Re: Can't Run Top

[Bill Brunton <bbrunton cottagesoft com>]

I am sorry to say...

You have been hacked...... Someone has put in a root kit replacing top, w,
ls, netstat, and various other programs. They did not do a very good job
of it though since they do not work!  Replace top and ps with a known good
copy, and look for any process you do not recognize. Also, check in
rc.local and cron for any process you do not recognize. I bet they are
running a packet sniffer. It is probably placing the sniffed packets into
a file which the hacker collects every few days. Look in all the obscure
directories, /dev, usr/lib etc for strange files.

Also do an rpm -Va and see what has changed.. My bet is that you will have
to reinstall and then restore data files from known good backups.

Once you are back up, disable any service you do not need, get the latest
updates, and hope for the best.

Good luck.


Bill
bbrunton intcon net
http://www.brunton.net
http://www.intcon.net
KA0SEP
NNN0HQA/OK

The Internet... The place to be!


On Tue, 8 Dec 1998, Flint Doungchak wrote:

> I'm having trouble with a lot of things, but one of the things that
> recently failed is my ability to run top.
> 
> When I go to run top, it just clears to screen and brings me back to my
> prompt. I can't see what I type and I have to logout to get my prompt to
> work correctly again.
> 
> Any ideas?
> 
> Thanks in advance.
> 
> Flint Doungchak
> 
> 
> -- 
>   PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
> 		http://www.redhat.com http://archive.redhat.com
>          To unsubscribe: mail redhat-list-request redhat com with 
>                        "unsubscribe" as the Subject.
>