[TriLUG] Suspicious behavior: have I been hacked?

[Mike M]

On Sunday 23 February 2003 21:48, Andrew Perrin wrote:
>
> The other thing in the ps listing were several (three I think) instances
> of:
>
> modprobe -s -k -- net-pf-10
>
> I do not have such a module, either loaded or available on the disk.

Kernel was trying to use IPv6. 

-s, --syslog
Report  via  syslog  instead  of  stderr.  This options will automatically be 
sent to insmod.

-k, --autoclean
Set 'autoclean' on loaded modules.  Used by the kernel when it calls on  
modprobe  to satisfy  a  missing  feature (supplied as a module).  The -q 
option is implied by -k. These options will automatically be sent to insmod.

 -q, --quiet
Do not complain about insmod failing to install a module.  Continue  as  
normal,  but silently,   with  other  possibilities  for  modprobe  to  test. 
This  option  will automatically be sent to insmod.

There were some powerful storms this weekend.  Could a power transient 
explain the half-hung state?  I found my machines took a power  cycle this 
weekend while I was away for a couple of hours.
-- 
Mike M.