OT: /var/run/.defunct

Matthew D Truch matt at truch.net
Thu Feb 24 16:14:56 UTC 2011


Sorry for the mostly off-topic post, but google hasn't been my friend
lately and I don't know where to turn.  

We've had a few machines (mostly non-Fedora machines) which seem to have
a kind of rootkit installed on them, and write data to a file called
/var/run/.defunct among other non-niceties.  Of course, we're going to
wipe the machines in question but googling doesn't seem to provide us
with any info and we'd like to make sure that whatever exploit got the
system cracked in the first place is patched up this time around.  Any
ideas?

-- 
"299792458 m/s.  It's not just a good idea, It's the law."
--------------------------
Matthew Truch
Department of Physics and Astronomy
University of Pennsylvania
matt at truch.net
http://matt.truch.net/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/devel/attachments/20110224/077f00de/attachment.bin 


More information about the devel mailing list