Find the answer to your Linux question:
Results 1 to 5 of 5
How do I noe If there is a thing planted in my system?...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux User
    Join Date
    May 2003
    Location
    Hong Kong, China
    Posts
    256

    Damn it! So fast my site is hacked.


    How do I noe If there is a thing planted in my system?
    Signature removed by moderator - please see forum rules

  2. #2
    Linux Guru
    Join Date
    Oct 2001
    Location
    Täby, Sweden
    Posts
    7,578
    Check what processes are running with ps. If you're rooted it might be worse, though. If you suspect that you've been rooted, check and compare the outputs of these commands:
    Code:
    ls -d /proc/[0-9]* | wc
    ps -Am h | wc
    You can also check a list of files modifed the last day with this:
    Code:
    find / -mtime 1 2>/dev/null
    Also, check what files have been put in all world writable directories:
    Code:
    find / -perm -0007 -type d -exec echo {} \; -exec ls -la {} \; 2>/dev/null

  3. #3
    Linux Guru
    Join Date
    Oct 2001
    Location
    Täby, Sweden
    Posts
    7,578
    Oh yeah, I forgot. Almost most importantly, check what processes are running with deleted executables. Remember that there are some kernel processes that don't have executables, like rpciod, kswapd and the like, so don't be too alarmed. This will list you a good list of PIDs doing that:
    Code:
    for proc in /proc/[0-9]*; do if ls -l $proc/exe 2>/dev/null | grep -q deleted; then basename $proc; fi; done

  4. #4
    Linux User
    Join Date
    May 2003
    Location
    Hong Kong, China
    Posts
    256
    Phew, I am very confused here, Dolda, Thanks a lot man! you are the man!!!
    I decided to reinstall my server all over again, since no data is special in my system. luckily.

    dunno why, he or she? just changed my site name to New Linux Era, I am 100% sure I did not change it. and the network went down itself, I had to reset my router and ADSL modem.

    Signature removed by moderator - please see forum rules

  5. #5
    Linux Guru
    Join Date
    Oct 2001
    Location
    Täby, Sweden
    Posts
    7,578
    I'm guessing that could have been a problem with your modem or router. It has happened once or twice that my switch has stopped routing packages, and once my modem hung as well, so that I needed to restart it (by unplugging the power cable and plug it back in).

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •