Date: Fri, 9 May 2003 15:46:35 +0200 From: Borja Marcos <borjamar@sarenet.es> To: Peter Elsner <peter@servplex.com> Cc: freebsd-security@freebsd.org Subject: Re: Hacked? Message-ID: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es> In-Reply-To: <5.2.0.9.2.20030509083519.01813eb8@mail.servplex.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> Notice the f in place of the date? What does that mean? Perhaps someone has installed a different ls command (and, presumably, others). Try doing "truss ls" to see if it is reading any sort of strange file. Rootkits use to have configuration files hidden in weird places. Borja.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?A695FEAC-8224-11D7-B2CA-000393C94468>