Re: [gentoo-user] Hacked by association?

[Jerry McBride <mcbrides9@comcast.net>]

On Wednesday 19 September 2007 07:16:09 pm Grant wrote:
> > > I recognize everything in 'ps -ef' I think, but I've never really used
> > > netstat before.  Under "Active Internet connections" I don't
> > > recognize:
> > >
> > > tcp localhost:10030
> > > tcp *:snpp
> >
> > Also, snpp is for pagers:
> > http://en.wikipedia.org/wiki/Simple_Network_Paging_Protocol
>
> With netstat -lp it looks like *:snpp is associated with apache2 and
> is using the same pid as *:http and *:https.  I've never set up
> anything having to do with a pager.  I've never had a pager.  What can
> I do to investigate that further?
>
> > Then run lsof (check man lsof) to see if there is anything suspicious
> > there, like another user logged in either as root or with a different
> > name.
>
> Any handy lsof commands?
>

Not sure about lsof... but something I did was to boot from a rescue disk, 
mounting the suspected partition and piped the outout from tree to a text 
file... A glance through the text file showed a lot of stuff from alien 
sources, explainging where some storage space had disappeared. The fix in 
that situation was a simple reformat and better inchains rules. Yeah, 
ipchains... this was a few years back.

Good luck Grant.



-- 


From the Desk of: Jerome D. McBride
--
gentoo-user@gentoo.org mailing list