<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
Thanks for the advice. got chkrootkit, getting rkhunter next.<br><br>ran chkrootkit.<font size="2"> no problems found. to uninstall it I use rm?<br><br>folder downloaded to is:<br><br>/home/imajica/Downloads/chkrootkit-0.48#<br><br></font>a little advice on rm here would go a long way!<br><br><br><blockquote><hr>Date: Wed, 21 May 2008 16:12:46 +0100<br>From: e-mail@mcrilly.co.uk<br>To: chester@mailman.lug.org.uk<br>Subject: Re: [Chester LUG] worried - hacked?<br><br>Debian/Ubuntu is a deb based system, not an RPM based system as I'm sure you know. Try synaptic, aptitude and or apt-get (the man pages, that is)<br><br>
<div><span class="EC_gmail_quote">On 5/21/08, <b class="EC_gmail_sendername">David Holden</b> <<a href="mailto:dh@iucr.org">dh@iucr.org</a>> wrote:</span>
<blockquote class="EC_gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">On Wednesday 21 May 2008, Bryn Salisbury wrote:<br>> Michael,<br>><br>> 2008/5/21 Michael Crilly <<a href="mailto:e-mail@mcrilly.co.uk">e-mail@mcrilly.co.uk</a>>:<br>
> > My bad, I was looking at the log wrong. I thought a process was being<br>> > executed by this 'Mark' but it was, in actual fact, crontab running the<br>> > process.<br>><br>> Ah, you had me worried there for a second. :)<br>
><br>> > Still, nothing wrong with running a chkrootkit and rkhunter every now and<br>> > then. Don't forget to remove them after installing them so the binary's<br>> > themselves don't become infected.<br>
><br>> I agree, no harm in running them every once in a while. Better safe than<br>> sorry.<br>><br>> B<br>><br>> _______________________________________________<br>> Chester mailing list<br>> <a href="mailto:Chester@mailman.lug.org.uk">Chester@mailman.lug.org.uk</a><br>
> <a href="https://mailman.lug.org.uk/mailman/listinfo/chester" target="_blank">https://mailman.lug.org.uk/mailman/listinfo/chester</a><br><br>anyone know if debian/ubuntu has a similar command to "rpm -Va", i.e. verify<br>all packages.<br>
<br>Dave.<br><br><br>--<br>Dr. David Holden.<br><br>See: <<a href="http://www.gnu.org/philosophy/no-word-attachments.html" target="_blank">http://www.gnu.org/philosophy/no-word-attachments.html</a>><br>regarding Word or PowerPoint. GPG key available on request.<br>
-------------------------------------------------------------<br><br>_______________________________________________<br>Chester mailing list<br><a href="mailto:Chester@mailman.lug.org.uk">Chester@mailman.lug.org.uk</a><br>
<a href="https://mailman.lug.org.uk/mailman/listinfo/chester" target="_blank">https://mailman.lug.org.uk/mailman/listinfo/chester</a><br></blockquote></div><br><br clear="all"><br>-- <br>M. T. Crilly<br><a href="http://www.mcrilly.co.uk/" target="_blank">http://www.mcrilly.co.uk/</a>
</blockquote><br /><hr /> <a href='http://clk.atdmt.com/UKM/go/msnnkmgl0010000010ukm/direct/01/' target='_new'>Get Started! </a></body>
</html>