Newsgroup: it.comp.os.linux.sys
Titolo: Vorrei chiedervi un consiglio .... da navigatore che vuole giustizia !!!!!

Ciao a tutti,
intanto mi scuso sulle dimensioni del msg che ho lasciato sul
newsgroup, ma penso che sia per una giusta causa.
Al Lunedė mattina mi sono ritrovato nel mio ufficio il pc con linux
redhat 6.2 direi svaccato !!!!
Io non sono esperto di linux e sulla sua sicurezza, comunque ho
installato un pc con linux ed era config. per stare connessa 24 ore su
24 in internet tramite aruba (tariffa flat ISDN). E penso, guardando i
log qui sotto, che uno stronzo, se cosė si puō definire si č loggato
con ftp e mi abbia svaccato in qualche modo il kernel.
Chiedo, agli esperti, se mi possono confermare la mia teoria e se mi
sanno dire cosa ha fatto per causare questi problemi.
Poi vi chiedo se l'indirizzo ip che compare al login possa essere del
diretto responsabile e se ci sia la maniera di poter effettuare una
denuncia del fatto accaduto alle autoritā competenti o se non ci sia
niente da fare ....
Con la speranza che qualcuno la pensi come me accetto consigli e
risposte  .....
Feb 17 10:11:02 localhost ftpd[6766]: ANONYMOUS FTP LOGIN FROM
57.66.144.66 [57.66.144.66],
??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1Ā1Û1É°FÍ?1Ā1ÛC?ŲA°?Í?ëk^1Ā1É?^^A^F^Dfđĸ^A°'Í?1Ā?^^A°=Í?1Ā1Û?^^H?C^B1ÉþÉ1Ā?^^H°^LÍ?þÉuó1Ā^F^I?^^H°=Í?þ^N°0þČ^F^D1Ā^F^G?v^H?F^L?ó?N^H?V^L°^KÍ?1Ā1Û°^AÍ?č?ĸĸĸ0bin0sh1..11
Feb 17 10:11:02 localhost ftpd[6766]: FTP session closed
Feb 17 11:11:47 localhost rpc.statd[374]: gethostbyname error for
^Xũĸŋ^Xũĸŋ^Yũĸŋ^Yũĸŋ^Zũĸŋ^Zũĸŋ^[ũĸŋ^[ũĸŋbffff750 8049710
8052c30687465676274736f6d616e797265206520726f7220726f66
bffff718
bffff719  bffff71a
bffff71b?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Feb 17 11:11:52 localhost inetd[512]: auth/tcp: bind: Address already
in use
Feb 17 11:16:16 localhost kernel: eth0: Promiscuous mode enabled. 
Feb 17 11:21:52 localhost inetd[512]: auth/tcp: bind: Address already
in use
Feb 17 11:31:24 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:31:46 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:31:52 localhost inetd[512]: auth/tcp: bind: Address already
in use
Feb 17 11:36:11 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:40:50 localhost last message repeated 2 times
Feb 17 11:41:02 localhost last message repeated 2 times
Feb 17 11:41:52 localhost inetd[512]: auth/tcp: bind: Address already
in use
Feb 17 11:50:21 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:51:52 localhost inetd[512]: auth/tcp: bind: Address already
in use
Feb 17 11:53:25 localhost init: Switching to runlevel: 6
Feb 17 11:53:26 localhost rc: Stopping keytable succeeded
Feb 17 11:53:27 localhost Font Server[700]: terminating 
Feb 17 11:53:27 localhost xfs: xfs shutdown succeeded
Feb 17 11:53:28 localhost gpm: gpm shutdown succeeded
Feb 17 11:53:33 localhost httpd: httpd shutdown succeeded
Feb 17 11:53:33 localhost sendmail: sendmail shutdown succeeded
Feb 17 11:53:33 localhost inet: inetd shutdown succeeded
Feb 17 11:53:34 localhost atd: atd shutdown succeeded
Feb 17 11:53:34 localhost crond: crond shutdown succeeded
Feb 17 11:53:35 localhost lpd: lpd shutdown succeeded
Feb 17 11:53:35 localhost identd: identd shutdown succeeded
Feb 17 11:56:36 localhost syslogd 1.3-3: restart.
