[ale] Cannot chown unowned files

[Randy C. Ramsdell]

On Wed, 2005-08-24 at 12:23 +0000, Jeff Hubbs wrote:
> Not knowing any better, I would suspect a very serious h4x0r problem; 
> those are three binaries that you would definitely want to replace with 
> pathologically-altered versions if you wanted to obfuscate what a 
> machine was really doing or what it really had on it. 
> 

I'll agree here. Those probably are trojans. Also check chown command.


> C. Lee Davis wrote:
> 
> >I've got an odd situation.  Some of my files have changed ownership to
> >an unknown user & group...
> >
> >  -rwxr-xr-x   1 122      114         39696 May  2 16:17 ls
> >  -rwxr-xr-x   1 122      114         54152 May  2 15:54 netstat
> >  -rwxr-xr-x   1 122      114         62920 May  2 12:39 ps
> >
> >There is no user 122 or group 114 on my system.  And I can't chown them
> >back, even as root.
> >
> >  host bin # chown root ls
> >  chown: changing ownership of `ls': Operation not permitted
> >
> >Anybody got any suggestions?
> >  
> >
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale