?
Solved

please check this chkrootkit output

Posted on 2009-04-17
9
Medium Priority
?
318 Views
Last Modified: 2013-12-16
Are the "Permission denied" messages a reason to worry?

Thanks,
Robert

# ./chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `crontab'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not infected
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not infected
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
/usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied

/usr/lib/perl5/5.6.1/i586-linux/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tk/GBARR/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tk/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Net/SSLeay/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Net/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/URI/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tie/IxHash/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Data/ShowTable/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/HTML/Tagset/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/MIME/Base64/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Digest/MD5/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Weblint/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/w3mir/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Locale/gettext/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/libwww-perl/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Storable/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Msql-Mysql-modules/.packlist /usr/lib/SunJava2-1.3.1/bin/.java_wrapper /usr/lib/SunJava2-1.3.1/jre/bin/.java_wrapper

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
nothing found
Searching for Adore Worm... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for common ssh-scanners default files... nothing found
Searching for suspect PHP files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth0: not promisc and no PF_PACKET sockets
ippp1: not promisc and no PF_PACKET sockets
Checking `w55808'... not infected
Checking `wted'... 4 deletion(s) between Thu Oct 30 10:22:14 2008 and Wed Mar  9 13:35:11 1988
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Checking `chkutmp'... chkutmp: nothing deleted
0
Comment
Question by:robert_skywalker
  • 4
  • 3
  • 2
9 Comments
 
LVL 19

Accepted Solution

by:
jools earned 750 total points
ID: 24168606
did you run as root?
0
 
LVL 23

Assisted Solution

by:Maciej S
Maciej S earned 750 total points
ID: 24169369
If you are running this as root (I think so, because of '#' prompt) you shouldn't get 'permission denied' message. What about output of: "ls -l /usr/lib/news/bin/control" and possibly "lsattr /usr/lib/news/bin/control" also?
0
 

Author Comment

by:robert_skywalker
ID: 24170242
Yes, I run as root.

# whoami
root
# ls -l /usr/lib/news/bin/control
ls: /usr/lib/news/bin/control: Permission denied
# lsattr /usr/lib/news/bin/control
lsattr: Permission denied while trying to stat /usr/lib/news/bin/control
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 23

Expert Comment

by:Maciej S
ID: 24170331
ls -ld /usr/lib/news
ls -l /usr/lib/news
ls -l /usr/lib/news/bin

lsattr -d /usr/lib/news
lsattr /usr/lib/news
lsattr /usr/lib/news/bin
0
 
LVL 19

Expert Comment

by:jools
ID: 24172660
have a look in;
   /var/log/messages
   /var/log/secure
   /var/log/audit/audit.log

... what linux distro is it?

if you are using redhat based distro verify the package;
   rpm -V inn

Permission denied while as root is a little strange IMHO.
0
 
LVL 19

Expert Comment

by:jools
ID: 24172701
can you post the output of `id` please, I just want to check your uid/gid settings

posting /etc/passwd may help as well (this is just a guess!)
0
 
LVL 19

Expert Comment

by:jools
ID: 24172756
I just installed inn and it listed fine, I'm hoping it's a SELinux thing at the moment. Don't want to say it's OK until it's clearer it is not a problem.
0
 

Author Comment

by:robert_skywalker
ID: 24843691
it's a SuSE Linux 8.?