Feb 17 11:56:36 localhost syslog: syslogd startup succeeded
Feb 17 11:56:36 localhost syslog: klogd startup succeeded
Feb 17 11:56:36 localhost kernel: klogd 1.3-3, log source = /proc/kmsg
started.
Feb 17 11:56:36 localhost kernel: Inspecting
/boot/System.map-2.2.14-5.0
Feb 17 11:56:36 localhost kernel: Loaded 7364 symbols from
/boot/System.map-2.2.14-5.0.
Feb 17 11:56:36 localhost kernel: Symbols match kernel version 2.2.14.
Feb 17 11:56:36 localhost kernel: No module symbols loaded.
Feb 17 11:56:36 localhost kernel: Linux version 2.2.14-5.0
(
ro...@porky.devel.redhat.com
) (gcc version egcs-2.91.66 19990314/Linux
(egcs-1.1.2 release)) #1 Tue Mar 7 21:07:39 EST 2000 
Feb 17 11:56:36 localhost kernel: Detected 350799493 Hz processor. 
Feb 17 11:56:36 localhost kernel: Console: colour VGA+ 80x25 
Feb 17 11:56:36 localhost kernel: Calibrating delay loop... 349.80
BogoMIPS 
Feb 17 11:56:36 localhost kernel: Memory: 127852k/131008k available
(1060k kernel code, 416k reserved, 1616k data, 64k init, 0k bigmem) 
Feb 17 11:56:36 localhost kernel: Dentry hash table entries: 262144
(order 9, 2048k) 
Feb 17 11:56:36 localhost kernel: Buffer cache hash table entries:
131072 (order 7, 512k) 
Feb 17 11:56:36 localhost kernel: Page cache hash table entries: 32768
(order 5, 128k) 
Feb 17 11:56:36 localhost kernel: VFS: Diskquotas version dquot_6.4.0
initialized 
Feb 17 11:56:36 localhost kernel: CPU: Intel Pentium II (Deschutes)
stepping 02 
Feb 17 11:56:36 localhost kernel: Enabling extended fast FPU save and
restore...done. 
Feb 17 11:56:36 localhost kernel: Checking 386/387 coupling... OK, FPU
using exception 16 error reporting. 
Feb 17 11:56:36 localhost kernel: Checking 'hlt' instruction... OK. 
Feb 17 11:56:36 localhost kernel: POSIX conformance testing by UNIFIX 
Feb 17 11:56:36 localhost kernel: mtrr: v1.35a (19990819) Richard
Gooch (
rgo...@atnf.csiro.au
) 
Feb 17 11:56:36 localhost kernel: PCI: PCI BIOS revision 2.10 entry at
0xf0720 
Feb 17 11:56:36 localhost kernel: PCI: Using configuration type 1 
Feb 17 11:56:36 localhost kernel: PCI: Probing PCI hardware 
Feb 17 11:56:36 localhost kernel: Linux NET4.0 for Linux 2.2 
Feb 17 11:56:36 localhost kernel: Based upon Swansea University
Computer Society NET3.039 
Feb 17 11:56:36 localhost kernel: NET4: Unix domain sockets 1.0 for
Linux NET4.0. 
Feb 17 11:56:36 localhost kernel: NET4: Linux TCP/IP 1.0 for NET4.0 
Feb 17 11:56:36 localhost kernel: IP Protocols: ICMP, UDP, TCP, IGMP 
Feb 17 11:56:36 localhost kernel: TCP: Hash tables configured (ehash
131072 bhash 65536) 
Feb 17 11:56:36 localhost kernel: Initializing RT netlink socket 
Feb 17 11:56:36 localhost kernel: Starting kswapd v 1.5  
Feb 17 11:56:36 localhost kernel: Detected PS/2 Mouse Port. 
