On Thu, 24 Nov 2011 14:06:24 +0100, Andrea Ganduglia wrote: > On Wed, Nov 23, 2011 at 6:48 PM, Brian <a...@cityscape.co.uk> wrote: >> On Wed 23 Nov 2011 at 17:36:40 +0000, Camaleón wrote: >> >>> On Wed, 23 Nov 2011 12:00:27 +0100, Andrea Ganduglia wrote: >>> >>> > I see this message when I call `top' >>> > >>> > Unknown HZ value! (92) Assume 100. >>> > >>> > What happen? >>> >>> Wow... found this on Google: >> >> Someone was bound to. :)
Ancient Greeks went to Oracle at Delphi to get answers. Now we have Google ;-) >>> *** >>> So you got rooted by SHV4 / SHV5 rootkit... >>> http://www.huweb.hu/maques/mblog/?p=153 *** >>> >>> But I hope there is another explanation for that message. >> >> An md5sum on the files on the system and those in the procps package >> would surely not be out of place? > :-(((((((((((((((((((((((((((( > > Original post talks abount RHEL and CentOS. > http://www.bigismore.com/web-server-security/unknown-hz-value-assume-100-youve-been-hacked/ > > ??? I'm afraid the rootkit is not distribution specific. I would run a deep scan with the mentioned tool (rkhunter) to be sure. Greetings, -- Camaleón -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/pan.2011.11.24.18.52...@gmail.com
