On 07/21/2010 06:39 AM, Sergey Spiridonov wrote: > I found yesterday that some files in /etc/ (/etc/shells and > /etc/default/default/schroot) are changed. They contain data which I was > typing on keyboard. Strange enough, this files are not overwritten, but > contain data they should contain + somewhere in the middle or at the > beginning of the file they contain something I typed in browser or in > command line in X window system. > > This looks like that I am hacked and somebody try to get my passwords. > But may be there is another explanation, like broken package? Or can > somebody suggest, how can I check it? Reinstalling everything from > scratch is a lot of work... > > System is squeeze, upgraded from lenny few weeks ago.
Check 'last' and 'lastb' to see if there are any other logins or login attempts other than yourself. -- . O . O . O . . O O . . . O . . . O . O O O . O . O O . . O O O O . O . . O O O O . O O O
signature.asc
Description: OpenPGP digital signature
