| 1 |
On Sat, 2006-03-25 at 18:03 +0000, Mick wrote: |
| 2 |
> Hi All, |
| 3 |
> |
| 4 |
> I don't know what to make of the attached. I found it in my distfiles. I |
| 5 |
> can't think how I could have saved anything like that in there myself. As |
| 6 |
> far as I know portage would not save anything like that there (no package |
| 7 |
> that I know of). What else could it be? |
| 8 |
> |
| 9 |
> Has this box been compromised? |
| 10 |
> -- |
| 11 |
> Regards, |
| 12 |
> Mick |
| 13 |
Hi, |
| 14 |
Check the time of creation and if there're more files with nearly equal |
| 15 |
time/date. Check against time/date of merged packages (genlop --help). |
| 16 |
Scan with 'rkhunter & chkrootkit' preferably from a LiveCD. |
| 17 |
PS: there's a very little probability for an existence of some typo in |
| 18 |
some ebuild which could fetch this file from another URL. Or the worst |
| 19 |
scenario - some Gentoo mirror might have being compromised. |
| 20 |
No more ideas for the time being. Backup your data first. |
| 21 |
HTH.Rumen |
Archives