From owner-freebsd-security  Wed Sep 26 10:53:47 2001
Delivered-To: freebsd-security@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id B17D537B414
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 10:53:44 -0700 (PDT)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f8QGnkI47927;
	Wed, 26 Sep 2001 09:49:46 -0700 (PDT)
Date: Wed, 26 Sep 2001 09:49:45 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: Tom Beer <tom@analogon.com>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: hacked?
In-Reply-To: <010a01c146b2$b5372e60$0801a8c0@system>
Message-ID: <20010926094852.Q85958-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, 26 Sep 2001, Tom Beer wrote:

> Hi,
>
> I just have taken a look at my /stand directory
> and have absolutely no explanation what the -sh and the [
> file could be, and why are nearly all files have exact the same
> size, date and time.
>
> Any suggestions will be very welcome,
> thanks Tom

This is normal stuff. /stand is basically the programs used for
installation. If you run ls -il in there you'll see that the inodes are
the same for most of those files. They were created using something called
"crunch" (I forget the actual command).

- dpk


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message