From owner-freebsd-questions@FreeBSD.ORG Tue Dec 14 18:29:58 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C8AC916A4CE for ; Tue, 14 Dec 2004 18:29:58 +0000 (GMT) Received: from MXR-4.estpak.ee (zen.estpak.ee [194.126.101.100]) by mx1.FreeBSD.org (Postfix) with ESMTP id F181B43D6B for ; Tue, 14 Dec 2004 18:29:56 +0000 (GMT) (envelope-from toomas.aas@raad.tartu.ee) Received: from [217.159.163.21] (217-159-163-21-dsl.trt.estpak.ee [217.159.163.21]) by MXR-4.estpak.ee (Postfix) with ESMTP id 4CEA5D9ED0; Tue, 14 Dec 2004 20:29:53 +0200 (EET) Message-ID: <41BF30FB.1020309@raad.tartu.ee> Date: Tue, 14 Dec 2004 20:29:15 +0200 From: Toomas Aas User-Agent: Mozilla Thunderbird 1.0RC1 (X11/20041207) X-Accept-Language: en-us, en MIME-Version: 1.0 To: infofarmer@mail.ru References: <41BF2C32.3080808@mail.ru> In-Reply-To: <41BF2C32.3080808@mail.ru> Content-Type: text/plain; charset=windows-1251; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at neti.ee cc: freebsd-questions@freebsd.org Subject: Re: ld-elf.so.1: Shared object"libintl.so.6" not found X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Dec 2004 18:29:58 -0000 Andrew P. wrote: >>> I got this at startup: >>> >>> Dec 11 03:32:42 satbsd /kernel: >>> Starting ppp as "root" >>> Dec 11 03:32:42 satbsd /kernel: >>> /usr/libexec/ld-elf.so.1: >>> Dec 11 03:32:42 satbsd /kernel: >>> Shared object "libintl.so.6" not found >> The real question you should be asking is "why does ppp (a system >> binary) depend on libintl (not a system library)?" You've probably >> replaced your ppp(8) with something else, with poor consequences. > > Can you tell me how to figure that out? It's hard to give a definitive guide here. First find out which startup script starts ppp at boot time. I can't look it up for you because I have FreeBSD 5.3 here where the startup scripts are different from 4.10. Has the script been modified. Is it still trying to run /usr/sbin/ppp or is it trying to run something else? Look at the output of 'ls -l /usr/sbin'. Is the timestamp of ppp close to other files in that directory (that would be the time when you built/installed the world)? If it's not, then ppp has been replaced with something else. The timestamp of /usr/sbin/ppp might give you an idea when it happened. Try to remember what you were doing around this time. I don't want to cry wolf, but it might even be some kind of trojan. If you're sure it's not a trojan (some accident during portupgrade or such), the easiest way to recover would probably be to rebuild and reinstall the world. If it's a trojan, the only safe way is to wipe the entire system, reinstall and restore the data.