01-07-2012
Strange system activity no matter what I try
When I choose to encrypt my drive during a Linux install, it encryps it, but I receive errors in dmesg and in ~/.xsessions-errors during use. The first error is in dmesg where it sometimes shows errors writing to the encypted device. The second error is in ~/.xsessions-errors with an error about writing to a cleartext device With the above errors noted, I've also discovered some strange events:
1. gvfsd-burn running with several instances while I'm not using any burning application
2. The .gvfs directory showing up in ls -l result with question marks, googled and told to enter fusermount -u .gvfs and log out and log back in but this event occurs again I don't know what it's doing this for.
3. When backing up a large amount of files to an external drive, I receive a nautilus popup saying a file has changed, would I like to replace it, when I haven't changed any of the files. Who is doing the changing?
4. Hard disk drive light flashes on and off with a second or two in between the flickers, running top and lsof, and checking logs, I can't find anything causing this activity?
5. Running unhide, which installs with rkhunter, shows several ports open when I'm not using them, I've firewalled most outgoing ports, nothing is listed as using any of these hidden ports.
6. Chkrootkit shows tty7 gnome desktop as being hidden from wtmp.
7. Console-kit-daemon runs several times, cannot pin down why this is.
8. Rkhunter and chkrootkit scans come out as clean, no rootkits or problems found, other than #6 from chkrootkit. What is recommended? It sounds like a rootkit's installed, and when I check binaries with chkrootkit -x command some of the strings sound weird, some binaries contain "mmap, mmove, fork, shell, shell always, fake, anonymous" and more I've wiped the drive and installed several times, these problems continue regardless of my efforts.
When I examined my wiped HDD from an "ultimate boot cd" disk utility, I saw a garbled message followed by "virus detected!" "booting hd1" I wasn't sure if a bad burn of the ubcd was placing it there, or if my BIOS is infected and is the source of the constant re-infection. I scanned my hdd with an antivirus and it discovered memtest+ in a kernel directory was infected, but it didn't elaborate. Even when I install disk without encryption, the hdd light flashes constantly, like someone is doing something, but no extra programs are running except a gnome desktop,
I've even tried smaller window managers but the disk keeps accessing. I'm guessing whatever is running has poisoned certain binaries like ls, ps, who, last, and so on. What is recommended in this condition? Any tips on what could be happening?
6 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hello,
With AIX 5.3 is it possible to run a mksysb with users logged into the system?
The users are accessing a database app that runs on a separate physical disk than the system files. Does this even matter?
Thanks (1 Reply)
Discussion started by: samsa1mi
1 Replies
2. AIX
Hi,
I want to find program's file read,write for a particular time.For example i am executing an application called test1, this will get input from some parameter files(file1,file2,file3) and it will write to some files(file4,file5), so i want to execute one program which will capture these... (3 Replies)
Discussion started by: gnanadurai_it
3 Replies
3. Shell Programming and Scripting
I need to monitor system activity (RAM, CPU usage, execution time)
while running some tests on solaris, linux and aix and save the output.
Please advise whether there's a utility available for these systems?
How can time the execution of the command?
Thanks! (2 Replies)
Discussion started by: smovla
2 Replies
4. Cybersecurity
Has anyone seen or know what is causing this FTP log file line-item?
3 times when I successfully logged into FTP today, the log file shows a server response of a wrong password (530) to an IP address that is not mine... Below are FTP Log-file entries. I have removed my username & IP address:
... (2 Replies)
Discussion started by: bricolage
2 Replies
5. Red Hat
Hi all,
i need to collect all system activities data(processes running, disk details, memory, etc), system logs and things related.
i heard of cfg2html but its not available for my CentOS distro(i may need to install separately but thats not what i wana do).
i can use sar for syatem... (1 Reply)
Discussion started by: ajayyadavmca
1 Replies
6. Infrastructure Monitoring
Hi team ,
I am working on monitoring the solaris machine utilization continously with shell script without using any thirdparty software. I stuck at below commands which are limited to 1000000000 seconds.
