From owner-freebsd-security Wed Sep 26 10:52:18 2001 Delivered-To: freebsd-security@freebsd.org Received: from relay1.pair.com (relay1.pair.com [209.68.1.20]) by hub.freebsd.org (Postfix) with SMTP id E37BF37B417 for ; Wed, 26 Sep 2001 10:52:01 -0700 (PDT) Received: (qmail 28939 invoked from network); 26 Sep 2001 17:52:00 -0000 Received: from pec-85-232.tnt6.m2.uunet.de (HELO nina) (149.225.85.232) by relay1.pair.com with SMTP; 26 Sep 2001 17:52:00 -0000 X-pair-Authenticated: 149.225.85.232 Message-ID: <010f01c146b2$bb9965c0$0801a8c0@system> From: "Tom Beer" To: Subject: hacked? Date: Wed, 26 Sep 2001 19:25:31 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi, I just have taken a look at my /stand directory and have absolutely no explanation what the -sh and the [ file could be, and why are nearly all files have exact the same size, date and time. Any suggestions will be very welcome, thanks Tom ls /stand total 55307 -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 -sh* drwxr-xr-x 4 root wheel 1024 Aug 6 19:52 ./ drwxr-xr-x 20 root wheel 512 Sep 19 19:39 ../ -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 [* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 arp* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 boot_crunch* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 cpio* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 dhclient* -r-xr-xr-x 1 root wheel 6690 Apr 22 02:25 dhclient-script* drwx------ 3 root wheel 512 Aug 6 19:52 etc/ -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 find* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 fsck* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 gunzip* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 gzip* drwxr-xr-x 2 root wheel 1024 Aug 6 19:52 help/ -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 hostname* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 ifconfig* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 minigzip* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 mount_mfs* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 mount_nfs* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 newfs* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pccardc* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pccardd* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 ppp* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pwd* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 rm* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 route* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 rtsol* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sed* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sh* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 slattach* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sysinstall* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 test* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 tunefs* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 usbd* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 usbdevs* -r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 zcat* To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message