 2594484
>>> Warning: The file properties have changed:
>>> File: /bin/netstat
>>> Current inode: 1297231 Stored inode: 2594462
>>> Warning: The file properties have changed:
>>> File: /bin/ps
>>> Current inode: 1297230 Stored inode: 2594460
>>> Warning: The file properties have changed:
>>> File: /bin/pwd
>>> Current inode: 1297210 Stored inode: 2594420
>>> Warning: The file properties have changed:
>>> File: /bin/readlink
>>> Current inode: 1297213 Stored inode: 2594426
>>> Warning: The file properties have changed:
>>> File: /bin/sed
>>> Current inode: 1297218 Stored inode: 2594436
>>> Warning: The file properties have changed:
>>> File: /bin/sh
>>> Current inode: 1297217 Stored inode: 2594434
>>> Warning: The file properties have changed:
>>> File: /bin/su
>>> Current inode: 1297208 Stored inode: 2594416
>>> Warning: The file properties have changed:
>>> File: /bin/touch
>>> Current inode: 1297185 Stored inode: 2594370
>>> Warning: The file properties have changed:
>>> File: /bin/uname
>>> Current inode: 1297199 Stored inode: 2594398
>>> Warning: The file properties have changed:
>>> File: /bin/which
>>> Current inode: 1297246 Stored inode: 2594492
>>> Warning: The file properties have changed:
>>> File: /bin/tcsh
>>> Current inode: 1297235 Stored inode: 2594470
>>> Warning: The file properties have changed:
>>> File: /usr/bin/awk
>>> Current inode: 1655623 Stored inode: 3311246
>>> Warning: The file properties have changed:
>>> File: /usr/bin/basename
>>> Current inode: 1658664 Stored inode: 3317328
>>> Warning: The file properties have changed:
>>> File: /usr/bin/chattr
>>> Current inode: 1658810 Stored inode: 3317620
>>> Warning: The file properties have changed:
>>> File: /usr/bin/cut
>>> Current inode: 1658385 Stored inode: 3316770
>>> Warning: The file properties have changed:
>>> File: /usr/bin/diff
>>> Current inode: 1658630 Stored inode: 3317260
>>> Warning: The file properties have changed:
>>> File: /usr/bin/dirname
>>> Current inode: 1658619 Stored inode: 3317238
>>> Warning: The file properties have changed:
>>> File: /usr/bin/dpkg
>>> Current inode: 1658463 Stored inode: 3316926
>>> Warning: The file properties have changed:
>>> File: /usr/bin/dpkg-query
>>> Current inode: 1658714 Stored inode: 3317428
>>> Warning: The file properties have changed:
>>> File: /usr/bin/du
>>> Current inode: 1658639 Stored inode: 3317278
>>> Warning: The file properties have changed:
>>> File: /usr/bin/env
>>> Current inode: 1658304 Stored inode: 3316608
>>> Warning: The file properties have changed:
>>> File: /usr/bin/file
>>> Current inode: 1658322 Stored inode: 3316644
>>> Warning: The file properties have changed:
>>> File: /usr/bin/find
>>> Current inode: 1658466 Stored inode: 3316932
>>> Warning: The file properties have changed:
>>> File: /usr/bin/GET
>>> Current inode: 1658826 Stored inode: 3317652
>>> Warning: The file properties have changed:
>>> File: /usr/bin/groups
>>> Current inode: 1658372 Stored inode: 3316744
>>> Warning: The file properties have changed:
>>> File: /usr/bin/head
>>> Current inode: 1658418 Stored inode: 3316836
>>> Warning: The file properties have changed:
>>> File: /usr/bin/id
>>> Current inode: 1658765 Stored inode: 3317530
>>> Warning: The file properties have changed:
>>> File: /usr/bin/killall
>>> Current inode: 1658395 Stored inode: 3316790
>>> Warning: The file properties have changed:
>>> File: /usr/bin/last
>>> Current inode: 1658363 Stored inode: 3316726
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lastlog
>>> Current inode: 1658334 Stored inode: 3316668
>>> Warning: The file properties have changed:
>>> File: /usr/bin/ldd
>>> Current inode: 1659800 Stored inode: 3319600
>>> Warning: The file properties have changed:
>>> File: /usr/bin/less
>>> Current inode: 1658757 Stored inode: 3317514
>>> Warning: The file properties have changed:
>>> File: /usr/bin/logger
>>> Current inode: 1658663 Stored inode: 3317326
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lsattr
>>> Current inode: 1658572 Stored inode: 3317144
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lsof
>>> Current inode: 1658865 Stored inode: 3317730
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lynx
>>> Current inode: 1655656 Stored inode: 3311312
>>> Warning: The file properties have changed:
>>> File: /usr/bin/mail
>>> Current inode: 1655640 Stored inode: 3311280
>>> Warning: The file properties have changed:
