Pai e simplu . Ai fost "hackuit". Ai instalat un rootkit on-fly numit suckit scris de sd. /sbin/init este schimbat, numai este al tau. Solutie : sterge /sbin/init si inlocuieshte`l cu unul nou si da un reboot. Bafta.
----- Original Message ----- From: "Paul POP" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 09, 2002 2:41 PM Subject: [rlug] procese defunct > Salut, > > Am un slackware 8.0 pe care mai nou imi apar procese defunct cu gramada, > problema esteca se pare ca procesele raman active nu mor. > Ex: > > 1241 ? Z 0:00 [sh <defunct>] > 1324 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1330 ? Z 0:00 [sh <defunct>] > 1399 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1402 ? Z 0:00 [sh <defunct>] > 1447 ? S 0:00 sendmail: accepting connections > 1467 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1469 ? Z 0:00 [sh <defunct>] > 1571 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1574 ? Z 0:00 [sh <defunct>] > 1650 tty1 T 0:00 ls > 1651 tty1 Z 0:00 [ls <defunct>] > 1655 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1658 ? Z 0:00 [sh <defunct>] > 1758 ? T 0:00 touch /tmp/.crond_running > 1760 ? Z 0:00 [touch <defunct>] > 1798 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 1801 ? Z 0:00 [sh <defunct>] > 1991 ? S 0:00 /usr/local/mysql/bin/mysqld > --defaults-extra-file=/usr/local/mysql/data/my.cnf --basedir=/usr/loc 1999 > ? T 0:00 touch/tmp/.crond_running > 2001 ? Z 0:00 [touch <defunct>] > 2004 ? T 0:00 touch /tmp/.crond_running > 2006 ? Z 0:00 [touch <defunct>] > 2008 ? S 0:00 /usr/sbin/sshd > 2011 pts/0 S 0:00 -bash > 2012 pts/0 T 0:00 -bash > 2013 pts/0 Z 0:00 [bash <defunct>] > 2030 pts/0 S 0:00 bash > 2149 ? S 0:00 sendmail: server mailman50.vmadmin.com > [64.27.167.150] cmd read 2247 ? T 0:00 /bin/sh -c /root/vmail/add_cont.pl 1>> /tmp/perr > 2249 ? Z 0:00 [sh <defunct>] > 2315 ? S 0:00 /usr/local/mysql/bin/mysqld > --defaults-extra-file=/usr/local/mysql/data/my.cnf --basedir=/usr/loc > 2320 ? S 0:00 /usr/sbin/httpd > 2327 ? S 0:00 /usr/local/mysql/bin/mysqld > --defaults-extra-file=/usr/local/mysql/data/my.cnf --basedir=/usr/loc > 2328 pts/0 R 0:00 ps -ax > > Imi dati ceva idei despre ceea ce se intampla? > > Paul > > > > --- > Pentru dezabonare, trimiteti mail la > [EMAIL PROTECTED] cu subiectul 'unsubscribe rlug'. > REGULI, arhive si alte informatii: http://www.lug.ro/mlist/ > > > --- Pentru dezabonare, trimiteti mail la [EMAIL PROTECTED] cu subiectul 'unsubscribe rlug'. REGULI, arhive si alte informatii: http://www.lug.ro/mlist/