CPU Utilization
sar -u 1 1000000000
Disk Utilization
sar -d 1 1000000000
Memory... (4 Replies)
Discussion started by: tarun_nix
4 Replies
DMESG(1) User Commands DMESG(1)
NAME
dmesg - print or control the kernel ring buffer
SYNOPSIS
dmesg [options]
dmesg --clear
dmesg --read-clear [options]
dmesg --console-level level
dmesg --console-on
dmesg --console-off
DESCRIPTION
dmesg is used to examine or control the kernel ring buffer.
The default action is to read all messages from kernel ring buffer.
OPTIONS
The --clear, --read-clear, --console-on, --console-off and --console-level options are mutually exclusive.
-C, --clear
Clear the ring buffer.
-c, --read-clear
Clear the ring buffer contents after printing.
-D, --console-off
Disable printing messages to the console.
-d, --show-delta
Display the timestamp and time delta spent between messages. If used together with --notime then only the time delta without the
timestamp is printed.
-e, --reltime
Display the local time and delta in human readable format.
-E, --console-on
Enable printing messages to the console.
-F, --file file
Read log from file.
-f, --facility list
Restrict output to defined (comma separated) list of facilities. For example
dmesg --facility=daemon
will print messages from system daemons only. For all supported facilities see dmesg --help output.
-H, --human
Enable human readable output. See also --color, --reltime and --nopager.
-h, --help
Print a help text and exit.
-k, --kernel
Print kernel messages.
-L, --color
Colorize important messages.
-l, --level list
Restrict output to defined (comma separated) list of levels. For example
dmesg --level=err,warn
will print error and warning messages only. For all supported levels see dmesg --help output.
-n, --console-level level
Set the level at which logging of messages is done to the console. The level is a level number or abbreviation of the level name.
For all supported levels see dmesg --help output.
For example, -n 1 or -n alert prevents all messages, except emergency (panic) messages, from appearing on the console. All levels
of messages are still written to /proc/kmsg, so syslogd(8) can still be used to control exactly where kernel messages appear. When
the -n option is used, dmesg will not print or clear the kernel ring buffer.
-P, --nopager
Do not pipe output into a pager, the pager is enabled for --human output.
-r, --raw
Print the raw message buffer, i.e., do not strip the log level prefixes.
Note that the real raw format depends on method how dmesg(1) reads kernel messages. The /dev/kmsg uses different format than sys-
log(2). For backward compatibility dmesg(1) returns data always in syslog(2) format. The real raw data from /dev/kmsg is possible
to read for example by command 'dd if=/dev/kmsg iflag=nonblock'.
-S, --syslog
Force to use syslog(2) kernel interface to read kernel messages. The default is to use /dev/kmsg rather than syslog(2) since kernel
3.5.0.
-s, --buffer-size size
Use a buffer of size to query the kernel ring buffer. This is 16392 by default. (The default kernel syslog buffer size was 4096 at
first, 8192 since 1.3.54, 16384 since 2.1.113.) If you have set the kernel buffer to be larger than the default then this option
can be used to view the entire buffer.
-T, --ctime
Print human readable timestamps. The timestamp could be inaccurate!
The time source used for the logs is not updated after system SUSPEND/RESUME.
-t, --notime
Do not print kernel's timestamps.
-u, --userspace
Print userspace messages.
-V, --version
Output version information and exit.
-w, --follow
Wait for new messages. This feature is supported on systems with readable /dev/kmsg only (since kernel 3.5.0).
-x, --decode
Decode facility and level (priority) number to human readable prefixes.
SEE ALSO
syslogd(8)
AUTHORS
Karel Zak <kzak@redhat.com>
Theodore Ts'o <tytso@athena.mit.edu>
AVAILABILITY
The dmesg command is part of the util-linux package and is available from Linux Kernel Archive <ftp://ftp.kernel.org/pub/linux/utils/util-
linux/>.
util-linux July 2012 DMESG(1)