>>> File: /usr/bin/md5sum
>>> Current inode: 1658453 Stored inode: 3316906
>>> Warning: The file properties have changed:
>>> File: /usr/bin/newgrp
>>> Current inode: 1658451 Stored inode: 3316902
>>> Warning: The file properties have changed:
>>> File: /usr/bin/passwd
>>> Current inode: 1658901 Stored inode: 3317802
>>> Warning: The file properties have changed:
>>> File: /usr/bin/perl
>>> Current inode: 1658715 Stored inode: 3317430
>>> Warning: The file properties have changed:
>>> File: /usr/bin/pstree
>>> Current inode: 1658565 Stored inode: 3317130
>>> Warning: The file properties have changed:
>>> File: /usr/bin/rkhunter
>>> Current inode: 1660745 Stored inode: 3321490
>>> Warning: The file properties have changed:
>>> File: /usr/bin/runcon
>>> Current inode: 1658401 Stored inode: 3316802
>>> Warning: The file properties have changed:
>>> File: /usr/bin/sha1sum
>>> Current inode: 1658864 Stored inode: 3317728
>>> Warning: The file properties have changed:
>>> File: /usr/bin/size
>>> Current inode: 1658566 Stored inode: 3317132
>>> Warning: The file properties have changed:
>>> File: /usr/bin/sort
>>> Current inode: 1658499 Stored inode: 3316998
>>> Warning: The file properties have changed:
>>> File: /usr/bin/stat
>>> Current inode: 1658449 Stored inode: 3316898
>>> Warning: The file properties have changed:
>>> File: /usr/bin/strings
>>> Current inode: 1658487 Stored inode: 3316974
>>> Warning: The file properties have changed:
>>> File: /usr/bin/sudo
>>> Current inode: 1660462 Stored inode: 3320924
>>> Warning: The file properties have changed:
>>> File: /usr/bin/tail
>>> Current inode: 1658838 Stored inode: 3317676
>>> Warning: The file properties have changed:
>>> File: /usr/bin/test
>>> Current inode: 1658370 Stored inode: 3316740
>>> Warning: The file properties have changed:
>>> File: /usr/bin/top
>>> Current inode: 1658778 Stored inode: 3317556
>>> Warning: The file properties have changed:
>>> File: /usr/bin/touch
>>> Current inode: 1658516 Stored inode: 3317032
>>> Warning: The file properties have changed:
>>> File: /usr/bin/tr
>>> Current inode: 1658808 Stored inode: 3317616
>>> Warning: The file properties have changed:
>>> File: /usr/bin/uniq
>>> Current inode: 1658343 Stored inode: 3316686
>>> Warning: The file properties have changed:
>>> File: /usr/bin/users
>>> Current inode: 1658652 Stored inode: 3317304
>>> Warning: The file properties have changed:
>>> File: /usr/bin/vmstat
>>> Current inode: 1658795 Stored inode: 3317590
>>> Warning: The file properties have changed:
>>> File: /usr/bin/w
>>> Current inode: 1655661 Stored inode: 3311322
>>> Warning: The file properties have changed:
>>> File: /usr/bin/watch
>>> Current inode: 1658346 Stored inode: 3316692
>>> Warning: The file properties have changed:
>>> File: /usr/bin/wc
>>> Current inode: 1658786 Stored inode: 3317572
>>> Warning: The file properties have changed:
>>> File: /usr/bin/wget
>>> Current inode: 1658297 Stored inode: 3316594
>>> Warning: The file properties have changed:
>>> File: /usr/bin/whatis
>>> Current inode: 1658677 Stored inode: 3317354
>>> Warning: The file properties have changed:
>>> File: /usr/bin/whereis
>>> Current inode: 1658357 Stored inode: 3316714
>>> Warning: The file properties have changed:
>>> File: /usr/bin/which
>>> Current inode: 1658610 Stored inode: 3317220
>>> Warning: The file properties have changed:
>>> File: /usr/bin/who
>>> Current inode: 1658678 Stored inode: 3317356
>>> Warning: The file properties have changed:
>>> File: /usr/bin/whoami
>>> Current inode: 1658571 Stored inode: 3317142
>>> Warning: The file properties have changed:
>>> File: /usr/bin/tcsh
>>> Current inode: 1658885 Stored inode: 3317770
>>> Warning: The file properties have changed:
>>> File: /usr/bin/gawk
>>> Current inode: 1658829 Stored inode: 3317658
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lwp-request
>>> Current inode: 1658437 Stored inode: 3316874
>>> Warning: The file properties have changed:
>>> File: /usr/bin/lynx.cur
>>> Current inode: 1658482 Stored inode: 3316964
>>> Warning: The file properties have changed:
>>> File: /usr/bin/bsd-mailx
>>> Current inode: 1658342 Stored inode: 3316684
>>> Warning: The file properties have changed:
>>> File: /usr/bin/w.procps
>>> Current inode: 1658408 Stored inode: 3316816
>>> Warning: The file properties have changed:
>>> File: /sbin/depmod
>>> Current inode: 1297274 Stored inode: 2594548