Feb 17 11:56:36 localhost kernel: Serial driver version 4.27 with
MANY_PORTS MULTIPORT SHARE_IRQ enabled 
Feb 17 11:56:36 localhost kernel: ttyS00 at 0x03f8 (irq = 4) is a
16550A 
Feb 17 11:56:36 localhost kernel: ttyS01 at 0x02f8 (irq = 3) is a
16550A 
Feb 17 11:56:36 localhost kernel: pty: 256 Unix98 ptys configured 
Feb 17 11:56:36 localhost kernel: apm: BIOS version 1.2 Flags 0x03
(Driver version 1.9) 
Feb 17 11:56:36 localhost kernel: Real Time Clock Driver v1.09 
Feb 17 11:56:36 localhost kernel: RAM disk driver initialized:  16 RAM
disks of 4096K size 
Feb 17 11:56:36 localhost kernel: PIIX4: IDE controller on PCI bus 00
dev 21 
Feb 17 11:56:36 localhost kernel: PIIX4: not 100% native mode: will
probe irqs later 
Feb 17 11:56:36 localhost kernel:     ide0: BM-DMA at 0xb800-0xb807,
BIOS settings: hda:DMA, hdb:pio 
Feb 17 11:56:36 localhost kernel:     ide1: BM-DMA at 0xb808-0xb80f,
BIOS settings: hdc:pio, hdd:DMA 
Feb 17 11:56:36 localhost kernel: hda: QUANTUM FIREBALLlct10 10, ATA
DISK drive 
Feb 17 11:56:36 localhost kernel: hdd: ATAPI CDROM, ATAPI CDROM drive 
Feb 17 11:56:36 localhost kernel: ide0 at 0x1f0-0x1f7,0x3f6 on irq 14 
Feb 17 11:56:36 localhost kernel: ide1 at 0x170-0x177,0x376 on irq 15 
Feb 17 11:56:36 localhost kernel: hda: QUANTUM FIREBALLlct10 10,
9787MB w/418kB Cache, CHS=1247/255/63 
Feb 17 11:56:36 localhost kernel: hdd: ATAPI 0X CD-ROM drive, 128kB
Cache 
Feb 17 11:56:36 localhost kernel: Uniform CDROM driver Revision: 2.56 
Feb 17 11:56:36 localhost kernel: Floppy drive(s): fd0 is 1.44M 
Feb 17 11:56:36 localhost kernel: FDC 0 is a post-1991 82077 
Feb 17 11:56:36 localhost kernel: md driver 0.90.0 MAX_MD_DEVS=256,
MAX_REAL=12 
Feb 17 11:56:36 localhost kernel: raid5: measuring checksumming speed 
Feb 17 11:56:36 localhost kernel: raid5: MMX detected, trying
high-speed MMX checksum routines 
Feb 17 11:56:36 localhost kernel:    pII_mmx   :   815.340 MB/sec 
Feb 17 11:56:36 localhost kernel:    p5_mmx    :   865.251 MB/sec 
Feb 17 11:56:36 localhost kernel:    8regs     :   603.123 MB/sec 
Feb 17 11:56:36 localhost kernel:    32regs    :   343.662 MB/sec 
Feb 17 11:56:36 localhost kernel: using fastest function: p5_mmx
(865.251 MB/sec) 
Feb 17 11:56:36 localhost kernel: scsi : 0 hosts. 
Feb 17 11:56:36 localhost kernel: scsi : detected total. 
Feb 17 11:56:36 localhost kernel: md.c: sizeof(mdp_super_t) = 4096 
Feb 17 11:56:36 localhost kernel: Partition check: 
Feb 17 11:56:36 localhost kernel:  hda: hda1 hda2 < hda5 hda6 hda7
hda8 hda9 hda10 hda11 hda12 > 
Feb 17 11:56:36 localhost kernel: autodetecting RAID arrays 
Feb 17 11:56:36 localhost kernel: autorun ... 
Feb 17 11:56:36 localhost kernel: ... autorun DONE. 
Feb 17 11:56:36 localhost kernel: VFS: Mounted root (ext2 filesystem)
readonly. 
Feb 17 11:56:36 localhost kernel: Freeing unused kernel memory: 64k
freed 
Feb 17 11:56:36 localhost kernel: Adding Swap: 1052216k swap-space
(priority -1) 
Feb 17 11:56:36 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:56:36 localhost kernel: lpsched uses obsolete
(PF_INET,SOCK_PACKET) 
Feb 17 11:56:36 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:56:36 localhost kernel: current->tss.cr3 = 07847000, %cr3 =
07847000 
Feb 17 11:56:36 localhost kernel: *pde = 00000000 
Feb 17 11:56:36 localhost kernel: Oops: 0000 
Feb 17 11:56:36 localhost kernel: CPU:    0 
Feb 17 11:56:36 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:56:36 localhost kernel: EFLAGS: 00010203 
Feb 17 11:56:36 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 0806c609 
Feb 17 11:56:36 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c7f91f8c 
Feb 17 11:56:36 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:56:36 localhost kernel: Process modprobe (pid: 514, process
nr: 98, stackpage=c7f91000) 
Feb 17 11:56:36 localhost kernel: Stack: bfffed2c bfffece4 c01db4e8
00000001 c01166e6 0806c609 000000ff bfffed2c  
Feb 17 11:56:36 localhost kernel:        c7f90000 00000100 bfffed2c
bfffece4 c7f90000 c010a0d4 00000000 00000001  
Feb 17 11:56:36 localhost kernel:        0806c608 00000100 bfffed2c
bfffece4 000000a7 c01d002b 0000002b 000000a7  
Feb 17 11:56:36 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56] [FPU_sub+673/960]  
Feb 17 11:56:36 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:56:36 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:56:36 localhost kernel: current->tss.cr3 = 022f6000, %cr3 =
022f6000 
Feb 17 11:56:36 localhost kernel: *pde = 00000000 
Feb 17 11:56:36 localhost kernel: Oops: 0000 
Feb 17 11:56:36 localhost kernel: CPU:    0 
Feb 17 11:56:36 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:56:36 localhost kernel: EFLAGS: 00010203 
Feb 17 11:56:36 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 0806c609 
Feb 17 11:56:36 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c7971f8c 
Feb 17 11:56:36 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:56:36 localhost kernel: Process modprobe (pid: 541, process
nr: 96, stackpage=c7971000) 
Feb 17 11:56:36 localhost kernel: Stack: bfffed2c bfffece4 c01db4e8
00000001 c01166e6 0806c609 000000ff bfffed2c  
Feb 17 11:56:36 localhost kernel:        c7970000 00000100 bfffed2c
bfffece4 c7970000 c010a0d4 00000000 00000001  
Feb 17 11:56:36 localhost kernel:        0806c608 00000100 bfffed2c
bfffece4 000000a7 c01d002b 0000002b 000000a7  
Feb 17 11:56:36 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56] [FPU_sub+673/960]  
Feb 17 11:56:36 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:56:36 localhost identd: identd startup succeeded
Feb 17 11:56:37 localhost atd: atd startup succeeded
Feb 17 11:56:37 localhost crond: crond startup succeeded
Feb 17 11:56:37 localhost rc: Starting pcmcia succeeded
Feb 17 11:56:37 localhost inet: inetd startup succeeded
Feb 17 11:56:38 localhost inetd[688]: auth/tcp: bind: Address already
in use
Feb 17 11:56:38 localhost lpd: lpd startup succeeded
Feb 17 11:56:38 localhost lpd[702]: restarted
Feb 17 11:56:38 localhost keytable: Loading keymap: 
Feb 17 11:56:38 localhost keytable: Loading
/usr/lib/kbd/keymaps/i386/qwerty/it.kmap.gz
Feb 17 11:56:38 localhost keytable: Loading system font: 
Feb 17 11:56:38 localhost rc: Starting keytable succeeded
Feb 17 11:56:39 localhost sendmail: sendmail startup succeeded
Feb 17 11:56:39 localhost gpm: gpm startup succeeded
Feb 17 11:56:42 localhost httpd: httpd startup succeeded
Feb 17 11:56:45 localhost kernel: Unable to load interpreter
/lib/ld-linux.so.2 
Feb 17 11:57:17 localhost last message repeated 19 times
Feb 17 11:57:30 localhost last message repeated 8 times
Feb 17 11:57:31 localhost xfs: xfs startup succeeded
Feb 17 11:57:32 localhost upsd[10380]: *** PowerChute PLUS Version
4.5.2.1 (glibc) Started ***
Feb 17 11:57:35 localhost upsd: PowerChute Plus for UNIX, v4.5.2.1
