Hacked?

[Bjoern A. Zeeb]

On Fri, 9 May 2003, Borja Marcos wrote:

> > Notice the f in place of the date?   What does that mean?
>
> 	Perhaps someone has installed a different ls command (and, presumably,
> others). Try doing "truss ls" to see if it is reading any sort of
> strange file. Rootkits use to have configuration files hidden in weird
> places.

this asumes that truss is ok ;-) perhaps take the truss from your
other 4.7 machine ...

-- 
Bjoern A. Zeeb				bzeeb at Zabbadoz dot NeT
56 69 73 69 74				http://www.zabbadoz.net/