James Brown wrote: > Chris wrote: >> On Sun, 5 Sep 2010 15:21:50 +0800 > >> Probably not. Have you done updates recently? After you installed >> rkhunter, did you run it with the --propupd switch? >> >> Odd though, my which resides in /usr/bin opposed to your /bin. >> This could be a difference from your Deb 5 and my Sid though. >> > > I have the similar problem: >> Warning: The file properties have changed: >> File: /bin/bash >> Current inode: 1297223 Stored inode: 2594446 >> Warning: The file properties have changed: >> File: /bin/cat >> Current inode: 1297207 Stored inode: 2594414 >> Warning: The file properties have changed: >> File: /bin/chmod >> Current inode: 1297184 Stored inode: 2594368 >> Warning: The file properties have changed: >> File: /bin/chown >> Current inode: 1297182 Stored inode: 2594364 >> Warning: The file properties have changed: >> File: /bin/cp >> Current inode: 1297206 Stored inode: 2594412 >> Warning: The file properties have changed: >> File: /bin/csh >> Current inode: 1296846 Stored inode: 2593692 >> Warning: The file properties have changed: >> File: /bin/date >> Current inode: 1297187 Stored inode: 2594374 >> Warning: The file properties have changed: >> File: /bin/df >> Current inode: 1297190 Stored inode: 2594380 >> Warning: The file properties have changed: >> File: /bin/dmesg >> Current inode: 1297211 Stored inode: 2594422 >> Warning: The file properties have changed: >> File: /bin/echo >> Current inode: 1297172 Stored inode: 2594344 >> Warning: The file properties have changed: >> File: /bin/ed >> Current inode: 1297197 Stored inode: 2594394 >> Warning: The file properties have changed: >> File: /bin/egrep >> Current inode: 1297221 Stored inode: 2594442 >> Warning: The file properties have changed: >> File: /bin/fgrep >> Current inode: 1297228 Stored inode: 2594456 >> Warning: The file properties have changed: >> File: /bin/fuser >> Current inode: 1297180 Stored inode: 2594360 >> Warning: The file properties have changed: >> File: /bin/grep >> Current inode: 1297216 Stored inode: 2594432 >> Warning: The file properties have changed: >> File: /bin/ip >> Current inode: 1297175 Stored inode: 2594350 >> Warning: The file properties have changed: >> File: /bin/kill >> Current inode: 1297176 Stored inode: 2594352 >> Warning: The file properties have changed: >> File: /bin/login >> Current inode: 1297255 Stored inode: 2594510 >> Warning: The file properties have changed: >> File: /bin/ls >> Current inode: 1297247 Stored inode: 2594494 >> Warning: The file properties have changed: >> File: /bin/lsmod >> Current inode: 1297252 Stored inode: 2594504 >> Warning: The file properties have changed: >> File: /bin/mktemp >> Current inode: 1297241 Stored inode: 2594482 >> Warning: The file properties have changed: >> File: /bin/more >> Current inode: 1297196 Stored inode: 2594392 >> Warning: The file properties have changed: >> File: /bin/mount >> Current inode: 1297188 Stored inode: 2594376 >> Warning: The file properties have changed: >> File: /bin/mv >> Current inode: 1297242 Stored inode: 2594484 >> Warning: The file properties have changed: >> File: /bin/netstat >> Current inode: 1297231 Stored inode: 2594462 >> Warning: The file properties have changed: >> File: /bin/ps >> Current inode: 1297230 Stored inode: 2594460 >> Warning: The file properties have changed: >> File: /bin/pwd >> Current inode: 1297210 Stored inode: 2594420 >> Warning: The file properties have changed: >> File: /bin/readlink >> Current inode: 1297213 Stored inode: 2594426 >> Warning: The file properties have changed: >> File: /bin/sed >> Current inode: 1297218 Stored inode: 2594436 >> Warning: The file properties have changed: >> File: /bin/sh >> Current inode: 1297217 Stored inode: 2594434 >> Warning: The file properties have changed: >> File: /bin/su >> Current inode: 1297208 Stored inode: 2594416 >> Warning: The file properties have changed: >> File: /bin/touch >> Current inode: 1297185 Stored inode: 2594370 >> Warning: The file properties have changed: >> File: /bin/uname >> Current inode: 1297199 Stored inode: 2594398 >> Warning: The file properties have changed: >> File: /bin/which >> Current inode: 1297246 Stored inode: 2594492 >> Warning: The file properties have changed: >> File: /bin/tcsh >> Current inode: 1297235 Stored inode: 2594470 >> Warning: The file properties have changed: >> File: /usr/bin/awk >> Current inode: 1655623 Stored inode: 3311246 >> Warning: The file properties have changed: >> File: /usr/bin/basename >> Current inode: 1658664 Stored inode: 3317328 >> Warning: The file properties have changed: >> File: /usr/bin/chattr >> Current inode: 1658810 Stored inode: 3317620 >> Warning: The file properties have changed: >> File: /usr/bin/cut >> Current inode: 1658385 Stored inode: 3316770 >> Warning: The file properties have changed: >> File: /usr/bin/diff >> Current inode: 1658630 Stored inode: 3317260 >> Warning: The file properties have changed: >> File: /usr/bin/dirname >> Current inode: 1658619 Stored inode: 3317238 >> Warning: The file properties have changed: >> File: /usr/bin/dpkg >> Current inode: 1658463 Stored inode: 3316926 >> Warning: The file properties have changed: >> File: /usr/bin/dpkg-query >> Current inode: 1658714 Stored inode: 3317428 >> Warning: The file properties have changed: >> File: /usr/bin/du >> Current inode: 1658639 Stored inode: 3317278 >> Warning: The file properties have changed: >> File: /usr/bin/env >> Current inode: 1658304 Stored inode: 3316608 >> Warning: The file properties have changed: >> File: /usr/bin/file >> Current inode: 1658322 Stored inode: 3316644 >> Warning: The file properties have changed: >> File: /usr/bin/find >> Current inode: 1658466 Stored inode: 3316932 >> Warning: The file properties have changed: >> File: /usr/bin/GET >> Current inode: 1658826 Stored inode: 3317652 >> Warning: The file properties have changed: >> File: /usr/bin/groups >> Current inode: 1658372 Stored inode: 3316744 >> Warning: The file properties have changed: >> File: /usr/bin/head >> Current inode: 1658418 Stored inode: 3316836 >> Warning: The file properties have changed: >> File: /usr/bin/id >> Current inode: 1658765 Stored inode: 3317530 >> Warning: The file properties have changed: >> File: /usr/bin/killall >> Current inode: 1658395 Stored inode: 3316790 >> Warning: The file properties have changed: >> File: /usr/bin/last >> Current inode: 1658363 Stored inode: 3316726 >> Warning: The file properties have changed: >> File: /usr/bin/lastlog >> Current inode: 1658334 Stored inode: 3316668 >> Warning: The file properties have changed: >> File: /usr/bin/ldd >> Current inode: 1659800 Stored inode: 3319600 >> Warning: The file properties have changed: >> File: /usr/bin/less >> Current inode: 1658757 Stored inode: 3317514 >> Warning: The file properties have changed: >> File: /usr/bin/logger >> Current inode: 1658663 Stored inode: 3317326 >> Warning: The file properties have changed: >> File: /usr/bin/lsattr >> Current inode: 1658572 Stored inode: 3317144 >> Warning: The file properties have changed: >> File: /usr/bin/lsof >> Current inode: 1658865 Stored inode: 3317730 >> Warning: The file properties have changed: >> File: /usr/bin/lynx >> Current inode: 1655656 Stored inode: 3311312 >> Warning: The file properties have changed: >> File: /usr/bin/mail >> Current inode: 1655640 Stored inode: 3311280 >> Warning: The file properties have changed: >> File: /usr/bin/md5sum >> Current inode: 1658453 Stored inode: 3316906 >> Warning: The file properties have changed: >> File: /usr/bin/newgrp >> Current inode: 1658451 Stored inode: 3316902 >> Warning: The file properties have changed: >> File: /usr/bin/passwd >> Current inode: 1658901 Stored inode: 3317802 >> Warning: The file properties have changed: >> File: /usr/bin/perl >> Current inode: 1658715 Stored inode: 3317430 >> Warning: The file properties have changed: >> File: /usr/bin/pstree >> Current inode: 1658565 Stored inode: 3317130 >> Warning: The file properties have changed: >> File: /usr/bin/rkhunter >> Current inode: 1660745 Stored inode: 3321490 >> Warning: The file properties have changed: >> File: /usr/bin/runcon >> Current inode: 1658401 Stored inode: 3316802 >> Warning: The file properties have changed: >> File: /usr/bin/sha1sum >> Current inode: 1658864 Stored inode: 3317728 >> Warning: The file properties have changed: >> File: /usr/bin/size >> Current inode: 1658566 Stored inode: 3317132 >> Warning: The file properties have changed: >> File: /usr/bin/sort >> Current inode: 1658499 Stored inode: 3316998 >> Warning: The file properties have changed: >> File: /usr/bin/stat >> Current inode: 1658449 Stored inode: 3316898 >> Warning: The file properties have changed: >> File: /usr/bin/strings >> Current inode: 1658487 Stored inode: 3316974 >> Warning: The file properties have changed: >> File: /usr/bin/sudo >> Current inode: 1660462 Stored inode: 3320924 >> Warning: The file properties have changed: >> File: /usr/bin/tail >> Current inode: 1658838 Stored inode: 3317676 >> Warning: The file properties have changed: >> File: /usr/bin/test >> Current inode: 1658370 Stored inode: 3316740 >> Warning: The file properties have changed: >> File: /usr/bin/top >> Current inode: 1658778 Stored inode: 3317556 >> Warning: The file properties have changed: >> File: /usr/bin/touch >> Current inode: 1658516 Stored inode: 3317032 >> Warning: The file properties have changed: >> File: /usr/bin/tr >> Current inode: 1658808 Stored inode: 3317616 >> Warning: The file properties have changed: >> File: /usr/bin/uniq >> Current inode: 1658343 Stored inode: 3316686 >> Warning: The file properties have changed: >> File: /usr/bin/users >> Current inode: 1658652 Stored inode: 3317304 >> Warning: The file properties have changed: >> File: /usr/bin/vmstat >> Current inode: 1658795 Stored inode: 3317590 >> Warning: The file properties have changed: >> File: /usr/bin/w >> Current inode: 1655661 Stored inode: 3311322 >> Warning: The file properties have changed: >> File: /usr/bin/watch >> Current inode: 1658346 Stored inode: 3316692 >> Warning: The file properties have changed: >> File: /usr/bin/wc >> Current inode: 1658786 Stored inode: 3317572 >> Warning: The file properties have changed: >> File: /usr/bin/wget >> Current inode: 1658297 Stored inode: 3316594 >> Warning: The file properties have changed: >> File: /usr/bin/whatis >> Current inode: 1658677 Stored inode: 3317354 >> Warning: The file properties have changed: >> File: /usr/bin/whereis >> Current inode: 1658357 Stored inode: 3316714 >> Warning: The file properties have changed: >> File: /usr/bin/which >> Current inode: 1658610 Stored inode: 3317220 >> Warning: The file properties have changed: >> File: /usr/bin/who >> Current inode: 1658678 Stored inode: 3317356 >> Warning: The file properties have changed: >> File: /usr/bin/whoami >> Current inode: 1658571 Stored inode: 3317142 >> Warning: The file properties have changed: >> File: /usr/bin/tcsh >> Current inode: 1658885 Stored inode: 3317770 >> Warning: The file properties have changed: >> File: /usr/bin/gawk >> Current inode: 1658829 Stored inode: 3317658 >> Warning: The file properties have changed: >> File: /usr/bin/lwp-request >> Current inode: 1658437 Stored inode: 3316874 >> Warning: The file properties have changed: >> File: /usr/bin/lynx.cur >> Current inode: 1658482 Stored inode: 3316964 >> Warning: The file properties have changed: >> File: /usr/bin/bsd-mailx >> Current inode: 1658342 Stored inode: 3316684 >> Warning: The file properties have changed: >> File: /usr/bin/w.procps >> Current inode: 1658408 Stored inode: 3316816 >> Warning: The file properties have changed: >> File: /sbin/depmod >> Current inode: 1297274 Stored inode: 2594548 >> Warning: The file properties have changed: >> File: /sbin/ifconfig >> Current inode: 1297344 Stored inode: 2594688 >> Warning: The file properties have changed: >> File: /sbin/ifdown >> Current inode: 1297326 Stored inode: 2594652 >> Warning: The file properties have changed: >> File: /sbin/ifup >> Current inode: 1297369 Stored inode: 2594738 >> Warning: The file properties have changed: >> File: /sbin/init >> Current inode: 1297364 Stored inode: 2594728 >> Warning: The file properties have changed: >> File: /sbin/insmod >> Current inode: 1297294 Stored inode: 2594588 >> Warning: The file properties have changed: >> File: /sbin/ip >> Current inode: 1297271 Stored inode: 2594542 >> Warning: The file properties have changed: >> File: /sbin/lsmod >> Current inode: 1297368 Stored inode: 2594736 >> Warning: The file properties have changed: >> File: /sbin/modinfo >> Current inode: 1297371 Stored inode: 2594742 >> Warning: The file properties have changed: >> File: /sbin/modprobe >> Current inode: 1297378 Stored inode: 2594756 >> Warning: The file properties have changed: >> File: /sbin/rmmod >> Current inode: 1297298 Stored inode: 2594596 >> Warning: The file properties have changed: >> File: /sbin/runlevel >> Current inode: 1297308 Stored inode: 2594616 >> Warning: The file properties have changed: >> File: /sbin/sulogin >> Current inode: 1297285 Stored inode: 2594570 >> Warning: The file properties have changed: >> File: /sbin/sysctl >> Current inode: 1297317 Stored inode: 2594634 >> Warning: The file properties have changed: >> File: /sbin/syslogd >> Current inode: 1297323 Stored inode: 2594646 >> Warning: The file properties have changed: >> File: /usr/sbin/adduser >> Current inode: 1430232 Stored inode: 2860464 >> Warning: The file properties have changed: >> File: /usr/sbin/chroot >> Current inode: 1430225 Stored inode: 2860450 >> Warning: The file properties have changed: >> File: /usr/sbin/cron >> Current inode: 1430291 Stored inode: 2860582 >> Warning: The file properties have changed: >> File: /usr/sbin/groupadd >> Current inode: 1430321 Stored inode: 2860642 >> Warning: The file properties have changed: >> File: /usr/sbin/groupdel >> Current inode: 1430318 Stored inode: 2860636 >> Warning: The file properties have changed: >> File: /usr/sbin/groupmod >> Current inode: 1430341 Stored inode: 2860682 >> Warning: The file properties have changed: >> File: /usr/sbin/grpck >> Current inode: 1430229 Stored inode: 2860458 >> Warning: The file properties have changed: >> File: /usr/sbin/nologin >> Current inode: 1430359 Stored inode: 2860718 >> Warning: The file properties have changed: >> File: /usr/sbin/pwck >> Current inode: 1430361 Stored inode: 2860722 >> Warning: The file properties have changed: >> File: /usr/sbin/tcpd >> Current inode: 1430276 Stored inode: 2860552 >> Warning: The file '/usr/sbin/unhide' exists on the system, but it is not >> present in the rkhunter.dat file. >> Warning: The file properties have changed: >> File: /usr/sbin/useradd >> Current inode: 1430266 Stored inode: 2860532 >> Warning: The file properties have changed: >> File: /usr/sbin/userdel >> Current inode: 1430285 Stored inode: 2860570 >> Warning: The file properties have changed: >> File: /usr/sbin/usermod >> Current inode: 1430258 Stored inode: 2860516 >> Warning: The file properties have changed: >> File: /usr/sbin/vipw >> Current inode: 1430364 Stored inode: 2860728 >> Warning: The file properties have changed: >> File: /usr/sbin/xinetd >> Current inode: 1430337 Stored inode: 2860674 >> Warning: The file '/usr/sbin/unhide-linux26' exists on the system, but it is >> not present in the rkhunter.dat file. >> Warning: Found enabled xinetd service: /etc/xinetd.d/ftp_psa >> Warning: Found enabled xinetd service: /etc/xinetd.d/poppassd_psa >> Warning: Found enabled xinetd service: /etc/xinetd.d/smtp_psa >> Warning: Found enabled xinetd service: /etc/xinetd.d/smtps_psa >> Warning: Found enabled xinetd service: /etc/xinetd.d/submission_psa >> Warning: No output found from the lsmod command or the /proc/modules file: >> /proc/modules output: >> lsmod output: > > > I have no updating before it excepting updating the wireshark. > It seems to me that it need update packeges which includes the above > files for changing inodes, not the wireshark. > >
And what do you think about the next? There are many hidden prosseses in my vds-system that I can see throwgh unhide-tcp. Or those are procceses on physical machine? -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c885863.3000...@gmail.com