The Following User Says Thank You to michaaa62 For This Useful Post: | ||
![]() |
2012-11-13
, 08:50
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#12
|
Did you try to check the basic setup of the linux system, like users set up in /etc/shadow (is there shadow~ as a backup?) , groups and their permissions, cronjobs for specific users and system users?
![]() |
2012-11-13
, 09:46
|
|
Posts: 738 |
Thanked: 983 times |
Joined on Apr 2010
@ London
|
#13
|
The Following 4 Users Say Thank You to erendorn For This Useful Post: | ||
![]() |
2012-11-13
, 17:02
|
Posts: 24 |
Thanked: 26 times |
Joined on Feb 2011
|
#14
|
The Following 6 Users Say Thank You to zitstif For This Useful Post: | ||
![]() |
2012-11-13
, 18:44
|
Posts: 2,292 |
Thanked: 4,135 times |
Joined on Apr 2010
@ UK
|
#15
|
It's beginning to look like it might have been smscon. When I looked at smscon's logs, it stated something like, "WARNING: running in stolen mode". It would then send SMS messages to +0123456789 periodically. Also ever since removing smscon I haven't had any outgoing sms messages to egypt or romania (YET).
However, I will keep you updated because it might not be smscon.
![]() |
2012-11-13
, 20:26
|
|
Posts: 4,118 |
Thanked: 8,901 times |
Joined on Aug 2010
@ Ruhrgebiet, Germany
|
#16
|
The Following 4 Users Say Thank You to peterleinchen For This Useful Post: | ||
![]() |
2012-11-13
, 21:44
|
Posts: 560 |
Thanked: 422 times |
Joined on Mar 2011
|
#17
|
The Following User Says Thank You to demolition For This Useful Post: | ||
![]() |
2012-11-14
, 03:27
|
Posts: 24 |
Thanked: 26 times |
Joined on Feb 2011
|
#18
|
The Following 3 Users Say Thank You to zitstif For This Useful Post: | ||
![]() |
2012-11-19
, 06:43
|
Posts: 79 |
Thanked: 53 times |
Joined on Jul 2010
@ Ho Chi Minh, Viet Nam
|
#20
|
The Following User Says Thank You to cantruchd For This Useful Post: | ||
Did you try to get chkrootkit from debian repo installed?