just logged into my root account to install a program, and my software FOLDER hs gone, and an executable file 'software' has appeared with a file size of 1778301, with full permissions. i havent run this executable. i installed an online multiplayer game a few days ago, but that was in my limited user account, but something definatley isnt right.

would it be 'safe' to copy this 'software' executable over to a new user account and run it, to see what happens? or should i just get rid of it?

Run the command "file software" to see what kind of file it is.

Report the output back here.

Forrest

doing file software says bzip2 compressed data, block size =900k

OK, I'm guessing it is a zipped up version of your software folder. Hard to tell what is inside without unzipping it. Run:
[code]
bzip2 -dvk software
file software.out
[code]

Report the output back here.

Forrest

And you might type:
last
to see who and when the last logins were on your server. Comes in handy at times like these.

it says its a tar archive.

i also did last, but there were alot of logins that day as root and normal user which i remember doing, so i cant really tell.

If you suspected foul-play, then the last thing you should have done was to start playing-around with the suspicious (and possibly malicious) file. Getting rid of it would have been a bad idea too, as it's valuable evidence. A better approach would have been to firewall the box and start performing a basic inspection. I'm assuming you don't have an IDS installed, but if you do, you should bust-out the signatures and run a scan from a live CD once your inspection results have been recorded on separate media. Hopefully you haven't been owned (and you ascertain the origin of the file), and this will be no more than a wake-up call.

At least nothing is out of the ordinary. So hopefully no one was able to get in.
You can also view the root history file to see all the commands that were recently run.

more /root/.bash_history

ls -l of the suspect file will tell you the time & date it was created. That could also be a big clue.

win32sux, im not really very experienced with security at the moment unfortunately, but something has definately happened, and its since i played the online game.

ill check on that, DotHQ.

*EDIT* i cant see anything suspicious in the root .bash_profile

the 'software' file seems to have been created today march 19 at 16:51, which if i remember was around the time i logged in.

win32sux, the commands I had jukebox55 run didn't do anything to the suspected file. It should still be there in an unaltered state. And, at this point I'm pretty sure it is NOT a case of hacking (cracking).

Here is what I suspect happened. A tar of the software directory was created by some command that involved tar being piped to bzip2 but wasn't formatted in the proper way which resulted in the software directory being removed and this tarball created.

If you run the command:
I would bet you will see the former contents of your software directory being listed.

Were you playing around w/ bzip2 or tar sometime today?

Forrest

forrestt, your right, i think what happened was i had a new program in bzip format i wanted to install, but it was on my pendrive, so i logged into the root account, mounted the drive, then tried to mv the file into the root/software folder, but something must have happened.

when i did

'tar -tvf software.tar' it was indeed the name of the program that was on the pendrive.

i feel a bit dumb now lol. thankfully it wasnt something bad , although ive lost the 'software' folder and its contents, it doesnt matter too much.

this has taught me to start building my programs as a normal user in a safe user folder using su!

thanks forrestt, DotHQ, and win32sux. nice to know u people are around if/WHEN noobs like me screw thing up

If at some point you ran "cp /pendrive/filename.tar.bz2 /root/software" and it created a file called software in /root, then you already lost your software folder BEFORE that command was run.

You'll have to think back and determine if you had removed your software directory (or moved it somewhere else).

Good luck.

Forrest

im pretty sure i didnt move the software directory. and you know whats funny, i remember glancing at the fortune message you get on log in and it said something like "we came, we conquered, we deleted your files", so i dont know what to think.

im gonna reformat and start again.