Volker Zell writes: Chris January writes:>> In both cases what is the actual value of HZ you are seeing? > 01:02 AM [555]> w > Unknown HZ value! (483) Assume 100.
That's unrelated, but interesting, because I got rooted yesterday on some linux box (a new t0rnkit with some libsh), which had some libproc hack (process hiding), which led to the same error message on the procps utils.
"Unknown HZ value! (11) Assume 100"
At least it was very easy to fix without reinstall. ttyload got hijacked (right after mingetty loading). rootkit in /usr/lib/libsh (hidden of course). But he forgot to hijack lsof. So lsof|grep LISTEN showed the intruder.
--
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/
-- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
