boot with a rescue disk and check out your system. In particular look at the dates on your library files and on key binaries like top, ls, ps, netstat, etc... If you have another system running the same distro you can check your binaries against those.
Using an unhacked netstat is a good way to find out if you've started to send/receive on ports that you shouldn't. This job is much easier if you have a back-up to compare with. Personally I use an unmounted partition with a copy of my etc and my /bin, /sbin, /usr/bin, /usr/sbin, and /lib directories. I can mount the partition read-only and run a automated checkup on my system using scripts and binaries located on the partition. Good Luck - Jon Carnes On Sun, 2003-02-23 at 21:48, Andrew Perrin wrote: > I came upstairs after a weekend mostly away from my computer to find it in > a nearly-hung state. Load (by top) was >10, and there were numerous > /USR/SBIN/CRON entries which, from the logs, look like they were trying to > run exim sessions: > > Feb 23 07:38:01 joehill /USR/SBIN/CRON[13821]: (mail) CMD ( if [ -x > /usr/sbin/exim -a -f /etc/exim/exim.conf ]; then /usr/sbin/exim -q ; fi) > Feb 23 07:53:01 joehill /USR/SBIN/CRON[13829]: (mail) CMD ( if [ -x > /usr/sbin/exim -a -f /etc/exim/exim.conf ]; then /usr/sbin/exim -q ; fi) > > > (etc., etc.) > > The other thing in the ps listing were several (three I think) instances > of: > > modprobe -s -k -- net-pf-10 > > I do not have such a module, either loaded or available on the disk. > > What's particularly worrisome is that this machine is behind another > machine running NAT, so it has only a private (192.168.0.x) address. The > NAT machine has nothing particularly suspicious about it. last commands on > both machine show only me logging in. > > I would be a happier person if someone could provide a non-suspicious > explanation for this. > > > Thanks. > > ---------------------------------------------------------------------- > Andrew J Perrin - http://www.unc.edu/~aperrin > Assistant Professor of Sociology, U of North Carolina, Chapel Hill > [EMAIL PROTECTED] * andrew_perrin (at) unc.edu > > > _______________________________________________ > TriLUG mailing list > http://www.trilug.org/mailman/listinfo/trilug > TriLUG Organizational FAQ: > http://www.trilug.org/~lovelace/faq/TriLUG-faq.html _______________________________________________ TriLUG mailing list http://www.trilug.org/mailman/listinfo/trilug TriLUG Organizational FAQ: http://www.trilug.org/~lovelace/faq/TriLUG-faq.html
