On Fri, 2003-11-07 at 13:45, Mike Egglestone wrote:
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov 7 05:31 .bash_history
and I can't edit it or delete it.
Mike Egglestone wrote:
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov 7 05:31 .bash_history
and I can't
Hello
Mike Egglestone ([EMAIL PROTECTED]) wrote:
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
The /root/.bash_history file is set to this:
chsslx1:~# ls -la .bash_history
-rw-r--r--1 root root0 Nov 7
Quoting Andreas Janssen [EMAIL PROTECTED]:
Maybe the file is immutable. Check with
lsattr .bash_history
You can use chattr to change it:
chattr -i .bash_history
Yes, that was it. It had a bunch of those permissions set.
I chattr'd them all to off, and the file returned to normal.
On Fri, Nov 07, 2003 at 10:45:32AM -0800, Mike Egglestone wrote:
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
Out of curiosity--how can you tell?
The /root/.bash_history file is set to this:
chsslx1:~# ls -la
Quoting J. Bruce Fields [EMAIL PROTECTED]:
On Fri, Nov 07, 2003 at 10:45:32AM -0800, Mike Egglestone wrote:
Hi,
My server was trojaned recently, not sure how.
It looks like /bin/ps was modified or replaced with
a trojan.
Out of curiosity--how can you tell?
I could tell because the ps
7 matches
Mail list logo
