From owner-freebsd-questions Wed Mar 10 13:55:44 1999 Delivered-To: freebsd-questions@freebsd.org Received: from uz.ComCAT.COM (uz.ComCAT.COM [204.170.64.8]) by hub.freebsd.org (Postfix) with ESMTP id 5CAD415268 for ; Wed, 10 Mar 1999 13:55:42 -0800 (PST) (envelope-from jerryr@ComCAT.COM) Received: from uw.ComCAT.COM (uw [204.170.64.249]) by uz.ComCAT.COM (8.8.8/8.8.8/sol2/mh/19980701) with ESMTP; id QAA28233; Wed, 10 Mar 1999 16:50:31 -0500 (EST) Received: from localhost by uw.ComCAT.COM (8.9.1a/8.9.1/sol2/clnt/19981012) with SMTP id QAA17506; Wed, 10 Mar 1999 16:50:26 -0500 (EST) X-Authentication-Warning: uw.ComCAT.COM: jerryr owned process doing -bs Date: Wed, 10 Mar 1999 16:50:24 -0500 (EST) From: Jerry Raynor X-Sender: jerryr@uw To: cjclark@home.com Cc: kerberus@inetu.net, des@flood.ping.uio.no, jonb@matchlogic.com, flygt@sr.se, freebsd-questions@FreeBSD.ORG Subject: Re: daily security check output In-Reply-To: <199903102136.QAA02166@cc942873-a.ewndsr1.nj.home.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG I found the file same file name in 5 different users directories (of course!) ;) I know only three of those were accessed yesterday. Now I need to just figure out which one is the bad guy! Thanks for your help! On Wed, 10 Mar 1999, Crist J. Clark wrote: > Kerberus wrote, > > come on guys think.... logs to much work, and i can run something as nobody, where in the file system does this script exist > > > > find / -name "chat.cgi" -print will tell you all you need to know...... > > Yuck. When I asked him where it was, I hoped he'd use 'locate' rather > than 'find.' > -- > Crist J. Clark cjclark@home.com > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message