Re: Am I paranoid?
On Mon 24 Feb 2014 at 19:23:29 +0100, Ralf Mardorf wrote:
> On Mon, 2014-02-24 at 09:51 -0600, yaro@marupa.net wrote:
> > Thank you. Using that command it'd be trivial to see if those files
> > were installed by the package manager, maybe a dependency, which is
> > more likely than being compromised, in all honesty.
>
> When something is installed as a dependency, then it would show up in
> the history. Assumed the OP isn't mistaken and the OP didn't install
> something that included those stuff, then somebody has got access to the
> machine. Somebody mentioned this already and I agree with this. I only
> wonder why somebody should install this. Perhaps it's something else,
> with this harmless, but faked name. I suspect the OP installed it,
> without being aware of it and didn't find it in the history or deleted
> parts of the history. In case of doubt only a new install is secure.
apt-cache rdepends --no-breaks open-vm-tools
gives
Reverse Depends:
open-vm-tools-dbg
open-vm-toolbox
open-vm-dkms
Does that resolve the ". . . . maybe a dependency" question?
Reply to: