Re: suspicious files in /tmp

[Marcel Weber]

Rudolf Lohner wrote:


[snip]
file hello.dyn 
hello.dyn: ELF 32-bit LSB executable, Intel 80386, version 1, dynamically linked (uses shared libs), not stripped

file hello.stat 
hello.stat: ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, not stripped
[snip]
Greetings,  Rudolf

Great, thanks! So here it comes:

www:~/chkrootkit/bin # file netstat
netstat: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), not stripped

www:~/chkrootkit/usr/bin # file env
env: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
statically linked, not stripped

So everythings clear now: One was statically linked, the other 
dynamically and I guess, that the meaning of stripped is, if there is 
debugging information in the file or not(?), which would make the file 
even bigger...

Greettings

Marcel



--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]