From owner-freebsd-security@FreeBSD.ORG Mon Dec 8 03:01:51 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6BA3F16A4CE for ; Mon, 8 Dec 2003 03:01:51 -0800 (PST) Received: from munk.nu (mail.munk.nu [213.152.51.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9CA0943FA3 for ; Mon, 8 Dec 2003 03:01:46 -0800 (PST) (envelope-from munk@munk.nu) Received: from munk by munk.nu with local (Exim 4.24; FreeBSD) id 1ATJ96-000O5S-Fi for freebsd-security@freebsd.org; Mon, 08 Dec 2003 11:01:44 +0000 Date: Mon, 8 Dec 2003 11:01:44 +0000 From: Jez Hancock To: freebsd-security@freebsd.org Message-ID: <20031208110144.GA92321@users.munk.nu> Mail-Followup-To: freebsd-security@freebsd.org References: <000b01c3bce5$a411f9c0$65ffa8c0@EOS> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <000b01c3bce5$a411f9c0$65ffa8c0@EOS> User-Agent: Mutt/1.4.1i Sender: User Munk Subject: Re: possible compromise or just misreading logs X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Dec 2003 11:01:51 -0000 On Sun, Dec 07, 2003 at 09:14:56AM -0800, Craig Riter wrote: > It was the only file listed and I didn't remember changing anything on my pc > having to do with the screensaver and can't even remember for sure if I was > on my computer at that time. Try: ls -l /var/db/pkg and see if any ports were modified at that time. You can also use 'last' to check if you were logged in around that time. -- Jez Hancock - System Administrator / PHP Developer http://munk.nu/