(glibc): Copyright (c) 2000, American Power Conversion succeeded
Feb 17 11:57:36 localhost linuxconf: Linuxconf final setup
Feb 17 11:57:38 localhost upsd[10380]: Communication established
Feb 17 11:57:39 localhost rc: Starting linuxconf succeeded
Feb 17 11:57:39 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:57:39 localhost kernel: current->tss.cr3 = 032e8000, %cr3 =
032e8000 
Feb 17 11:57:39 localhost kernel: *pde = 00000000 
Feb 17 11:57:39 localhost kernel: Oops: 0000 
Feb 17 11:57:39 localhost kernel: CPU:    0 
Feb 17 11:57:39 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:57:39 localhost kernel: EFLAGS: 00010203 
Feb 17 11:57:39 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 080719c1 
Feb 17 11:57:39 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c0943f8c 
Feb 17 11:57:39 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:57:39 localhost kernel: Process depmod (pid: 10681, process
nr: 71, stackpage=c0943000) 
Feb 17 11:57:39 localhost kernel: Stack: bfff5f84 bfff5f3c c01db4e8
00000001 c01166e6 080719c1 000000ff bfff5f84  
Feb 17 11:57:39 localhost kernel:        c0942000 00000100 bfff5f84
bfff5f3c c0943fc4 c010a0d4 00000000 00000001  
Feb 17 11:57:39 localhost kernel:        080719c0 00000100 bfff5f84
bfff5f3c 000000a7 0000002b 0000002b 000000a7  
Feb 17 11:57:39 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56]  
Feb 17 11:57:39 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:57:39 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:57:39 localhost kernel: current->tss.cr3 = 032e8000, %cr3 =
032e8000 
Feb 17 11:57:39 localhost kernel: *pde = 00000000 
Feb 17 11:57:39 localhost kernel: Oops: 0000 
Feb 17 11:57:39 localhost kernel: CPU:    0 
Feb 17 11:57:39 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:57:39 localhost kernel: EFLAGS: 00010203 
Feb 17 11:57:39 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 0806c609 
Feb 17 11:57:39 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c0943f8c 
Feb 17 11:57:39 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:57:39 localhost kernel: Process modprobe (pid: 10682,
process nr: 71, stackpage=c0943000) 
Feb 17 11:57:39 localhost kernel: Stack: bfffec2c bfffebe4 c01db4e8
00000001 c01166e6 0806c609 000000ff bfffec2c  
Feb 17 11:57:39 localhost kernel:        c0942000 00000100 bfffec2c
bfffebe4 c0942000 c010a0d4 00000000 00000001  
Feb 17 11:57:39 localhost kernel:        0806c608 00000100 bfffec2c
bfffebe4 000000a7 0000002b 0000002b 000000a7  
Feb 17 11:57:39 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56]  
Feb 17 11:57:39 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:57:40 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:57:40 localhost kernel: current->tss.cr3 = 027e3000, %cr3 =
027e3000 
Feb 17 11:57:40 localhost kernel: *pde = 00000000 
Feb 17 11:57:40 localhost kernel: Oops: 0000 
Feb 17 11:57:40 localhost kernel: CPU:    0 
Feb 17 11:57:40 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:57:40 localhost kernel: EFLAGS: 00010203 
Feb 17 11:57:40 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 0806c609 
Feb 17 11:57:40 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c7b51f8c 
Feb 17 11:57:40 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:57:40 localhost kernel: Process modprobe (pid: 10703,
process nr: 7, stackpage=c7b51000) 
Feb 17 11:57:40 localhost kernel: Stack: bfffed2c bfffece4 c01db4e8
00000001 c01166e6 0806c609 000000ff bfffed2c  
Feb 17 11:57:40 localhost kernel:        c7b50000 00000100 bfffed2c
bfffece4 c7b50000 c010a0d4 00000000 00000001  
Feb 17 11:57:40 localhost kernel:        0806c608 00000100 bfffed2c
bfffece4 000000a7 c01d002b 0000002b 000000a7  
Feb 17 11:57:40 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56] [FPU_sub+673/960]  
Feb 17 11:57:40 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:57:40 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 11:57:40 localhost kernel: current->tss.cr3 = 027e3000, %cr3 =
