I haven't had the timer for a full report, but, althought I'm not CLEAR that his box has been rooted, things like minor changes to su, and other wierd things failing are signs of a rootkit (yes, a clumsy one) being installed. Having su suddenly start to give different messages is a sign that SOMEBODY has changed SOMETHING.
It's not actually certain it has.
At the very least, I think he should run something like chkrootkit to see if any well-known root kit is being used.
I've taken your advice here and the only possible anomaly it comes up with is "Warning: '//root/.sc_history' file size is zero".
All the rest is "nothing found", "not infected", "nothing detected", "not found", and "nothing deleted". Search for uspicious files and directories turns up 2 .packlist files, which I gather is fairly normal. One is identical to the one on the installation CD and the other corresponds with the Foo-matic packet I installed.
Now can I relax and have a beer?
Thanks,
Andrew
-
To unsubscribe from this list: send the line "unsubscribe linux-newbie" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.linux-learn.org/faqs