# ls -ld /usr/lib/news
drwxr-xr-x    5 news     news          144 Sep  5  2002 /usr/lib/news
# ls -l /usr/lib/news
total 33
drwxr-xr-x    5 news     news          144 Sep  5  2002 .
drwxr-xr-x   85 root     root        29040 Oct  9  2004 ..
drwxr-xr-x    6 news     news         2288 Sep  5  2002 bin
drwxr-xr-x    2 news     news          216 Sep  5  2002 include
lrwxrwxrwx    1 root     root            9 Sep 14  2005 inews -> bin/inews
drwxr-xr-x    2 news     news          264 Sep  5  2002 lib
#
# ls -l /usr/lib/news/bin
ls: /usr/lib/news/bin/control: Permission denied
total 3421
drwxr-xr-x    6 news     news         2288 Sep  5  2002 .
drwxr-xr-x    5 news     news          144 Sep  5  2002 ..
-r-xr-xr-x    1 news     news         4644 Mar 23  2002 actmerge
-r-xr-xr-x    1 news     news        58316 Mar 23  2002 actsync
-r-xr-xr-x    1 news     news         6133 Mar 23  2002 actsyncd
-r-xr-xr-x    1 news     news       109156 May  2  2002 archive
drwxr-xr-x    4 news     news           96 Sep  5  2002 auth
-r-xr-xr-x    1 news     news       108464 May  2  2002 batcher
-r-xr-xr-x    1 news     news        31940 Mar 23  2002 buffchan
-r-xr-x---    1 news     news         8084 Mar 23  2002 cnfsheadconf
-r-xr-x---    1 news     news        13936 Mar 23  2002 cnfsstat
-r-xr-x---    1 news     news         2557 Mar 23  2002 controlbatch
-r-xr-x---    1 news     news        12397 Mar 23  2002 controlchan
-r-xr-xr-x    1 news     news        11868 Mar 23  2002 convdate
-r-xr-xr-x    1 news     news         3428 Mar 23  2002 convertspool
-r-xr-x---    1 news     news        33064 Mar 23  2002 ctlinnd
-r-xr-xr-x    1 news     news       103308 May  2  2002 cvtbatch
-r-xr-x---    1 news     news         1576 Mar 23  2002 dbprocs
-r-xr-x---    1 news     news       123856 May  2  2002 expire
-r-xr-x---    1 news     news       152988 May  2  2002 expireover
-r-xr-x---    1 news     news          688 Mar 23  2002 expirerm
-r-xr-xr-x    1 news     news       107692 May  2  2002 fastrm
-r-xr-xr-x    1 news     news        27328 Mar 23  2002 filechan
drwxr-xr-x    2 news     news          328 Sep  5  2002 filter
-r-xr-xr-x    1 news     news         3166 Mar 23  2002 findmissing.pl
-r-xr-xr-x    1 news     news        30476 Mar 23  2002 getlist
-r-xr-xr-x    1 news     news         7009 Mar 23  2002 gpgverify
-r-xr-xr-x    1 news     news       111896 May  2  2002 grephistory
-rwxr-xr-x    1 root     root        25108 Mar 23  2002 gup
-rwxr-xr-x    1 root     root          826 Mar 23  2002 gupadd
-rwxr-xr-x    1 root     root         1234 Mar 23  2002 gupdate
-rwxr-xr-x    1 root     root          566 Mar 23  2002 gupverify
-rwxr-sr-x    1 news     news        51940 Mar 23  2002 inews
-r-xr-x---    1 news     news        27157 Mar 23  2002 inncheck
-r-xr-xr-x    1 news     news        26344 Mar 23  2002 innconfval
-r-xr-x---    1 news     news       322936 May  2  2002 innd
-r-xr-xr-x    1 news     news       150884 May  2  2002 inndf
-rwsr-xr--    1 root     news        29928 Mar 23  2002 inndstart
-r-xr-x---    1 news     news       254744 May  2  2002 innfeed
-r-xr-xr-x    1 news     news         1750 Mar 23  2002 innmail
-r-xr-x---    1 news     news        87629 Mar 23  2002 innreport
-r-xr-x---    1 news     news         1751 Mar 23  2002 innstat
-r-xr-x---    1 news     news         7766 Mar 23  2002 innwatch
-r-xr-xr-x    1 news     news        34052 Mar 23  2002 innxbatch
-r-xr-xr-x    1 news     news       126668 May  2  2002 innxmit
-r-xr-xr-x    1 news     news        11029 Mar 23  2002 mailpost
