*If* it belongs to a rpm package, running "rpm -qf /lib/.libcrypto.so.0.9.8e.hmac " may provide some info. Be even more suspicious if it does not belong to a package. [by pjwelsh]
on 02/19/2010 – Made popular on 02/19/2010
Today I checked my LAN with nmap and found something strange with my machine:
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.14 ((Ubuntu))
|_ html-title: Site doesn't have a title (text/html).
Why is there apache running? I never ran a web server and it wasn't here before.
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:
I still get it after editing /etc/chkrootkit.conf and adding
If we want to get some idea whether a website (which may arise as a result of web-search) is safe to visit or not, it is sometimes said that "Web of Trust" is useful. However there are conflicting views about its utility. I would like to see what experts in this forum think about it.