There they are again, always with a user's owner.group and filesize 0.
Just because I keep looking over my shoulder to check if anyone's following
me doesn't mean I am paranoided...
----- Original Message -----
From: "Gordon Messmer" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Friday, September 27, 2002 07:17 PM
Subject: RE: Is this a virus : "/tmp/orbit-<blabla>"
> On Fri, 2002-09-27 at 10:26, Ward William E DLDN wrote:
> > Gordon, while you're right that it's PROBABLY
> > ORBit (an Open Source CORBA implementation),
> > it seems to me whenever someone asks that question
> > the answer can NEVER be "No". It's always got
> > to be "YES!", "Possibly" or "Probably not", since
> > most root kits are going to attempt to install
> > some service or device which masquerades as an
> > innocuous, or even required, program.
>
> Good point. It could be a worm or trojan that creates the files, but I
> haven't heard of one that behaves like ORBit yet. :)
>
> > He might be able to check RPM to see what he has
> > installed which required ORBit, and see if he's
> > using those programs. In this case, perhaps
> > he should do an
> >
> > rpm -q ORBit | xargs rpm -q --whatrequires
>
> He'll get better results with:
> rpm -q ORBit --provides | awk '{print $1}' | xargs rpm -q --whatrequires
>
>
>
>
> --
> redhat-list mailing list
> unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe
> https://listman.redhat.com/mailman/listinfo/redhat-list
--
redhat-list mailing list
unsubscribe mailto:[EMAIL PROTECTED]?subject=unsubscribe
https://listman.redhat.com/mailman/listinfo/redhat-list
