/.iiim/auth/passwd on Solaris 8

Hi all,

 I noticed a strange thing on several machines in my network and in a few home directories of users  

 a directory .iiim/auth/ and a passwd file with an encrypted line.

 I saw a posting by John Bartoszewski <johnb@ugrad.cs.ualberta.ca> without answers:

> Date: Mon, 22 Oct 2001 23:34:07 -0600
> From: John Bartoszewski <johnb@ugrad.cs.ualberta.ca>
> To: focus-sun@securityfocus.com
> Subject: Usage of xiiimp.so.2
> Message-ID: <20011022233407.A14675@ugrad.cs.ualberta.ca>
>
>
>
>
>A few days ago I found a /.iiim/auth/passwd on one of my machines.
> Thinking a break in I begin an investigation.
>
>
>
>I found that /usr/openwin/lib/locale/common/xiiimp.so.2 contains
> references to this file. I then begin to see what uses this lib.
>
>
>
>As far as I an tell nothing does.
>
>
>
>Is there a program on a standard Solaris 8 install that uses xiiimp.so.2
> (or ximlocal.so.2 which is a link to xiiimp.so.2)?
>
>
>
>Is there any normal course of operation that would create this file?
 

Thanks,
 John

 Any ideas what it is ?

 Thanks, Shay Weinstein. Received on Tue Apr 8 15:25:43 2003

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek