It sounds to me like you've been rooted, and somebody installed a trojan. I'd do a full hunt for signs of a rootkit. When in doubt (especially if there are ony a few people on your system), I'd just load a new OS and migrate the user data over to it.
I don't want to sound like Pollyanna, but interpreting your initial trouble report as evidence of a breakin seems to me like an enormous leap.I thought reinstalling shadow had put everything right, but there are still hiccups. For example, although I can now su again --that is, it now recognises the password-- if I give the wrong password I still get just 'sorry'.
I presume you mean "Sorry."
I do indeed.
Do you recall if you used to get a response more like the one Richard and I posted here?
I can't remember. In a similar situation Slackware 7.1 does give a longer response.
Lilo failed to load again and I have had to reinstall it.
Without details of your setup, this one is impossible to diagnose. But why would a rootkit mess with the bootloader?
I'll leave that one till I've had a chance to try it again.
This one bugs me a bit. That's the complete message. It turns up twice (repeated) in the .xsession-errors file in my home directory. X is started by xdm from rc.4. It starts with a login screen and I log in as normal user. I use the Window Maker window manager.
And I get a very strange message in my user .xsession-errors file. It says:
'stderr is not a tty - where are you?'
Context, please. Is that the full line? How do you normally run X? What userid?
No
GRC reports most ports as stealthed and 113 IDENT and 5000 UPnP as closed.
Does it report ANY ports as open?
What does "netstat -ln" report?
Nothing that looks suspicious to me, but I'll study the manual first of all.
One more thing: as normal user I also found I couldn't mount floppies or cds (in spite of the 'user' option in fstab) Reinstalling the util-linux packet has put that right. I think I put one very large foot in the works, nothing more sinister. No-one else has physical access to the system
Thanks for your help,
Andrew -
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs
