hacked?

From: Tom Beer (tom@analogon.com)
Date: 09/26/01 

From: "Tom Beer" <tom@analogon.com>
To: <freebsd-security@freebsd.org>
Date: Wed, 26 Sep 2001 19:25:31 +0200

Hi,

I just have taken a look at my /stand directory
and have absolutely no explanation what the -sh and the [
file could be, and why are nearly all files have exact the same
size, date and time.

Any suggestions will be very welcome,
thanks Tom

ls /stand

total 55307
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 -sh*
drwxr-xr-x 4 root wheel 1024 Aug 6 19:52 ./
drwxr-xr-x 20 root wheel 512 Sep 19 19:39 ../
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 [*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 arp*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 boot_crunch*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 cpio*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 dhclient*
-r-xr-xr-x 1 root wheel 6690 Apr 22 02:25 dhclient-script*
drwx------ 3 root wheel 512 Aug 6 19:52 etc/
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 find*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 fsck*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 gunzip*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 gzip*
drwxr-xr-x 2 root wheel 1024 Aug 6 19:52 help/
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 hostname*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 ifconfig*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 minigzip*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 mount_mfs*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 mount_nfs*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 newfs*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pccardc*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pccardd*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 ppp*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 pwd*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 rm*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 route*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 rtsol*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sed*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sh*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 slattach*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 sysinstall*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 test*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 tunefs*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 usbd*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 usbdevs*
-r-xr-xr-x 32 root wheel 1759284 Apr 22 01:44 zcat*

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message