Re: hpd, afb, sc, and sn

From: Brad Arlt <arlt(at)cpsc.ucalgary.ca>
Date: Fri Dec 20 2002 - 17:28:48 EST

On Fri, Dec 20, 2002 at 02:11:31PM -0700, Gordon Chamberlin wrote:
> I found suspicious looking files on a Redhat 7.1 Linux server earlier

Oh ya. Maybe more than once.

> According to an rpm -V, all kinds of binaries have been changed: ps,

http://www.chkrootkit.org/

Chkrootkit might be able to diagnose your problems. I'd hit http://www.google.com, and http://isc.incidents.org/ and see what pops up.

---

   __o		Bradley Arlt			Security Team Lead
 _ \<_		arlt@cpsc.ucalgary.ca		University Of Calgary
(_)/(_) 	I should be biking right now.	Computer Science


----------------------------------------------------------------------------

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Dec 23 11:54:13 2002