-r-xr-x---    1 news     news        39484 Mar 23  2002 makedbz
-r-xr-x---    1 news     news       163580 May  2  2002 makehistory
-r-xr-x---    1 news     news         3199 Mar 23  2002 mod-active
-r-xr-x---    1 news     news        13630 Mar 23  2002 news.daily
-r-xr-xr-x    1 news     news         3364 Mar 23  2002 news2mail
-r-xr-x---    1 news     news        40968 Mar 23  2002 newsrequeue
-r-xr-xr-x    1 news     news       273572 May  2  2002 nnrpd
-r-xr-xr-x    1 news     news        44736 Mar 23  2002 nntpget
-r-xr-xr-x    1 news     news         9894 Mar 23  2002 nntpsend
-r-xr-x---    1 news     news         3108 Mar 23  2002 ovdb_recover
lrwxrwxrwx    1 root     root           12 Sep 14  2005 ovdb_upgrade -> ovdb_recover
-r-xr-x---    1 news     news       151172 May  2  2002 overchan
-r-xr-x---    1 news     news         5208 Mar 23  2002 parsecontrol
-r-xr-xr-x    1 news     news        17049 Mar 23  2002 pgpverify
-r-xr-x---    1 news     news         5447 Mar 23  2002 procbatch
-r-xr-x---    1 news     news        39100 Mar 23  2002 prunehistory
-r-xr-xr-x    1 news     news        15002 Mar 23  2002 pullnews
-r-xr-x---    1 news     news         4777 Mar 23  2002 rc.news
-rwsr-x---    1 news     uucp        38120 Mar 23  2002 rnews
drwxr-xr-x    2 news     news          152 Sep  5  2002 rnews.libexec
-r-xr-x---    1 news     news         7101 Mar 23  2002 scanlogs
-r-xr-xr-x    1 news     news        12671 Mar 23  2002 scanspool
-r-xr-xr-x    1 news     news         2244 Mar 23  2002 send-ihave
-r-xr-xr-x    1 news     news         1693 Mar 23  2002 send-nntp
-r-xr-xr-x    1 news     news         2706 May  2  2002 send-uucp
-r-xr-xr-x    1 news     news         4291 May  2  2002 send-uucp.pl
-r-xr-xr-x    1 news     news         4790 May  2  2002 sendbatch
-r-xr-xr-x    1 news     news          867 Mar 23  2002 sendxbatches
-r-xr-xr-x    1 news     news         5836 Mar 23  2002 shlock
-r-xr-xr-x    1 news     news        28776 Mar 23  2002 shrinkfile
-r-xr-xr-x    1 news     news        18424 Mar 23  2002 signcontrol
-r-xr-xr-x    1 news     news         2175 Mar 23  2002 simpleftp
-r-xr-xr-x    1 news     news       103276 May  2  2002 sm
-rwsr-xr--    1 root     news        26120 Mar 23  2002 startinnfeed
-r-xr-x---    1 news     news         1388 Mar 23  2002 tally.control
-r-xr-x---    1 news     news         1212 Mar 23  2002 writelog
# lsattr -d /usr/lib/news
-------------- /usr/lib/news
# lsattr /usr/lib/news
-------------- /usr/lib/news/bin
-------------- /usr/lib/news/lib
-------------- /usr/lib/news/inews
-------------- /usr/lib/news/include
# lsattr /usr/lib/news/bin
-------------- /usr/lib/news/bin/sm
-------------- /usr/lib/news/bin/gup
-------------- /usr/lib/news/bin/auth
-------------- /usr/lib/news/bin/innd
-------------- /usr/lib/news/bin/expirerm
-------------- /usr/lib/news/bin/inndstart
-------------- /usr/lib/news/bin/dbprocs
/usr/lib/news/bin/control: Permission denied
-------------- /usr/lib/news/bin/news.daily
-------------- /usr/lib/news/bin/ctlinnd
-------------- /usr/lib/news/bin/tally.control
-------------- /usr/lib/news/bin/sendxbatches
-------------- /usr/lib/news/bin/makehistory
-------------- /usr/lib/news/bin/inews
-------------- /usr/lib/news/bin/inndf
-------------- /usr/lib/news/bin/nnrpd
-------------- /usr/lib/news/bin/rnews
-------------- /usr/lib/news/bin/innreport
-------------- /usr/lib/news/bin/pullnews
-------------- /usr/lib/news/bin/scanlogs
-------------- /usr/lib/news/bin/cnfsstat
-------------- /usr/lib/news/bin/ovdb_recover
-------------- /usr/lib/news/bin/innxbatch
