What about nmap, maybe it could at least give you a port to investigate<br>
<br>
nmap -p 1-65535 localhost<br>
<br>
Marc<br>
<br>
<br><br><div><span class="gmail_quote">On 9/9/05, <b class="gmail_sendername">Jose Luis Hime</b> <<a href="mailto:jhime@synchro.com.br">jhime@synchro.com.br</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>chkrootkit and rkhunter do not report any problem.<br><br>I am still with this issue, any hints?<br><br>Thanks,<br>J. Hime<br>________________________________________<br>From: <a href="mailto:fedora-list-bounces@redhat.com">
fedora-list-bounces@redhat.com</a> [mailto:<a href="mailto:fedora-list-bounces@redhat.com">fedora-list-bounces@redhat.com</a>]<br>On Behalf Of Marc M<br>Sent: Thursday, September 08, 2005 5:00 PM<br>To: For users of Fedora Core releases
<br>Subject: Re: Have I been hacked? Shadow file deleted<br><br>Try running chkrootkit and rkhunter<br>On 9/8/05, STYMA, ROBERT E (ROBERT) <<a href="mailto:stymar@lucent.com">stymar@lucent.com</a>> wrote:<br>><br>
> Hello,<br>><br>> I installed a new server on Tuesday using Fedora Core 4 and<br>> today the shadow<br>> file was deleted three times. Since nothing was being done on<br>> the box at<br>> those times, I believe I was hacked.
<br>><br>Since it is a new install, I would look into running the<br>badblocks command just to be safe.There is always the chance<br>something is wrong with the disk where the inode for the shadow<br>file is stored.This
is a long shot, but easy to do.<br><br>Bob Styma<br><br>--<br>fedora-list mailing list<br><a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a><br>To unsubscribe: <a href="http://www.redhat.com/mailman/listinfo/fedora-list">
http://www.redhat.com/mailman/listinfo/fedora-list</a><br><br><br><br>--<br>fedora-list mailing list<br><a href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</a><br>To unsubscribe: <a href="http://www.redhat.com/mailman/listinfo/fedora-list">
http://www.redhat.com/mailman/listinfo/fedora-list</a><br></blockquote></div><br>