027e3000 
Feb 17 11:57:40 localhost kernel: *pde = 00000000 
Feb 17 11:57:40 localhost kernel: Oops: 0000 
Feb 17 11:57:40 localhost kernel: CPU:    0 
Feb 17 11:57:40 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 11:57:40 localhost kernel: EFLAGS: 00010203 
Feb 17 11:57:40 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 0806c609 
Feb 17 11:57:40 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c7b51f8c 
Feb 17 11:57:40 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 11:57:40 localhost kernel: Process modprobe (pid: 10704,
process nr: 7, stackpage=c7b51000) 
Feb 17 11:57:40 localhost kernel: Stack: bfffed2c bfffece4 c01db4e8
00000001 c01166e6 0806c609 000000ff bfffed2c  
Feb 17 11:57:40 localhost kernel:        c7b50000 00000100 bfffed2c
bfffece4 c7b50000 c010a0d4 00000000 00000001  
Feb 17 11:57:40 localhost kernel:        0806c608 00000100 bfffed2c
bfffece4 000000a7 c01d002b 0000002b 000000a7  
Feb 17 11:57:40 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56] [FPU_sub+673/960]  
Feb 17 11:57:40 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7  
Feb 17 11:57:40 localhost pppd[10693]: ioctl(TIOCSETD(PPP)): Invalid
argument(22)
Feb 17 11:57:40 localhost pppd[10693]: This system lacks kernel
support for PPP.  This could be because the PPP kernel module could
not be loaded, or because PPP was not included in the kernel
configuration.  If PPP was included as a module, try `/sbin/modprobe
-v ppp'.  If that fails, check t
Feb 17 12:00:00 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000008 
Feb 17 12:00:00 localhost kernel: current->tss.cr3 = 032e8000, %cr3 =
032e8000 
Feb 17 12:00:00 localhost kernel: *pde = 00000000 
Feb 17 12:00:00 localhost kernel: Oops: 0000 
Feb 17 12:00:00 localhost kernel: CPU:    0 
Feb 17 12:00:00 localhost kernel: EIP:    0010:[qm_modules+31/203] 
Feb 17 12:00:00 localhost kernel: EFLAGS: 00010203 
Feb 17 12:00:00 localhost kernel: eax: 00000000   ebx: 00000001   ecx:
00000000   edx: 080572e9 
Feb 17 12:00:00 localhost kernel: esi: 00000000   edi: c01db4e9   ebp:
00000001   esp: c0943f8c 
Feb 17 12:00:00 localhost kernel: ds: 0018   es: 0018   ss: 0018 
Feb 17 12:00:00 localhost kernel: Process rmmod (pid: 10708, process
nr: 71, stackpage=c0943000) 
Feb 17 12:00:00 localhost kernel: Stack: bfffede0 bfffed98 c01db4e8
00000001 c01166e6 080572e9 000000ff bfffede0  
Feb 17 12:00:00 localhost kernel:        c0942000 00000100 bfffede0
bfffed98 c7e3b0f8 c010a0d4 00000000 00000001  
Feb 17 12:00:00 localhost kernel:        080572e8 00000100 bfffede0
bfffed98 000000a7 0000002b 0000002b 000000a7  
Feb 17 12:00:00 localhost kernel: Call Trace: [tvecs+1632/16536]
[sys_query_module+256/357] [system_call+52/56]  
Feb 17 12:00:00 localhost kernel: Code: 8b 46 08 89 44 24 10 b9 ff ff
ff ff 89 c7 31 c0 fc f2 ae f7 

niente da fare ....
Puoi provare, ma mi sa che che a sua volta e' un server bucato...
-- 
Every program has two purposes -- one for which it was written and
another for which it wasn't.
Maurizio - Tannoiser
Founder Member of ERLUG (Emilia Romagna Linux User Group)
http://erlug.linux.it

Puoi provare, ma mi sa che che a sua volta e' un server bucato...
Ho capito .....
Grazie per avermi spiegato le modalità di attacco .... e dove ho
sbagliato io
Ciao

 niente da fare ....
Credo tu possa farci poco: quell'indirizzo sara' probabilmente
spoofato perche' a me non risulta nulla ne' con nslookup ne'
tantomeno con Samspade quindi dubito ti possa lamentare con
qualcuno. Molto probabilmente l'amico ha usato un exploit un noto
exploit di wuftpd, inoltre usi anche un kernel vecchio, quindi e'
anche colpa tua. Reinstalla tutto e mettiti l'anima in pace, poi
quando avrai reinstallato ti si spieghera' come premunirti un po'
meglio con appositi tools.
-- 
|Pierluigi De Rosa (
tho...@durin.khazad-dum.net
)|
|     E' nato il Cosenza Linux User Group	|
|   mail -s help 
cslug-...@lists.linux.it
	|
|      IRC: #cslug - 
irc.openprojects.net
	|