On Thursday 07 November 2002 12:39 am, Leon Brooks wrote: > On Thursday 07 November 2002 11:57 am, Salane wrote: > > is this a problem with chkrootkit or with nfs > > Do an lsattr in (/usr)/(s)bin and check for funny attributes, just in case. > One of the features of many rootkits is subverting tools like netstat. In > fact, I discovered one the other day because netstat -tanp failed (the > cracked version was too old to support -p). > > Cheers; Leon cd / [root@sking /]# lsattr lsattr: Inappropriate ioctl for device While reading flags on ./1 lsattr: Inappropriate ioctl for device While reading flags on ./bin lsattr: Inappropriate ioctl for device While reading flags on ./boot lsattr: Inappropriate ioctl for device While reading flags on ./dev lsattr: Inappropriate ioctl for device While reading flags on ./dhcpcd lsattr: Inappropriate ioctl for device While reading flags on ./etc ---------------- ./home lsattr: Inappropriate ioctl for device While reading flags on ./initrd lsattr: Inappropriate ioctl for device While reading flags on ./lib lsattr: Inappropriate ioctl for device While reading flags on ./mnt lsattr: Inappropriate ioctl for device While reading flags on ./opt lsattr: Inappropriate ioctl for device While reading flags on ./proc lsattr: Inappropriate ioctl for device While reading flags on ./root lsattr: Inappropriate ioctl for device While reading flags on ./sbin lsattr: Inappropriate ioctl for device While reading flags on ./tmp lsattr: Inappropriate ioctl for device While reading flags on ./usr lsattr: Inappropriate ioctl for device While reading flags on ./var
