[wellylug] users logged in do not much current logged in users...

[Phillip Hutchings]

On 3/02/2006, at 12:28 PM, Chris Hodgetts wrote:

> I cant think of anything that might be causing this....

Some programs can create a login without attaching a shell, can't  
really tell without ps output.

It could be a kernel module rootkit. Is chkrootkit statically linked  
against a clean install? I have a x86 bundle here of chkrootkit  
linked against busybox, it also includes a utility to check the  
kernel dispatch table against the System.map file.

Other than that, have you had any issues with processes segfaulting  
unexpectedly? Unexplainable load averages? Odd network traffic?


--
Phillip Hutchings
phillip.hutchings at sitharus.com
http://www.sitharus.com/


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2234 bytes
Desc: not available
Url : http://lists.wellylug.org.nz/pipermail/wellylug/attachments/20060203/6cfc3bcb/attachment.bin