Possibly HD or controller failure even if S.M.A.R.T. doesn't report anything. It may have been that the 11 files were all written to the same bad sector(s).
Did you Copy, Hash, Compare, Delete, repeat 500 times? Try just Copy (to a random filename), Hash, Compare, Repeat (with a new random filename). When I transfer large files between flash drives or USB HDDs I usually do MD5 hashes to validate the copies. Every now and then I do encounter different hashes, most of the times recopying the file fixes things. --- mike t. ----- Original Message ---- > From: John Peter Loh <[email protected]> > To: Philippine Linux Users' Group (PLUG) Technical Discussion List > <[email protected]> > Sent: Monday, July 13, 2009 17:11:56 > Subject: [plug] Root Kit, Hardware failure or something else? > > Hi all, > > I remember reading on the list where a server got attacked with a root > kit. It made me really paranoid and I think one of our servers got > attacked with a root kit too! > > I checked with S.M.A.R.T. and the HDs are reported to be working fine. > I checked the serial number of the disks with Seagate and it seems > that the disks were only manufactured last year. > > The problem is files sometime fail to get written properly. I tried > copying a file 500 times and getting the md5 hash of the copied file. > Out of 500 writes, 11 returned different hashes. Is there a known root > kit attack that randomly modifies files? > > What else could cause this? Are there other tests that I can do? I'm > hoping to rule out a breach in the system. > > Thanks, > JP > _________________________________________________ > Philippine Linux Users' Group (PLUG) Mailing List > http://lists.linux.org.ph/mailman/listinfo/plug > Searchable Archives: http://archives.free.net.ph _________________________________________________ Philippine Linux Users' Group (PLUG) Mailing List http://lists.linux.org.ph/mailman/listinfo/plug Searchable Archives: http://archives.free.net.ph
