similar to: Linux virus

Hi everyone, I know there have been several requests regarding subsetting before, but none of them really helps with my problem: I'm trying to subset only infected individuals from the REC2 data.frame: > str(REC2) 'data.frame': 362 obs. of 7 variables: $ RINGNO : Factor w/ 370 levels "BL17546","BL17577",..: 78 81 67 41 58 66 17 $ year : Factor w/ 8

Hi I have data from 12 subjects. The measurement is log(expression) of a particular gene and can be assumed to be normally distributed. The 12 subjects are divided into the following groups: Infected, Vaccinated, Lesions - 3 measurements Infected, Vaccintaed, No Lesions - 2 measurements Infected, Not Vaccinated, Lesions - 4 measurements Uninfected, Not Vaccinated, No Lesions - 3 measurements

Dear R users, Prof. Ripley just corrected my understanding of the use of weights in glm, which I thought would allow me to correctly use lmer. However I'm still having problems. My data takes the form of # of infected and uninfected individuals that were measured over time under different treatments. I'm using lmer to adjust for the repeated measures over time. In fitting the

Hello; I'm running a FreeBSD 4.10-release-p2 box and both chkrootkit 0.44 & 0.45 report that my /sbin/init file is infected. It appears as though the egrep for "UPX" in the output of "strings" triggers the infected notice. When I copy the init file from an uninfected box to this one chkrootkit continues to report it as infected. Is chkrootkit reading a copy of the

Hi So carrying on my use of analysis of variance to check for the effects of two factors. It's made simpler by the fact that both my factors have only two levels each, creating four unique groups. I have a highly significant interaction term. In the context of the experiment, this makes sense. I can visualise the data graphically, and sure enough I can see that both factors have different

Hi! Running chkrootkit on newly installed FreeBSD 5.0 got: -cut- Checking `basename'... not infected Checking `biff'... not infected Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `cron'... not infected Checking `date'... INFECTED -cut- Checking `ls'... INFECTED -cut- Checking `ps'... INFECTED Checking `pstree'... not found -cut- What does it

My machine got hacked a few days ago through the samba bug. I reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM but still... Can anyone please advise ? bash-2.05b# chkrootkit | grep INFECTED Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `date'... INFECTED Checking `ls'... INFECTED Checking `ps'... INFECTED -- Jay -------------- next

Hello! I've found that on two FreeBSD 4.5-RELEASE boxes chkrootkit finds: Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `date'... INFECTED Checking `ls'... INFECTED Checking `ps'... INFECTED recompiling, say, ls from souces didn't help. False positive or source changed as well? -- Alex.

Hello I'm having a problem using the virusfilter and shadow_copy2 modules which, unless I'm mistaken, seems like a conflict between these modules. If I use the virusfilter, acl_xattr, recycle, shadow_copy2 and full_audit modules together, everything works perfectly, if I use the NOTHING, RENAME or DELETE actions of the virusfilter module. If I choose to use the QUARANTINE action for the

Hi, I have a 4.9-STABLE FreeBSD box apparently hacked! Yesterday I ran chkrootkit-0.41 and I don't like some of the outputs. Those are: chfn ... INFECTED chsh ... INFECTED date ... INFECTED ls ... INFECTED ps ... INFECTED But all the rest is NOT PROMISC, NOT INFECTED, NOTHING FOUND, NOTHING DELETED, or NOTHING DETECTED. I know by the FreeBSD-Security archives that

Here is the applicable article: http://www.linux.com/feature/125548 There are links in the above article that explain tests for the system and what is currently known about the rootkit. Apparently initial access is NOT via any vulnerability but just guessed root passwords. There are currently 2 methods to see if you are infected: 1. In some cases, the root kit causes you to not be able to

----------------------- This e-mail is generated by Skynet Mail Protection to warn you that the e-mail sent by samba@lists.samba.org to vincent.brabant@skynet.be is infected with virus: Win32/Mydoom.A@mm. Deze e-mail is gegenereerd door Skynet Mail Protection om u te waarschuwen dat de e-mail gestuurd door samba@lists.samba.org naar vincent.brabant@skynet.be geinfecteerd is met Win32/Mydoom.A@mm.

Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or later report chfn, chsh, and date as infected? I built world yesterday, and my nightly chkrootkit reports this on run. I've replaced the binaries with their 4.9 equivalents, and things don't report as infected. I upgrade the 4.9 machine to 4.10, and chkrootkit reports them as infected again. Is this similar to the

Hi, This may seem a fairly obvious question but I need to check it out. It's also fairly urgent so I apologise that I haven't made a good check of the FAQ's or mailing archives. We have a Solaris box with Samba installed. We are on a campus network where boxes that are infected are blocked from the network as a security measure. We have had our server blocked as it is probing port

-=> To moderator: I don't know whether it's wise to release the FTP-location I would recommend everyone to just look over their daemons, and run something like nessus against theirselves... Greetings, Jan-Philip Velders ---------- Forwarded message ---------- Date: Thu, 25 Mar 1999 16:26:59 -0700 From: "Ben Cantrick (Macky Stingray)" <mackys@MACKY.RONIN.NET> To:

I have discovered that many times the virus definitions I use for scanning messages (ClamAV, with the unofficial signatures http://sanesecurity.com/usage/linux-scripts/) are updated some time after my server has received an infected email. It seems the virus creators are trying to race the virus definition creators to see who can deliver first; more than half of the infected messages are found

Running freeBSD 6.1 After changing chkrootkit to the latest version V. 0.47 and compiling it then running it I get the following: ==================<SNIPPIT>================ Searching for anomalies in shell history files... nothing found Checking `asp'... not infected Checking `bindshell'... INFECTED (PORTS: 6667) Checking `lkm'... You have 131 process hidden for readdir

Hi, The data (attached) I am looking at consists of measurements of growth rate at different ages, for individuals in two treatments (control and infected). What I want to know is whether and when (what age) the growth rate of infected individuals is higher than the growth rate for control individuals. The simplest way to approach this question is to just do a t-test at each age, but because

While I realize that the bliss virus looks more like a research project than a malicious virus, the reality is that it is out there. Because I was concerned that some programs on my linux systems might have become infected, I wrote a tool to determine which programs, if any, had been infected by the bliss virus. For those who lack md5 checksums of all their binaries, this is likely to be a

I ran chkrootkit ( v. chkrootkit-0.43 ) earlier and noticed that chfn, date, and chsh showed as being infected. I remember reading post from the past that right now chkrootkit is giving alot of false positives, so I suspected that these 3 binaries are not bad. However, to be on the safe side, I deleted the 3 binaries, removed /usr/src and did a 'make world' to 4.10-STABLE. But, chfn,