Manuel Arostegui Ramirez <manuel@xxxxxxxxxxxxxx> kirjoitti:
El Sábado, 20 de Octubre de 2007 16:37, Les Mikesell escribió:
>
> Note that if the box has been cracked with a typical rootkit, the
> netstat program (and ps, ls, etc.) will have been replaced with versions
> that don't show what is really going on.
>
Absolutely.
The thing is that the original poster have not provided any information or any
thought that lead him to think he has been hacked, so we're just guessing...
I just think he don't have any idea about what's going on on his system, so we
don't know if he already ran rkhunter or similar to find out if there's any
well-known rootkit installed...
Let's wait...
All the best
Manuel
--
Manuel Arostegui Ramirez.
Electronic Mail is not secure, may not be read every day, and should not
be used for urgent or sensitive issues.
Attached tmp directory ls -lR, anything unnormal to your eyes there?
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
--
/tmp/:
totalt 980
-rw------- 1 fjoka fjoka 1033 15 okt 06.43 gaimafAo7O
drwx------ 3 fjoka fjoka 4096 20 okt 18.41 gconfd-fjoka
drwx------ 2 root root 4096 18 okt 12.07 gconfd-root
drwx------ 2 fjoka fjoka 4096 20 okt 18.41 keyring-HczBJG
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 mapping-fjoka
drwx------ 2 fjoka fjoka 4096 20 okt 19.23 orbit-fjoka
drwx------ 2 fjoka fjoka 4096 20 okt 18.41 ssh-gPnLml2294
-r-------- 1 fjoka fjoka 5182 17 okt 16.14 tmp10328421.tmp
-r-------- 1 fjoka fjoka 194 17 okt 16.14 tmp11457e3e.tmp
-r-------- 1 fjoka fjoka 203 15 okt 06.36 tmp11810068.tmp
-r-------- 1 fjoka fjoka 0 20 okt 13.08 tmp1255da59.tmp
-r-------- 1 fjoka fjoka 5182 16 okt 07.15 tmp1451057e.tmp
-r-------- 1 fjoka fjoka 190 18 okt 12.06 tmp161cfc92.tmp
-r-------- 1 fjoka fjoka 5182 18 okt 11.53 tmp1752d895.tmp
-r-------- 1 fjoka fjoka 0 20 okt 18.42 tmp17a455bf.tmp
-r-------- 1 fjoka fjoka 190 14 okt 15.20 tmp18292d53.tmp
-r-------- 1 fjoka fjoka 194 13 okt 19.55 tmp192a7abf.tmp
-r-------- 1 fjoka fjoka 194 15 okt 16.01 tmp1934316d.tmp
-r-------- 1 fjoka fjoka 263 14 okt 13.15 tmp198b0685.tmp
-r-------- 1 fjoka fjoka 194 16 okt 07.15 tmp1a8ab450.tmp
-r-------- 1 fjoka fjoka 190 17 okt 08.30 tmp1adc5eec.tmp
-r-------- 1 fjoka fjoka 190 19 okt 08.22 tmp1b3e9b4c.tmp
-r-------- 1 fjoka fjoka 190 17 okt 16.14 tmp1debdb60.tmp
-r-------- 1 fjoka fjoka 3306 17 okt 08.30 tmp1f584db4.tmp
-r-------- 1 fjoka fjoka 5182 13 okt 19.55 tmp2029b900.tmp
-r-------- 1 fjoka fjoka 203 16 okt 07.15 tmp20c7106b.tmp
-r-------- 1 fjoka fjoka 263 16 okt 07.15 tmp220a5cbd.tmp
-r-------- 1 fjoka fjoka 263 14 okt 11.13 tmp228c1df4.tmp
-r-------- 1 fjoka fjoka 0 19 okt 08.22 tmp247c03c3.tmp
-r-------- 1 fjoka fjoka 3306 14 okt 13.15 tmp24abe4b3.tmp
-r-------- 1 fjoka fjoka 190 18 okt 12.06 tmp24f4af86.tmp
-r-------- 1 fjoka fjoka 203 18 okt 11.53 tmp250c2fd4.tmp
-r-------- 1 fjoka fjoka 203 13 okt 19.55 tmp25a332f5.tmp
-r-------- 1 fjoka fjoka 0 16 okt 07.15 tmp27036c86.tmp
-r-------- 1 fjoka fjoka 5182 20 okt 13.08 tmp27689580.tmp
-r-------- 1 fjoka fjoka 190 20 okt 18.42 tmp279ba462.tmp
-r-------- 1 fjoka fjoka 190 14 okt 13.15 tmp27f5008.tmp
-r-------- 1 fjoka fjoka 190 19 okt 08.22 tmp28f7f28b.tmp
-r-------- 1 fjoka fjoka 5182 14 okt 11.13 tmp29703ccc.tmp
-r-------- 1 fjoka fjoka 5182 13 okt 20.32 tmp29a91ab5.tmp
-r-------- 1 fjoka fjoka 0 13 okt 19.55 tmp2bdf8f10.tmp
-r-------- 1 fjoka fjoka 190 13 okt 19.55 tmp2de3103f.tmp
-r-------- 1 fjoka fjoka 190 14 okt 13.15 tmp2de94d2a.tmp
-r-------- 1 fjoka fjoka 0 14 okt 15.20 tmp2ebb37ca.tmp
-r-------- 1 fjoka fjoka 0 18 okt 12.06 tmp2f0e6cfe.tmp
-r-------- 1 fjoka fjoka 3306 17 okt 16.14 tmp325f18cb.tmp
-r-------- 1 fjoka fjoka 194 14 okt 13.15 tmp328c152b.tmp
-r-------- 1 fjoka fjoka 194 18 okt 12.06 tmp32ae06c5.tmp
-r-------- 1 fjoka fjoka 0 20 okt 18.42 tmp331d16cc.tmp
-r-------- 1 fjoka fjoka 5182 15 okt 06.36 tmp338d29e5.tmp
-r-------- 1 fjoka fjoka 190 20 okt 13.08 tmp33e14db6.tmp
-r-------- 1 fjoka fjoka 190 20 okt 18.42 tmp3554fba1.tmp
-r-------- 1 fjoka fjoka 0 17 okt 08.30 tmp364f0d6a.tmp
-r-------- 1 fjoka fjoka 0 17 okt 16.14 tmp36afa6e0.tmp
-r-------- 1 fjoka fjoka 190 14 okt 11.13 tmp3729940b.tmp
-r-------- 1 fjoka fjoka 190 13 okt 20.32 tmp376271f4.tmp
-r-------- 1 fjoka fjoka 194 19 okt 08.22 tmp3889d524.tmp
-r-------- 1 fjoka fjoka 3306 19 okt 08.22 tmp38ef412e.tmp
-r-------- 1 fjoka fjoka 263 17 okt 16.14 tmp395e89de.tmp
-r-------- 1 fjoka fjoka 0 13 okt 20.32 tmp3adfd4a.tmp
-r-------- 1 fjoka fjoka 194 17 okt 08.30 tmp3d1fe16a.tmp
-r-------- 1 fjoka fjoka 194 14 okt 11.13 tmp3e6ccef8.tmp
-r-------- 1 fjoka fjoka 203 14 okt 13.15 tmp3f04cd61.tmp
-r-------- 1 fjoka fjoka 263 18 okt 11.53 tmp407ede52.tmp
-r-------- 1 fjoka fjoka 190 15 okt 06.36 tmp41468124.tmp
-r-------- 1 fjoka fjoka 0 18 okt 11.53 tmp425faadf.tmp
-r-------- 1 fjoka fjoka 194 20 okt 18.42 tmp430c50af.tmp
-r-------- 1 fjoka fjoka 0 14 okt 15.20 tmp4326ede3.tmp
-r-------- 1 fjoka fjoka 203 17 okt 08.30 tmp435c3d85.tmp
-r-------- 1 fjoka fjoka 3306 16 okt 07.15 tmp4436f167.tmp
-r-------- 1 fjoka fjoka 3306 14 okt 11.13 tmp44370f.tmp
-r-------- 1 fjoka fjoka 203 19 okt 08.22 tmp446aa109.tmp
-r-------- 1 fjoka fjoka 0 14 okt 13.15 tmp4541297c.tmp
-r-------- 1 fjoka fjoka 3306 20 okt 18.42 tmp454c4a44.tmp
-r-------- 1 fjoka fjoka 0 18 okt 12.06 tmp47e02ce7.tmp
-r-------- 1 fjoka fjoka 263 15 okt 06.36 tmp487955b6.tmp
-r-------- 1 fjoka fjoka 190 17 okt 16.14 tmp4955d881.tmp
-r-------- 1 fjoka fjoka 0 14 okt 13.15 tmp495bfba8.tmp
-r-------- 1 fjoka fjoka 190 18 okt 11.53 tmp49f65afc.tmp
-r-------- 1 fjoka fjoka 203 14 okt 11.13 tmp4ae5872e.tmp
-r-------- 1 fjoka fjoka 263 20 okt 13.08 tmp4cd2be22.tmp
-r-------- 1 fjoka fjoka 190 16 okt 07.15 tmp4d7459de.tmp
-r-------- 1 fjoka fjoka 263 18 okt 12.06 tmp4e20b543.tmp
-r-------- 1 fjoka fjoka 194 14 okt 15.20 tmp4ea48541.tmp
