On Friday 20 June 2003 05:41 pm, Michael Schwendt wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > <snip> > > So, basically my question is, how do I remove those files ? or why can't > > I remove it, eventhough I am root ? I tried to boot as single user and it > > didn't help either. > > > > The permission of the file and directory are as follows (the files is in > > directory /bin and /usr/bin): > > > > -rwxr-xr-x 1 root root 36692 Dec 13 2001 ls > > -rwxr-xr-x 1 root root 32756 Dec 13 2001 ps > > -rwxr-xr-x 1 root root 30640 Dec 13 2001 netstat > > -rwxr-xr-x 1 root root 48856 Sep 25 1983 top > > - -snip- > > With "ls" you will fail to detect the hacker's changes. Use "lsattr" > and read about it in "man lsattr".
Thanks a lot. That's what I need. RDB -- Reuben D. Budiardja -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list
