[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Am I infected with a rootkit?



On Sun, Apr 16, 2023 at 04:39:13PM +0200, Jesper Dybdal wrote:
> 
> On 2023-04-16 16:33, David Wright wrote:
> > On Sun 16 Apr 2023 at 14:19:34 (+0200), Jesper Dybdal wrote:
> > > The 4 lines were:
> > > > md5users
> > > > sp md5users
> > > > sp /x/md5users
> > > > ps /x/md5users
> > > 
> > Just FTR and clarity's sake, are the "> " characters (which my MUA has
> > unhelpfully doubled by quoting) part of what was typed in the putty
> > session, or did you type them into the post to make them stand out?
> They were not part of what was typed, and I did add them to make the lines
> stand out.  Sorry for the unclear text.
> 
> Here is a correct and clear, I hope, version:
> 
> ---------------- The 4 lines were:
> md5users
> sp md5users
> sp /x/md5users
> ps /x/md5users
> ---------------- End of the 4 lines

Sometimes, some tools rely on a shell at the "other side" to do
their job. Emacs's Tramp is known for leaving traces in the shell
history, quite possibly abominations like VSCode do their thing
in a similar way.

That said, the above commands look more like a human not quite
knowing what (s)he's doing. If that were an intruder, I'd not
worry too much ;-)

Cheers
-- 
t

Attachment: signature.asc
Description: PGP signature


Reply to: