On Fri, 2003-11-07 at 13:45, Mike Egglestone wrote:
> Hi,
> My server was trojaned recently, not sure how.
> It looks like /bin/ps was modified or replaced with
> a trojan.
> The /root/.bash_history file is set to this:
>
> chsslx1:~# ls -la .bash_history
> -rw-r--r--1 root root
Quoting "J. Bruce Fields" <[EMAIL PROTECTED]>:
> On Fri, Nov 07, 2003 at 10:45:32AM -0800, Mike Egglestone wrote:
> > Hi,
> > My server was trojaned recently, not sure how.
> > It looks like /bin/ps was modified or replaced with
> > a trojan.
>
> Out of curiosity--how can you tell?
I could tell
On Fri, Nov 07, 2003 at 10:45:32AM -0800, Mike Egglestone wrote:
> Hi,
> My server was trojaned recently, not sure how.
> It looks like /bin/ps was modified or replaced with
> a trojan.
Out of curiosity--how can you tell?
> The /root/.bash_history file is set to this:
>
> chsslx1:~# ls -la .bas
Quoting Andreas Janssen <[EMAIL PROTECTED]>:
>> Maybe the file is immutable. Check with
>
> lsattr .bash_history
>
> You can use chattr to change it:
>
> chattr -i .bash_history
Yes, that was it. It had a bunch of those permissions set.
I chattr'd them all to off, and the file returned to norma
Hello
Mike Egglestone (<[EMAIL PROTECTED]>) wrote:
> My server was trojaned recently, not sure how.
> It looks like /bin/ps was modified or replaced with
> a trojan.
> The /root/.bash_history file is set to this:
>
> chsslx1:~# ls -la .bash_history
> -rw-r--r--1 root root0 No
Mike Egglestone wrote:
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov 7 05:31 .bash_history
and I can't ed
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov 7 05:31 .bash_history
and I can't edit it or delete it.
It
7 matches
Mail list logo
