On Tue, 2004-08-03 at 09:08, Saurabh Barve wrote: > Hi, > > I am having a funny problem that I haven't experienced ever before. > Whenever I try to list the contents of /usr/bin on a remote ssh > connection, it scrolls all the files very quickly, and then it closes > the terminal window. Not only that, all the other terminal windows on > all my other desktops close too, even if I am not logged into any remote > machine on them. > > I am running RH 9.0 on my local machine, and different flavors of RH on > the remote machines (RH 7.3, RHEL). When I do this locally on the other > machine, the listing doesn't give me this problem. > > I guess this might also happen on any directory with a large number of > files like /usr/bin, but I don't have such a directory on my remote > machine right now! > > Anybody else come across something like this? > --- No but ls is one of the common tools that a rootkit would replace and so that makes it suspect. Try rpm -Va * > /tmp/altered_files.txt and examine the file /tmp/altered_files.txt or post it here. If ls appears in this list (or ps), be very suspicious. Craig -- Shrike-list mailing list Shrike-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/shrike-list