>>> Warning: The file properties have changed:
>>> File: /sbin/ifconfig
>>> Current inode: 1297344 Stored inode: 2594688
>>> Warning: The file properties have changed:
>>> File: /sbin/ifdown
>>> Current inode: 1297326 Stored inode: 2594652
>>> Warning: The file properties have changed:
>>> File: /sbin/ifup
>>> Current inode: 1297369 Stored inode: 2594738
>>> Warning: The file properties have changed:
>>> File: /sbin/init
>>> Current inode: 1297364 Stored inode: 2594728
>>> Warning: The file properties have changed:
>>> File: /sbin/insmod
>>> Current inode: 1297294 Stored inode: 2594588
>>> Warning: The file properties have changed:
>>> File: /sbin/ip
>>> Current inode: 1297271 Stored inode: 2594542
>>> Warning: The file properties have changed:
>>> File: /sbin/lsmod
>>> Current inode: 1297368 Stored inode: 2594736
>>> Warning: The file properties have changed:
>>> File: /sbin/modinfo
>>> Current inode: 1297371 Stored inode: 2594742
>>> Warning: The file properties have changed:
>>> File: /sbin/modprobe
>>> Current inode: 1297378 Stored inode: 2594756
>>> Warning: The file properties have changed:
>>> File: /sbin/rmmod
>>> Current inode: 1297298 Stored inode: 2594596
>>> Warning: The file properties have changed:
>>> File: /sbin/runlevel
>>> Current inode: 1297308 Stored inode: 2594616
>>> Warning: The file properties have changed:
>>> File: /sbin/sulogin
>>> Current inode: 1297285 Stored inode: 2594570
>>> Warning: The file properties have changed:
>>> File: /sbin/sysctl
>>> Current inode: 1297317 Stored inode: 2594634
>>> Warning: The file properties have changed:
>>> File: /sbin/syslogd
>>> Current inode: 1297323 Stored inode: 2594646
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/adduser
>>> Current inode: 1430232 Stored inode: 2860464
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/chroot
>>> Current inode: 1430225 Stored inode: 2860450
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/cron
>>> Current inode: 1430291 Stored inode: 2860582
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/groupadd
>>> Current inode: 1430321 Stored inode: 2860642
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/groupdel
>>> Current inode: 1430318 Stored inode: 2860636
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/groupmod
>>> Current inode: 1430341 Stored inode: 2860682
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/grpck
>>> Current inode: 1430229 Stored inode: 2860458
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/nologin
>>> Current inode: 1430359 Stored inode: 2860718
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/pwck
>>> Current inode: 1430361 Stored inode: 2860722
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/tcpd
>>> Current inode: 1430276 Stored inode: 2860552
>>> Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/useradd
>>> Current inode: 1430266 Stored inode: 2860532
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/userdel
>>> Current inode: 1430285 Stored inode: 2860570
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/usermod
>>> Current inode: 1430258 Stored inode: 2860516
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/vipw
>>> Current inode: 1430364 Stored inode: 2860728
>>> Warning: The file properties have changed:
>>> File: /usr/sbin/xinetd
>>> Current inode: 1430337 Stored inode: 2860674
>>> Warning: The file '/usr/sbin/unhide-linux26' exists on the system, but it is not present in the rkhunter.dat file.
>>> Warning: Found enabled xinetd service: /etc/xinetd.d/ftp_psa
>>> Warning: Found enabled xinetd service: /etc/xinetd.d/poppassd_psa
>>> Warning: Found enabled xinetd service: /etc/xinetd.d/smtp_psa
>>> Warning: Found enabled xinetd service: /etc/xinetd.d/smtps_psa
>>> Warning: Found enabled xinetd service: /etc/xinetd.d/submission_psa
>>> Warning: No output found from the lsmod command or the /proc/modules file:
>>> /proc/modules output:
>>> lsmod output:
>>
>> I have no updating before it excepting updating the wireshark.
>> It seems to me that it need update packeges which includes the above
>> files for changing inodes, not the wireshark.
>>
>>
>
> And what do you think about the next? There are many hidden prosseses
> in my vds-system that I can see throwgh unhide-tcp. Or those are
> procceses on physical machine?
>
>
Sorry, through unhide sys.
Unhide proc and unhide-tcp don't report about any problems.
Reply to: