Link to home
Start Free TrialLog in
Avatar of robert_skywalker
robert_skywalkerFlag for Austria

asked on

please check this chkrootkit output

Are the "Permission denied" messages a reason to worry?

Thanks,
Robert

# ./chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `crontab'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not infected
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not infected
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
/usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied

/usr/lib/perl5/5.6.1/i586-linux/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tk/GBARR/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tk/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Net/SSLeay/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Net/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/URI/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Tie/IxHash/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Data/ShowTable/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/HTML/Tagset/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/MIME/Base64/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Digest/MD5/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Weblint/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/w3mir/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Locale/gettext/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/libwww-perl/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Storable/.packlist /usr/lib/perl5/site_perl/5.6.1/i586-linux/auto/Msql-Mysql-modules/.packlist /usr/lib/SunJava2-1.3.1/bin/.java_wrapper /usr/lib/SunJava2-1.3.1/jre/bin/.java_wrapper

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
nothing found
Searching for Adore Worm... /usr/bin/find: /usr/lib/news/bin/control: Permission denied
/usr/bin/find: /usr/lib/news/bin/mailpost: Permission denied
/usr/bin/find: /usr/lib/news/bin/filechan: Permission denied
/usr/bin/find: /usr/lib/news/bin/gpgverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/sendbatch: Permission denied
/usr/bin/find: /usr/lib/news/bin/parsecontrol: Permission denied
/usr/bin/find: /usr/lib/news/bin/pgpverify: Permission denied
/usr/bin/find: /usr/lib/news/bin/scanspool: Permission denied
/usr/bin/find: /usr/lib/news/bin/fastrm: Permission denied
/usr/bin/find: /usr/lib/news/bin/filter: Permission denied
/usr/bin/find: /usr/lib/news/bin/inncheck: Permission denied
/usr/bin/find: /usr/lib/news/bin/writelog: Permission denied
/usr/bin/find: /usr/lib/news/bin/news2mail: Permission denied
nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for common ssh-scanners default files... nothing found
Searching for suspect PHP files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth0: not promisc and no PF_PACKET sockets
ippp1: not promisc and no PF_PACKET sockets
Checking `w55808'... not infected
Checking `wted'... 4 deletion(s) between Thu Oct 30 10:22:14 2008 and Wed Mar  9 13:35:11 1988
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Checking `chkutmp'... chkutmp: nothing deleted
ASKER CERTIFIED SOLUTION
Avatar of Julian Parker
Julian Parker
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of robert_skywalker

ASKER

Yes, I run as root.

# whoami
root
# ls -l /usr/lib/news/bin/control
ls: /usr/lib/news/bin/control: Permission denied
# lsattr /usr/lib/news/bin/control
lsattr: Permission denied while trying to stat /usr/lib/news/bin/control
ls -ld /usr/lib/news
ls -l /usr/lib/news
ls -l /usr/lib/news/bin

lsattr -d /usr/lib/news
lsattr /usr/lib/news
lsattr /usr/lib/news/bin
have a look in;
   /var/log/messages
   /var/log/secure
   /var/log/audit/audit.log

... what linux distro is it?

if you are using redhat based distro verify the package;
   rpm -V inn

Permission denied while as root is a little strange IMHO.
can you post the output of `id` please, I just want to check your uid/gid settings

posting /etc/passwd may help as well (this is just a guess!)
I just installed inn and it listed fine, I'm hoping it's a SELinux thing at the moment. Don't want to say it's OK until it's clearer it is not a problem.
it's a SuSE Linux 8.?

# ls -ld /usr/lib/news
drwxr-xr-x    5 news     news          144 Sep  5  2002 /usr/lib/news
# ls -l /usr/lib/news
total 33
drwxr-xr-x    5 news     news          144 Sep  5  2002 .
drwxr-xr-x   85 root     root        29040 Oct  9  2004 ..
drwxr-xr-x    6 news     news         2288 Sep  5  2002 bin
drwxr-xr-x    2 news     news          216 Sep  5  2002 include
lrwxrwxrwx    1 root     root            9 Sep 14  2005 inews -> bin/inews
drwxr-xr-x    2 news     news          264 Sep  5  2002 lib
#
# ls -l /usr/lib/news/bin
ls: /usr/lib/news/bin/control: Permission denied
total 3421
drwxr-xr-x    6 news     news         2288 Sep  5  2002 .
drwxr-xr-x    5 news     news          144 Sep  5  2002 ..
-r-xr-xr-x    1 news     news         4644 Mar 23  2002 actmerge
-r-xr-xr-x    1 news     news        58316 Mar 23  2002 actsync
-r-xr-xr-x    1 news     news         6133 Mar 23  2002 actsyncd
-r-xr-xr-x    1 news     news       109156 May  2  2002 archive
drwxr-xr-x    4 news     news           96 Sep  5  2002 auth
-r-xr-xr-x    1 news     news       108464 May  2  2002 batcher
-r-xr-xr-x    1 news     news        31940 Mar 23  2002 buffchan
-r-xr-x---    1 news     news         8084 Mar 23  2002 cnfsheadconf
-r-xr-x---    1 news     news        13936 Mar 23  2002 cnfsstat
-r-xr-x---    1 news     news         2557 Mar 23  2002 controlbatch
-r-xr-x---    1 news     news        12397 Mar 23  2002 controlchan
-r-xr-xr-x    1 news     news        11868 Mar 23  2002 convdate
-r-xr-xr-x    1 news     news         3428 Mar 23  2002 convertspool
-r-xr-x---    1 news     news        33064 Mar 23  2002 ctlinnd
-r-xr-xr-x    1 news     news       103308 May  2  2002 cvtbatch
-r-xr-x---    1 news     news         1576 Mar 23  2002 dbprocs
-r-xr-x---    1 news     news       123856 May  2  2002 expire
-r-xr-x---    1 news     news       152988 May  2  2002 expireover
-r-xr-x---    1 news     news          688 Mar 23  2002 expirerm
-r-xr-xr-x    1 news     news       107692 May  2  2002 fastrm
-r-xr-xr-x    1 news     news        27328 Mar 23  2002 filechan
drwxr-xr-x    2 news     news          328 Sep  5  2002 filter
-r-xr-xr-x    1 news     news         3166 Mar 23  2002 findmissing.pl
-r-xr-xr-x    1 news     news        30476 Mar 23  2002 getlist
-r-xr-xr-x    1 news     news         7009 Mar 23  2002 gpgverify
-r-xr-xr-x    1 news     news       111896 May  2  2002 grephistory
-rwxr-xr-x    1 root     root        25108 Mar 23  2002 gup
-rwxr-xr-x    1 root     root          826 Mar 23  2002 gupadd
-rwxr-xr-x    1 root     root         1234 Mar 23  2002 gupdate
-rwxr-xr-x    1 root     root          566 Mar 23  2002 gupverify
-rwxr-sr-x    1 news     news        51940 Mar 23  2002 inews
-r-xr-x---    1 news     news        27157 Mar 23  2002 inncheck
-r-xr-xr-x    1 news     news        26344 Mar 23  2002 innconfval
-r-xr-x---    1 news     news       322936 May  2  2002 innd
-r-xr-xr-x    1 news     news       150884 May  2  2002 inndf
-rwsr-xr--    1 root     news        29928 Mar 23  2002 inndstart
-r-xr-x---    1 news     news       254744 May  2  2002 innfeed
-r-xr-xr-x    1 news     news         1750 Mar 23  2002 innmail
-r-xr-x---    1 news     news        87629 Mar 23  2002 innreport
-r-xr-x---    1 news     news         1751 Mar 23  2002 innstat
-r-xr-x---    1 news     news         7766 Mar 23  2002 innwatch
-r-xr-xr-x    1 news     news        34052 Mar 23  2002 innxbatch
-r-xr-xr-x    1 news     news       126668 May  2  2002 innxmit
-r-xr-xr-x    1 news     news        11029 Mar 23  2002 mailpost
-r-xr-x---    1 news     news        39484 Mar 23  2002 makedbz
-r-xr-x---    1 news     news       163580 May  2  2002 makehistory
-r-xr-x---    1 news     news         3199 Mar 23  2002 mod-active
-r-xr-x---    1 news     news        13630 Mar 23  2002 news.daily
-r-xr-xr-x    1 news     news         3364 Mar 23  2002 news2mail
-r-xr-x---    1 news     news        40968 Mar 23  2002 newsrequeue
-r-xr-xr-x    1 news     news       273572 May  2  2002 nnrpd
-r-xr-xr-x    1 news     news        44736 Mar 23  2002 nntpget
-r-xr-xr-x    1 news     news         9894 Mar 23  2002 nntpsend
-r-xr-x---    1 news     news         3108 Mar 23  2002 ovdb_recover
lrwxrwxrwx    1 root     root           12 Sep 14  2005 ovdb_upgrade -> ovdb_recover
-r-xr-x---    1 news     news       151172 May  2  2002 overchan
-r-xr-x---    1 news     news         5208 Mar 23  2002 parsecontrol
-r-xr-xr-x    1 news     news        17049 Mar 23  2002 pgpverify
-r-xr-x---    1 news     news         5447 Mar 23  2002 procbatch
-r-xr-x---    1 news     news        39100 Mar 23  2002 prunehistory
-r-xr-xr-x    1 news     news        15002 Mar 23  2002 pullnews
-r-xr-x---    1 news     news         4777 Mar 23  2002 rc.news
-rwsr-x---    1 news     uucp        38120 Mar 23  2002 rnews
drwxr-xr-x    2 news     news          152 Sep  5  2002 rnews.libexec
-r-xr-x---    1 news     news         7101 Mar 23  2002 scanlogs
-r-xr-xr-x    1 news     news        12671 Mar 23  2002 scanspool
-r-xr-xr-x    1 news     news         2244 Mar 23  2002 send-ihave
-r-xr-xr-x    1 news     news         1693 Mar 23  2002 send-nntp
-r-xr-xr-x    1 news     news         2706 May  2  2002 send-uucp
-r-xr-xr-x    1 news     news         4291 May  2  2002 send-uucp.pl
-r-xr-xr-x    1 news     news         4790 May  2  2002 sendbatch
-r-xr-xr-x    1 news     news          867 Mar 23  2002 sendxbatches
-r-xr-xr-x    1 news     news         5836 Mar 23  2002 shlock
-r-xr-xr-x    1 news     news        28776 Mar 23  2002 shrinkfile
-r-xr-xr-x    1 news     news        18424 Mar 23  2002 signcontrol
-r-xr-xr-x    1 news     news         2175 Mar 23  2002 simpleftp
-r-xr-xr-x    1 news     news       103276 May  2  2002 sm
-rwsr-xr--    1 root     news        26120 Mar 23  2002 startinnfeed
-r-xr-x---    1 news     news         1388 Mar 23  2002 tally.control
-r-xr-x---    1 news     news         1212 Mar 23  2002 writelog
# lsattr -d /usr/lib/news
-------------- /usr/lib/news
# lsattr /usr/lib/news
-------------- /usr/lib/news/bin
-------------- /usr/lib/news/lib
-------------- /usr/lib/news/inews
-------------- /usr/lib/news/include
# lsattr /usr/lib/news/bin
-------------- /usr/lib/news/bin/sm
-------------- /usr/lib/news/bin/gup
-------------- /usr/lib/news/bin/auth
-------------- /usr/lib/news/bin/innd
-------------- /usr/lib/news/bin/expirerm
-------------- /usr/lib/news/bin/inndstart
-------------- /usr/lib/news/bin/dbprocs
/usr/lib/news/bin/control: Permission denied
-------------- /usr/lib/news/bin/news.daily
-------------- /usr/lib/news/bin/ctlinnd
-------------- /usr/lib/news/bin/tally.control
-------------- /usr/lib/news/bin/sendxbatches
-------------- /usr/lib/news/bin/makehistory
-------------- /usr/lib/news/bin/inews
-------------- /usr/lib/news/bin/inndf
-------------- /usr/lib/news/bin/nnrpd
-------------- /usr/lib/news/bin/rnews
-------------- /usr/lib/news/bin/innreport
-------------- /usr/lib/news/bin/pullnews
-------------- /usr/lib/news/bin/scanlogs
-------------- /usr/lib/news/bin/cnfsstat
-------------- /usr/lib/news/bin/ovdb_recover
-------------- /usr/lib/news/bin/innxbatch
-------------- /usr/lib/news/bin/prunehistory
-------------- /usr/lib/news/bin/grephistory
-------------- /usr/lib/news/bin/makedbz
-------------- /usr/lib/news/bin/send-nntp
-------------- /usr/lib/news/bin/send-uucp
-------------- /usr/lib/news/bin/mailpost
-------------- /usr/lib/news/bin/filechan
-------------- /usr/lib/news/bin/gpgverify
-------------- /usr/lib/news/bin/sendbatch
-------------- /usr/lib/news/bin/parsecontrol
-------------- /usr/lib/news/bin/pgpverify
-------------- /usr/lib/news/bin/scanspool
-------------- /usr/lib/news/bin/fastrm
-------------- /usr/lib/news/bin/filter
-------------- /usr/lib/news/bin/convdate
-------------- /usr/lib/news/bin/expire
-------------- /usr/lib/news/bin/getlist
-------------- /usr/lib/news/bin/shrinkfile
-------------- /usr/lib/news/bin/findmissing.pl
-------------- /usr/lib/news/bin/gupadd
-------------- /usr/lib/news/bin/mod-active
-------------- /usr/lib/news/bin/controlchan
-------------- /usr/lib/news/bin/rnews.libexec
-------------- /usr/lib/news/bin/overchan
-------------- /usr/lib/news/bin/cvtbatch
-------------- /usr/lib/news/bin/actsync
-------------- /usr/lib/news/bin/actmerge
-------------- /usr/lib/news/bin/nntpget
-------------- /usr/lib/news/bin/actsyncd
-------------- /usr/lib/news/bin/newsrequeue
-------------- /usr/lib/news/bin/buffchan
-------------- /usr/lib/news/bin/shlock
-------------- /usr/lib/news/bin/startinnfeed
-------------- /usr/lib/news/bin/gupverify
-------------- /usr/lib/news/bin/procbatch
-------------- /usr/lib/news/bin/gupdate
-------------- /usr/lib/news/bin/convertspool
-------------- /usr/lib/news/bin/send-ihave
-------------- /usr/lib/news/bin/batcher
-------------- /usr/lib/news/bin/archive
-------------- /usr/lib/news/bin/simpleftp
-------------- /usr/lib/news/bin/ovdb_upgrade
-------------- /usr/lib/news/bin/signcontrol
-------------- /usr/lib/news/bin/controlbatch
-------------- /usr/lib/news/bin/send-uucp.pl
-------------- /usr/lib/news/bin/cnfsheadconf
-------------- /usr/lib/news/bin/innfeed
-------------- /usr/lib/news/bin/innmail
-------------- /usr/lib/news/bin/innstat
-------------- /usr/lib/news/bin/innxmit
-------------- /usr/lib/news/bin/inncheck
-------------- /usr/lib/news/bin/writelog
-------------- /usr/lib/news/bin/news2mail
-------------- /usr/lib/news/bin/innwatch
-------------- /usr/lib/news/bin/expireover
-------------- /usr/lib/news/bin/nntpsend
-------------- /usr/lib/news/bin/rc.news
-------------- /usr/lib/news/bin/innconfval
# rpm -V inn
.......T c /etc/init.d/inn
.......T c /etc/news/.pgp/pubring.pgp
.......T c /etc/news/.profile
.......T c /etc/news/actsync.cfg
.......T c /etc/news/actsync.ign
.......T c /etc/news/buffindexed.conf
.......T c /etc/news/control.ctl
.......T c /etc/news/crontab.sample
.......T c /etc/news/cycbuff.conf
.......T c /etc/news/distrib.pats
.......T c /etc/news/distributions
.......T c /etc/news/expire.ctl
.......T c /etc/news/incoming.conf
.......T c /etc/news/inn.conf
.......T c /etc/news/innfeed.conf
.......T c /etc/news/innreport.conf
.......T c /etc/news/innwatch.ctl
.......T c /etc/news/moderators
.......T c /etc/news/motd.news
.......T c /etc/news/news2mail.cf
.......T c /etc/news/newsfeeds
.......T c /etc/news/nnrpd.track
.......T c /etc/news/nntpsend.ctl
.......T c /etc/news/ovdb.conf
.......T c /etc/news/overview.fmt
.......T c /etc/news/passwd.nntp
.......T c /etc/news/radius.conf
.......T c /etc/news/readers.conf
.......T c /etc/news/sasl.conf
.......T c /etc/news/send-uucp.cf
.......T c /etc/news/storage.conf
.......T c /etc/news/subscriptions
.......T   /usr/lib/news/bin/actmerge
.......T   /usr/lib/news/bin/actsync
.......T   /usr/lib/news/bin/actsyncd
.......T   /usr/lib/news/bin/auth/passwd/ckpasswd
.......T   /usr/lib/news/bin/auth/passwd/pwcheck
.......T   /usr/lib/news/bin/auth/passwd/radius
.......T   /usr/lib/news/bin/auth/resolv/domain
.......T   /usr/lib/news/bin/auth/resolv/ident
.......T   /usr/lib/news/bin/buffchan
.......T   /usr/lib/news/bin/cnfsheadconf
.......T   /usr/lib/news/bin/cnfsstat
missing    /usr/lib/news/bin/control
missing    /usr/lib/news/bin/control/checkgroups
missing    /usr/lib/news/bin/control/checkgroups.pl
missing    /usr/lib/news/bin/control/default
missing    /usr/lib/news/bin/control/ihave
missing    /usr/lib/news/bin/control/ihave.pl
missing    /usr/lib/news/bin/control/newgroup
missing    /usr/lib/news/bin/control/newgroup.pl
missing    /usr/lib/news/bin/control/rmgroup
missing    /usr/lib/news/bin/control/rmgroup.pl
missing    /usr/lib/news/bin/control/sendme
missing    /usr/lib/news/bin/control/sendme.pl
missing    /usr/lib/news/bin/control/sendsys
missing    /usr/lib/news/bin/control/sendsys.pl
missing    /usr/lib/news/bin/control/senduuname
missing    /usr/lib/news/bin/control/senduuname.pl
missing    /usr/lib/news/bin/control/version
missing    /usr/lib/news/bin/control/version.pl
.......T   /usr/lib/news/bin/controlbatch
.......T   /usr/lib/news/bin/controlchan
.......T   /usr/lib/news/bin/convdate
.......T   /usr/lib/news/bin/convertspool
.......T   /usr/lib/news/bin/ctlinnd
.......T   /usr/lib/news/bin/dbprocs
.......T   /usr/lib/news/bin/expirerm
.......T   /usr/lib/news/bin/filechan
.......T c /usr/lib/news/bin/filter/INN.py
.......T c /usr/lib/news/bin/filter/filter.tcl
.......T c /usr/lib/news/bin/filter/filter_innd.pl
.......T c /usr/lib/news/bin/filter/filter_innd.py
.......T c /usr/lib/news/bin/filter/filter_nnrpd.pl
.......T c /usr/lib/news/bin/filter/nnrpd_auth.pl
.......T c /usr/lib/news/bin/filter/nnrpd_auth.py
.......T c /usr/lib/news/bin/filter/startup.tcl
.......T c /usr/lib/news/bin/filter/startup_innd.pl
.......T   /usr/lib/news/bin/findmissing.pl
.......T   /usr/lib/news/bin/getlist
.......T   /usr/lib/news/bin/gpgverify
.M.....T   /usr/lib/news/bin/inews
.......T   /usr/lib/news/bin/inncheck
.......T   /usr/lib/news/bin/innconfval
.M.....T   /usr/lib/news/bin/inndstart
.......T   /usr/lib/news/bin/innmail
.......T   /usr/lib/news/bin/innreport
.......T   /usr/lib/news/bin/innstat
.......T   /usr/lib/news/bin/innwatch
.......T   /usr/lib/news/bin/innxbatch
.......T   /usr/lib/news/bin/mailpost
.......T   /usr/lib/news/bin/makedbz
.......T   /usr/lib/news/bin/mod-active
.......T   /usr/lib/news/bin/news.daily
.......T   /usr/lib/news/bin/news2mail
.......T   /usr/lib/news/bin/newsrequeue
.......T   /usr/lib/news/bin/nntpget
.......T   /usr/lib/news/bin/nntpsend
.......T   /usr/lib/news/bin/ovdb_recover
.......T   /usr/lib/news/bin/parsecontrol
.......T   /usr/lib/news/bin/pgpverify
.......T   /usr/lib/news/bin/procbatch
.......T   /usr/lib/news/bin/prunehistory
.......T   /usr/lib/news/bin/pullnews
.......T   /usr/lib/news/bin/rc.news
.M.....T   /usr/lib/news/bin/rnews
.......T   /usr/lib/news/bin/rnews.libexec/c7unbatch
.......T   /usr/lib/news/bin/rnews.libexec/decode
.......T   /usr/lib/news/bin/rnews.libexec/encode
.......T   /usr/lib/news/bin/rnews.libexec/gunbatch
.......T   /usr/lib/news/bin/scanlogs
.......T   /usr/lib/news/bin/scanspool
.......T   /usr/lib/news/bin/send-ihave
.......T   /usr/lib/news/bin/send-nntp
.......T   /usr/lib/news/bin/sendxbatches
.......T   /usr/lib/news/bin/shlock
.......T   /usr/lib/news/bin/shrinkfile
.......T   /usr/lib/news/bin/signcontrol
.......T   /usr/lib/news/bin/simpleftp
.M.....T   /usr/lib/news/bin/startinnfeed
.......T   /usr/lib/news/bin/tally.control
.......T   /usr/lib/news/bin/writelog
.......T   /usr/lib/news/lib/docheckgroups
.......T   /usr/lib/news/lib/innshellvars
.......T   /usr/lib/news/lib/innshellvars.pl
.......T   /usr/lib/news/lib/innshellvars.tcl
..5....T   /usr/lib/news/lib/libinn.a
.......T c /var/lib/news/active
.......T c /var/lib/news/active.times
.......T c /var/lib/news/history
.......T c /var/lib/news/history.dir
.......T c /var/lib/news/history.pag
.......T c /var/lib/news/newsgroups
missing    /var/log/news/news
.M......   /var/log/news/news.crit
.M......   /var/log/news/news.err
.M......   /var/log/news/news.notice
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),14(uucp),15(shadow),16(dialout),17(audio),65533(nobody),65534(nogroup)
# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/bin/bash
daemon:x:2:2:Daemon:/sbin:/bin/bash
lp:x:4:7:Printing daemon:/var/spool/lpd:/bin/bash
mail:x:8:12:Mailer daemon:/var/spool/clientmqueue:/bin/false
games:x:12:100:Games account:/var/games:/bin/bash
at:x:25:25:Batch jobs daemon:/var/spool/atjobs:/bin/bash
postgres:x:26:2:Postgres database admin:/var/lib/pgsql:/bin/bash
mdom:x:28:28:Mailing list agent:/usr/lib/majordomo:/bin/bash
wwwrun:x:30:65534:WWW daemon apache:/var/lib/wwwrun:/bin/bash
squid:x:31:65534:WWW proxy squid:/var/squid:/bin/bash
fax:x:33:14:Facsimile agent:/var/spool/fax:/bin/bash
gnats:x:34:65534:Gnats GNU backtracking system:/usr/lib/gnats:/bin/bash
adabas:x:36:100:Adabas-D database admin:/usr/lib/adabas:/bin/bash
amanda:x:37:6:Amanda admin:/var/lib/amanda:/bin/bash
irc:x:39:65534:IRC daemon:/usr/lib/ircd:/bin/bash
ftp:x:40:2:FTP account:/usr/local/ftp:/bin/bash
firewall:x:41:31:Firewall account:/var/lib/firewall:/bin/false
named:x:44:44:Nameserver daemon:/var/named:/bin/bash
fnet:x:49:14:FidoNet account:/var/spool/fnet:/bin/bash
gdm:x:50:15:Gnome Display Manager daemon:/var/lib/gdm:/bin/bash
postfix:x:51:51:Postfix daemon:/var/spool/postfix:/bin/false
cyrus:x:96:12:IMAP daemon:/usr/lib/cyrus:/bin/bash
oracle:x:59:54:Oracle database admin:/opt/oracle:/bin/bash
mysql:x:60:2:MySQL database admin:/var/lib/mysql:/bin/false
dpbox:x:61:56:DpBox account:/var/spool/dpbox:/bin/false
ingres:x:62:3:Ingres database admin:/opt/tngfw/ingres:/bin/bash
zope:x:64:2:Zope daemon:/var/lib/zope:/bin/false
vscan:x:65:65534:Vscan account:/var/spool/vscan:/bin/false
wnn:x:66:100:Wnn system account:/var/lib/wnn:/bin/false
pop:x:67:100:POP admin:/var/lib/pop:/bin/false
perforce:x:68:60:Perfoce admin:/var/lib/perforce:/bin/false
sapdb:x:69:61:SAPDB demo account:/var/opt/sapdb:/bin/bash
db4web:x:70:100:DB4Web account:/opt/db4web:/bin/bash
nobody:x:65534:65533:nobody:/var/lib/nobody:/bin/bash
robert:x:500:100:Robert Schelander:/home/robert:/bin/bash
man:x:13:62:Manual pages viewer:/var/cache/man:/bin/bash
news:x:9:13:News system:/etc/news:/bin/bash
sshd:x:74:65:SSH daemon:/var/lib/sshd:/bin/false
uucp:x:10:14:Unix-to-Unix CoPy system:/etc/uucp:/bin/bash
#
just assigned points to all that tried to help
maybe there is no solution because file system was corrupt
the system was not worth to invest too much time