Date: Fri, 9 May 2003 14:25:48 +0000 (UTC) From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: Borja Marcos <borjamar@sarenet.es> Cc: freebsd-security@freebsd.org Subject: Re: Hacked? Message-ID: <Pine.BSF.4.53.0305091424480.650@e0-0.zab2.int.zabbadoz.net> In-Reply-To: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es> References: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 9 May 2003, Borja Marcos wrote: > > Notice the f in place of the date? What does that mean? > > Perhaps someone has installed a different ls command (and, presumably, > others). Try doing "truss ls" to see if it is reading any sort of > strange file. Rootkits use to have configuration files hidden in weird > places. this asumes that truss is ok ;-) perhaps take the truss from your other 4.7 machine ... -- Bjoern A. Zeeb bzeeb at Zabbadoz dot NeT 56 69 73 69 74 http://www.zabbadoz.net/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.53.0305091424480.650>