Re: Am I hacked?

From: Kevin B. McCarty (kmccarty_at_Princeton.EDU)
Date: 06/16/05

  • Next message: martin f krafft: "setting the umask globally" 
    Date: Thu, 16 Jun 2005 11:36:18 -0400
To: debian-user@lists.debian.org

    Michal Sedlak wrote:

    > I am nearly sure that my server was hacked, but I want to be sure. Can anybody say me if it is true.
    >
    > Here is tiger script output. Do you have any ideas how to repair it {no mkfs funny stuff please}
    > There are some line interesting. I have one for every critical system command like {login, su, etc}
    > --WARN-- [sig004w] None of the following versions of /bin/netstat (-rwxr-xr-x) matched the /bin/netstat on this machine.
    > and something like this for some kernel modules
    > --FAIL-- [lin005f] Installed file `/lib/modules/2.6.8-2-386/modules.symbols'
    > checksum differs from installed package 'kernel-image-2.6.8-2-386'.

    Could you try running chkrootkit and send the results to this list? A
    Debian package exists, but you may want to install it manually (install
    the package to another machine and copy over the files) if you don't
    know whether apt-get et al. have been trojanned. 

    -- 
Kevin B. McCarty <kmccarty@princeton.edu>   Physics Department
WWW: http://www.princeton.edu/~kmccarty/    Princeton University
GPG: public key ID 4F83C751                 Princeton, NJ 08544
-- 
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: martin f krafft: "setting the umask globally"

    Relevant Pages

    • Re: Problem on start-up
      ... while a repair install should leave your data ... >>Assuming your system is set to boot from the CD-ROM ... >>with the option to setup Windows or Repair ...
      (microsoft.public.windowsxp.accessibility)
    • Re: How to recover product Key from a previous installation ?
      ... :> be a legitimate transferable version and for all I know, ... :> the old key will be overwritten if user proceeds with repair ... :> or install, and then offers an option to exit the repair or install ... The requirements for legal transfer of license are covered in he End User ...
      (microsoft.public.windowsxp.general)
    • Re: Repeated Boot
      ... I didn't recommend the recovery console, I recommended you do a repair ... install, that doesn't require the recovery console, please follow the steps ... >> actual XP CD as opposed to a recovery CD, boot with the XP ...
      (microsoft.public.windowsxp.accessibility)
    • Re: How to recover product Key from a previous installation ?
      ... it could well be a legitimate and transferable ... warn that |:> the old key will be overwritten if user proceeds with repair |:> or install, and then offers an option to exit the repair or install |:> before this happens. ... |: The requirements for legal transfer of license are covered in he End User |: License Agreement that is |: available at any tine as a link on winver. ...
      (microsoft.public.windowsxp.general)
    • Re: computer logs itself off
      ... >>If that fails to resolve the issue, try a Repair Install ... >>Assuming your system is set to boot from the CD-ROM ... >>with the option to setup Windows or Repair ...
      (microsoft.public.windowsxp.accessibility)