<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2604" name=GENERATOR></HEAD>
<BODY>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> fedora-list-bounces@redhat.com
[mailto:fedora-list-bounces@redhat.com] <B>On Behalf Of </B>Marc
M<BR><B>Sent:</B> Thursday, April 14, 2005 1:38 PM<BR><B>To:</B> For users of
Fedora Core releases<BR><B>Subject:</B> Re: Network
problems<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>Are the lights on, on the switch's ports that you are using?
Have you rebooted the switch? Are you able to connect with other
machines or ports (say a laptop)? Is the light working on the
nic? Cabling good? If you have multiple nics you should stop/start
them and see if you can get one to work, sometimes one works when another
won't. service network stop, ifup eth0, ifup eth1, etc. Look
at your dmesg and see whether it finds your eth0 or eth1, that'd be nice to
know....<BR><BR>If you are able to narrow it down to the one FC2 box (and
within the os), then I would say that lastly you should run a chkrootkit
utility on the box to see if you have been own3d. <BR><SPAN
class=871574118-14042005><FONT face=Arial color=#0000ff
size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=871574118-14042005><FONT face=Arial color=#0000ff size=2>I
ran chrootkit and I found this:</FONT></SPAN></DIV>
<DIV><SPAN class=871574118-14042005></SPAN> </DIV>
<DIV><SPAN class=871574118-14042005><FONT face=Arial color=#0000ff
size=2>Checking `bindshell'... INFECTED (PORTS: 1524 31337)<BR>Checking
`lkm'... You have 12 process hidden for readdir
command<BR>You have 12 process hidden for ps
command<BR>Warning: Possible LKM Trojan installed</FONT></SPAN></DIV>
<DIV><SPAN class=871574118-14042005></SPAN><SPAN
class=871574118-14042005><FONT face=Arial color=#0000ff
size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=871574118-14042005><FONT face=Arial color=#0000ff size=2>This
looks like a problem!! What is bindshell? I did a locate but could
not find it installed. What do I need to do? </FONT></SPAN></DIV>
<DIV><SPAN class=871574118-14042005></SPAN> </DIV>
<DIV><SPAN class=871574118-14042005><FONT face=Arial color=#0000ff
size=2>TIA</FONT> </SPAN><BR>Cheers<BR>Marc<BR><BR><BR></DIV>
<DIV><SPAN class=gmail_quote>On 4/14/05, <B class=gmail_sendername>Thomas E.
Dukes</B> <<A href="mailto:edukes@alltel.net">edukes@alltel.net</A>>
wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Hello,<BR><BR>This
is strange! I don't even know where to
start. Everything was working<BR>fine until yesterday about
1:00PM.<BR><BR>I am running a FC2 system. I have a dynamic ip
using ddclient to update. I<BR>run ifconfig and I have an ip
address. I can ping it with no problem. I <BR>can ping
other internal hosts. My ip is current with my dynamic
dns<BR>provider.<BR><BR>I have changed out network cards and even bought a
new switch. Still no<BR>internet connectivity. DSL
modem works fine as it is currently connected to <BR>this PC. So its not an
ISP or modem problem.<BR><BR>I have not updated any packages since
04-01-05. I have been out of town ten<BR>days and was able to
access my server remotely, even yesterday morning. I<BR>have made no changes
to any files. Internet connectivity just stopped. <BR><BR>Any
ideas where to begin? I have been looking over logs and don't
see<BR>anything wrong.<BR><BR>TIA<BR><BR>--<BR>fedora-list mailing
list<BR><A
href="mailto:fedora-list@redhat.com">fedora-list@redhat.com</A><BR>To
unsubscribe: <A
href="http://www.redhat.com/mailman/listinfo/fedora-list">http://www.redhat.com/mailman/listinfo/fedora-list</A><BR></BLOCKQUOTE></DIV><BR></BLOCKQUOTE></BODY></HTML>