-------------- /usr/lib/news/bin/prunehistory
-------------- /usr/lib/news/bin/grephistory
-------------- /usr/lib/news/bin/makedbz
-------------- /usr/lib/news/bin/send-nntp
-------------- /usr/lib/news/bin/send-uucp
-------------- /usr/lib/news/bin/mailpost
-------------- /usr/lib/news/bin/filechan
-------------- /usr/lib/news/bin/gpgverify
-------------- /usr/lib/news/bin/sendbatch
-------------- /usr/lib/news/bin/parsecontrol
-------------- /usr/lib/news/bin/pgpverify
-------------- /usr/lib/news/bin/scanspool
-------------- /usr/lib/news/bin/fastrm
-------------- /usr/lib/news/bin/filter
-------------- /usr/lib/news/bin/convdate
-------------- /usr/lib/news/bin/expire
-------------- /usr/lib/news/bin/getlist
-------------- /usr/lib/news/bin/shrinkfile
-------------- /usr/lib/news/bin/findmissing.pl
-------------- /usr/lib/news/bin/gupadd
-------------- /usr/lib/news/bin/mod-active
-------------- /usr/lib/news/bin/controlchan
-------------- /usr/lib/news/bin/rnews.libexec
-------------- /usr/lib/news/bin/overchan
-------------- /usr/lib/news/bin/cvtbatch
-------------- /usr/lib/news/bin/actsync
-------------- /usr/lib/news/bin/actmerge
-------------- /usr/lib/news/bin/nntpget
-------------- /usr/lib/news/bin/actsyncd
-------------- /usr/lib/news/bin/newsrequeue
-------------- /usr/lib/news/bin/buffchan
-------------- /usr/lib/news/bin/shlock
-------------- /usr/lib/news/bin/startinnfeed
-------------- /usr/lib/news/bin/gupverify
-------------- /usr/lib/news/bin/procbatch
-------------- /usr/lib/news/bin/gupdate
-------------- /usr/lib/news/bin/convertspool
-------------- /usr/lib/news/bin/send-ihave
-------------- /usr/lib/news/bin/batcher
-------------- /usr/lib/news/bin/archive
-------------- /usr/lib/news/bin/simpleftp
-------------- /usr/lib/news/bin/ovdb_upgrade
-------------- /usr/lib/news/bin/signcontrol
-------------- /usr/lib/news/bin/controlbatch
-------------- /usr/lib/news/bin/send-uucp.pl
-------------- /usr/lib/news/bin/cnfsheadconf
-------------- /usr/lib/news/bin/innfeed
-------------- /usr/lib/news/bin/innmail
-------------- /usr/lib/news/bin/innstat
-------------- /usr/lib/news/bin/innxmit
-------------- /usr/lib/news/bin/inncheck
-------------- /usr/lib/news/bin/writelog
-------------- /usr/lib/news/bin/news2mail
-------------- /usr/lib/news/bin/innwatch
-------------- /usr/lib/news/bin/expireover
-------------- /usr/lib/news/bin/nntpsend
-------------- /usr/lib/news/bin/rc.news
-------------- /usr/lib/news/bin/innconfval
# rpm -V inn
.......T c /etc/init.d/inn
.......T c /etc/news/.pgp/pubring.pgp
.......T c /etc/news/.profile
.......T c /etc/news/actsync.cfg
.......T c /etc/news/actsync.ign
.......T c /etc/news/buffindexed.conf
.......T c /etc/news/control.ctl
.......T c /etc/news/crontab.sample
.......T c /etc/news/cycbuff.conf
.......T c /etc/news/distrib.pats
.......T c /etc/news/distributions
.......T c /etc/news/expire.ctl
.......T c /etc/news/incoming.conf
.......T c /etc/news/inn.conf
.......T c /etc/news/innfeed.conf
.......T c /etc/news/innreport.conf
.......T c /etc/news/innwatch.ctl
.......T c /etc/news/moderators
.......T c /etc/news/motd.news
.......T c /etc/news/news2mail.cf
.......T c /etc/news/newsfeeds
.......T c /etc/news/nnrpd.track
.......T c /etc/news/nntpsend.ctl
.......T c /etc/news/ovdb.conf
.......T c /etc/news/overview.fmt
.......T c /etc/news/passwd.nntp
.......T c /etc/news/radius.conf
.......T c /etc/news/readers.conf
.......T c /etc/news/sasl.conf
.......T c /etc/news/send-uucp.cf
.......T c /etc/news/storage.conf
.......T c /etc/news/subscriptions
.......T   /usr/lib/news/bin/actmerge
.......T   /usr/lib/news/bin/actsync
.......T   /usr/lib/news/bin/actsyncd
.......T   /usr/lib/news/bin/auth/passwd/ckpasswd
.......T   /usr/lib/news/bin/auth/passwd/pwcheck
.......T   /usr/lib/news/bin/auth/passwd/radius
.......T   /usr/lib/news/bin/auth/resolv/domain
.......T   /usr/lib/news/bin/auth/resolv/ident
.......T   /usr/lib/news/bin/buffchan
.......T   /usr/lib/news/bin/cnfsheadconf
.......T   /usr/lib/news/bin/cnfsstat
missing    /usr/lib/news/bin/control
missing    /usr/lib/news/bin/control/checkgroups
missing    /usr/lib/news/bin/control/checkgroups.pl
missing    /usr/lib/news/bin/control/default
missing    /usr/lib/news/bin/control/ihave
missing    /usr/lib/news/bin/control/ihave.pl
missing    /usr/lib/news/bin/control/newgroup
missing    /usr/lib/news/bin/control/newgroup.pl
missing    /usr/lib/news/bin/control/rmgroup
missing    /usr/lib/news/bin/control/rmgroup.pl
missing    /usr/lib/news/bin/control/sendme
missing    /usr/lib/news/bin/control/sendme.pl
missing    /usr/lib/news/bin/control/sendsys
missing    /usr/lib/news/bin/control/sendsys.pl
missing    /usr/lib/news/bin/control/senduuname
missing    /usr/lib/news/bin/control/senduuname.pl
missing    /usr/lib/news/bin/control/version
missing    /usr/lib/news/bin/control/version.pl
.......T   /usr/lib/news/bin/controlbatch
.......T   /usr/lib/news/bin/controlchan
.......T   /usr/lib/news/bin/convdate
.......T   /usr/lib/news/bin/convertspool
.......T   /usr/lib/news/bin/ctlinnd
.......T   /usr/lib/news/bin/dbprocs
.......T   /usr/lib/news/bin/expirerm
.......T   /usr/lib/news/bin/filechan
.......T c /usr/lib/news/bin/filter/INN.py
.......T c /usr/lib/news/bin/filter/filter.tcl
.......T c /usr/lib/news/bin/filter/filter_innd.pl
.......T c /usr/lib/news/bin/filter/filter_innd.py
.......T c /usr/lib/news/bin/filter/filter_nnrpd.pl
.......T c /usr/lib/news/bin/filter/nnrpd_auth.pl
.......T c /usr/lib/news/bin/filter/nnrpd_auth.py
.......T c /usr/lib/news/bin/filter/startup.tcl
.......T c /usr/lib/news/bin/filter/startup_innd.pl
.......T   /usr/lib/news/bin/findmissing.pl
.......T   /usr/lib/news/bin/getlist
.......T   /usr/lib/news/bin/gpgverify
.M.....T   /usr/lib/news/bin/inews
.......T   /usr/lib/news/bin/inncheck
.......T   /usr/lib/news/bin/innconfval
.M.....T   /usr/lib/news/bin/inndstart
.......T   /usr/lib/news/bin/innmail
.......T   /usr/lib/news/bin/innreport
.......T   /usr/lib/news/bin/innstat
.......T   /usr/lib/news/bin/innwatch
.......T   /usr/lib/news/bin/innxbatch
.......T   /usr/lib/news/bin/mailpost
.......T   /usr/lib/news/bin/makedbz
.......T   /usr/lib/news/bin/mod-active
.......T   /usr/lib/news/bin/news.daily
.......T   /usr/lib/news/bin/news2mail
.......T   /usr/lib/news/bin/newsrequeue
.......T   /usr/lib/news/bin/nntpget
.......T   /usr/lib/news/bin/nntpsend
.......T   /usr/lib/news/bin/ovdb_recover
.......T   /usr/lib/news/bin/parsecontrol
.......T   /usr/lib/news/bin/pgpverify
.......T   /usr/lib/news/bin/procbatch
.......T   /usr/lib/news/bin/prunehistory
.......T   /usr/lib/news/bin/pullnews
.......T   /usr/lib/news/bin/rc.news
.M.....T   /usr/lib/news/bin/rnews
.......T   /usr/lib/news/bin/rnews.libexec/c7unbatch
.......T   /usr/lib/news/bin/rnews.libexec/decode
.......T   /usr/lib/news/bin/rnews.libexec/encode
.......T   /usr/lib/news/bin/rnews.libexec/gunbatch
.......T   /usr/lib/news/bin/scanlogs
.......T   /usr/lib/news/bin/scanspool
.......T   /usr/lib/news/bin/send-ihave
.......T   /usr/lib/news/bin/send-nntp
.......T   /usr/lib/news/bin/sendxbatches
.......T   /usr/lib/news/bin/shlock
.......T   /usr/lib/news/bin/shrinkfile
.......T   /usr/lib/news/bin/signcontrol
.......T   /usr/lib/news/bin/simpleftp
.M.....T   /usr/lib/news/bin/startinnfeed
.......T   /usr/lib/news/bin/tally.control
.......T   /usr/lib/news/bin/writelog
.......T   /usr/lib/news/lib/docheckgroups
.......T   /usr/lib/news/lib/innshellvars
.......T   /usr/lib/news/lib/innshellvars.pl
.......T   /usr/lib/news/lib/innshellvars.tcl
..5....T   /usr/lib/news/lib/libinn.a
.......T c /var/lib/news/active
.......T c /var/lib/news/active.times
.......T c /var/lib/news/history
.......T c /var/lib/news/history.dir
.......T c /var/lib/news/history.pag
.......T c /var/lib/news/newsgroups
missing    /var/log/news/news
.M......   /var/log/news/news.crit
.M......   /var/log/news/news.err
.M......   /var/log/news/news.notice
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),14(uucp),15(shadow),16(dialout),17(audio),65533(nobody),65534(nogroup)
# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash
daemon:x:2:2:Daemon:/sbin:/bin/bash
lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
games:x:12:100:Games account:/var/games:/bin/bash
at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
postgres:x:26:2:Postgres database admin:/var/lib/pgsql:/bin/bash
mdom:x:28:28:Mailing list agent:/usr/lib/majordomo:/bin/bash
wwwrun:x:30:65534:WWW daemon apache:/var/lib/wwwrun:/bin/bash
squid:x:31:65534:WWW proxy squid:/var/squid:/bin/bash
fax:x:33:14:Facsimile agent:/var/spool/fax:/bin/bash
gnats:x:34:65534:Gnats GNU backtracking system:/usr/lib/gnats:/bin/bash
adabas:x:36:100:Adabas-D database admin:/usr/lib/adabas:/bin/bash
amanda:x:37:6:Amanda admin:/var/lib/amanda:/bin/bash
irc:x:39:65534:IRC daemon:/usr/lib/ircd:/bin/bash
ftp:x:40:2:FTP account:/usr/local/ftp:/bin/bash
firewall:x:41:31:Firewall account:/var/lib/firewall:/bin/false
named:x:44:44:Nameserver daemon:/var/named:/bin/bash
fnet:x:49:14:FidoNet account:/var/spool/fnet:/bin/bash
gdm:x:50:15:Gnome Display Manager daemon:/var/lib/gdm:/bin/bash
postfix:x:51:51:Postfix daemon:/var/spool/postfix:/bin/false
cyrus:x:96:12:IMAP daemon:/usr/lib/cyrus:/bin/bash
oracle:x:59:54:Oracle database admin:/opt/oracle:/bin/bash
mysql:x:60:2:MySQL database admin:/var/lib/mysql:/bin/false
dpbox:x:61:56:DpBox account:/var/spool/dpbox:/bin/false
ingres:x:62:3:Ingres database admin:/opt/tngfw/ingres:/bin/bash
zope:x:64:2:Zope daemon:/var/lib/zope:/bin/false
vscan:x:65:65534:Vscan account:/var/spool/vscan:/bin/false
wnn:x:66:100:Wnn system account:/var/lib/wnn:/bin/false
pop:x:67:100:POP admin:/var/lib/pop:/bin/false
perforce:x:68:60:Perfoce admin:/var/lib/perforce:/bin/false
sapdb:x:69:61:SAPDB demo account:/var/opt/sapdb:/bin/bash
db4web:x:70:100:DB4Web account:/opt/db4web:/bin/bash
nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
robert:x:500:100:Robert Schelander:/home/robert:/bin/bash
man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
news:x:9:13:News system:/etc/news:/bin/bash
sshd:x:74:65:SSH daemon:/var/lib/sshd:/bin/false
uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
#
0
 

Author Closing Comment

by:robert_skywalker
ID: 31571398
just assigned points to all that tried to help
maybe there is no solution because file system was corrupt
the system was not worth to invest too much time
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Fine Tune your automatic Updates for Ubuntu / Debian
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses
Course of the Month17 days, 5 hours left to enroll

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question