-r-------- 1 fjoka fjoka 0 20 okt 13.08 tmp4ee37f1d.tmp
-r-------- 1 fjoka fjoka 263 13 okt 20.32 tmp4ee3ea1b.tmp
-r-------- 1 fjoka fjoka 190 18 okt 11.53 tmp50762cf5.tmp
-r-------- 1 fjoka fjoka 194 15 okt 06.36 tmp5084832.tmp
-r-------- 1 fjoka fjoka 203 20 okt 18.42 tmp50c7aa1f.tmp
-r-------- 1 fjoka fjoka 0 14 okt 11.13 tmp5121e349.tmp
-r-------- 1 fjoka fjoka 5182 14 okt 15.20 tmp514c81b3.tmp
-r-------- 1 fjoka fjoka 5182 17 okt 08.30 tmp53ffb34c.tmp
-r-------- 1 fjoka fjoka 263 19 okt 08.22 tmp57b7a1ab.tmp
-r-------- 1 fjoka fjoka 263 15 okt 16.01 tmp5847a900.tmp
-r-------- 1 fjoka fjoka 190 13 okt 19.55 tmp594d0d60.tmp
-r-------- 1 fjoka fjoka 263 14 okt 15.20 tmp5b1d3d77.tmp
-r-------- 1 fjoka fjoka 190 16 okt 07.15 tmp5b2db11d.tmp
-r-------- 1 fjoka fjoka 194 18 okt 11.53 tmp5e2f8434.tmp
-r-------- 1 fjoka fjoka 190 20 okt 13.08 tmp5edacdc0.tmp
-r-------- 1 fjoka fjoka 203 14 okt 15.20 tmp5f05d8f2.tmp
-r-------- 1 fjoka fjoka 0 15 okt 16.01 tmp6010dd0c.tmp
-r-------- 1 fjoka fjoka 263 17 okt 08.30 tmp61b90a8b.tmp
-r-------- 1 fjoka fjoka 5182 19 okt 08.22 tmp621b46eb.tmp
-r-------- 1 fjoka fjoka 263 20 okt 18.42 tmp623a1d36.tmp
-r-------- 1 fjoka fjoka 190 14 okt 11.13 tmp6293912c.tmp
-r-------- 1 fjoka fjoka 190 13 okt 20.32 tmp62cc6f15.tmp
-r-------- 1 fjoka fjoka 3306 15 okt 06.36 tmp637315ce.tmp
-r-------- 1 fjoka fjoka 3306 14 okt 15.20 tmp6381c7ba.tmp
-r-------- 1 fjoka fjoka 3306 18 okt 11.53 tmp672761c4.tmp
-r-------- 1 fjoka fjoka 0 18 okt 11.53 tmp69242783.tmp
-r-------- 1 fjoka fjoka 5182 15 okt 16.01 tmp6a3410b6.tmp
-r-------- 1 fjoka fjoka 0 19 okt 08.22 tmp6b58af62.tmp
-r-------- 1 fjoka fjoka 194 20 okt 13.08 tmp6c9424ff.tmp
-r-------- 1 fjoka fjoka 190 15 okt 06.36 tmp6cb07e45.tmp
-r-------- 1 fjoka fjoka 5182 20 okt 18.42 tmp6e785001.tmp
-r-------- 1 fjoka fjoka 194 13 okt 20.32 tmp70f8e8f8.tmp
-r-------- 1 fjoka fjoka 3306 20 okt 13.08 tmp711013c7.tmp
-r-------- 1 fjoka fjoka 203 17 okt 16.14 tmp7281de3e.tmp
-r-------- 1 fjoka fjoka 3306 13 okt 20.32 tmp72c3bdb8.tmp
-r-------- 1 fjoka fjoka 203 18 okt 12.06 tmp74409a4.tmp
-r-------- 1 fjoka fjoka 3306 15 okt 16.01 tmp74841a77.tmp
-r-------- 1 fjoka fjoka 0 13 okt 19.55 tmp74bfbbde.tmp
-r-------- 1 fjoka fjoka 5182 14 okt 13.15 tmp74c5f8c9.tmp
-r-------- 1 fjoka fjoka 0 15 okt 06.36 tmp75b18e45.tmp
-r-------- 1 fjoka fjoka 190 15 okt 16.01 tmp76acc8ec.tmp
-r-------- 1 fjoka fjoka 263 13 okt 19.55 tmp7a1900e.tmp
-r-------- 1 fjoka fjoka 3306 18 okt 12.06 tmp7bc8a9c8.tmp
-r-------- 1 fjoka fjoka 0 15 okt 16.01 tmp7ce92507.tmp
-r-------- 1 fjoka fjoka 0 17 okt 08.30 tmp7d2bb909.tmp
-r-------- 1 fjoka fjoka 203 13 okt 20.32 tmp7d71a12e.tmp
-r-------- 1 fjoka fjoka 0 14 okt 11.13 tmp7e063faa.tmp
-r-------- 1 fjoka fjoka 0 13 okt 20.32 tmp7e3f1d93.tmp
-r-------- 1 fjoka fjoka 0 16 okt 07.15 tmp7f35ef0e.tmp
-r-------- 1 fjoka fjoka 0 17 okt 16.14 tmp7fceea47.tmp
-r-------- 1 fjoka fjoka 203 20 okt 13.08 tmp806d37e.tmp
-r-------- 1 fjoka fjoka 0 15 okt 06.36 tmp8232cc4.tmp
-r-------- 1 fjoka fjoka 3306 13 okt 19.55 tmp932f94a.tmp
-r-------- 1 fjoka fjoka 5182 18 okt 12.06 tmp9a4445c.tmp
-r-------- 1 fjoka fjoka 190 14 okt 15.20 tmpa6fd614.tmp
-r-------- 1 fjoka fjoka 190 15 okt 16.01 tmpb7ada2e.tmp
-r-------- 1 fjoka fjoka 203 15 okt 16.01 tmpc0d331c.tmp
-r-------- 1 fjoka fjoka 190 17 okt 08.30 tmpd2307ad.tmp
-rw------- 1 fjoka fjoka 320643 14 okt 08.05 winradio-wr-1550e-pc-empfaenger.pdf
drwx------ 2 fjoka fjoka 4096 20 okt 18.41 virtual-fjoka.kktota
/tmp/gconfd-fjoka:
totalt 4
drwx------ 2 fjoka fjoka 4096 20 okt 18.41 lock
/tmp/gconfd-fjoka/lock:
totalt 4
-rwx------ 1 fjoka fjoka 609 20 okt 18.41 ior
/tmp/gconfd-root:
totalt 0
/tmp/keyring-HczBJG:
totalt 0
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 socket
/tmp/orbit-fjoka:
totalt 4
-rwx------ 1 fjoka fjoka 0 20 okt 18.41 bonobo-activation-register.lock
-rw-r--r-- 1 fjoka fjoka 629 20 okt 18.41 bonobo-activation-server-ior
srwxr-xr-x 1 fjoka fjoka 0 20 okt 19.23 linc-19fc-0-727e8b03463a3
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-8f6-0-ef4edc4bed5d
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-915-0-35941574a9429
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-91a-0-5a3e8d85e8ee2
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-920-0-4dc054315d3da
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-92e-0-209bcab973cf2
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-932-0-134c94fcdf4ed
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-934-0-134c94fcdcf28
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-936-0-134c94fce317b
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-938-0-45619728a2967
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-93b-0-45e556a0be3ec
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-940-0-3623952842597
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-94a-0-c65c31387f39
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-952-0-2884801ab8a66
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.42 linc-953-0-5ee3b5127c0f7
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-97d-0-7ebf635054213
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-97f-0-7ebf6350a2d39
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-98f-0-365ba22e4ac37
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-991-0-365ba22e8294d
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-993-0-365ba22e42868
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.41 linc-9c2-0-28e6d80d69aef
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.42 linc-9d5-0-19ced02b7f53
srwxr-xr-x 1 fjoka fjoka 0 20 okt 18.45 linc-9f0-0-879844a9b3d1
srwxr-xr-x 1 fjoka fjoka 0 20 okt 19.00 linc-a22-0-3cd0cc3541710
/tmp/ssh-gPnLml2294:
totalt 0
srw------- 1 fjoka fjoka 0 20 okt 18.41 agent.2294
/tmp/virtual-fjoka.kktota:
totalt 0
