This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: [Bug Cygwin Applications/575] Unknown HZ value! message from procps commands


Chris January schrieb:
Volker Zell writes:
Chris January writes:
   >> In both cases what is the actual value of HZ you are seeing?
   > 01:02 AM [555]> w
   > Unknown HZ value! (483) Assume 100.

That's unrelated, but interesting, because I got rooted yesterday on some linux box (a new t0rnkit with some libsh), which had some libproc hack (process hiding), which led to the same error message on the procps utils.
"Unknown HZ value! (11) Assume 100"


At least it was very easy to fix without reinstall. ttyload got hijacked (right after mingetty loading). rootkit in /usr/lib/libsh (hidden of course). But he forgot to hijack lsof. So lsof|grep LISTEN showed the intruder.
--
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]