被黑了吗？

blackwhite

个人的desktop。一直在线。现在出现这个问题。
用chkrootkit检测，网卡是运行在混杂模式下。用lsattr -a /bin的目录，出现这个结果。

1. 
   
2. s-S-i-dAc---- ./.
   
3. suS-iadAcjI-- ./..
   
4. s-S-i-dAc---- ./dd
   
5. s-S-i-dAc---- ./cp
   
6. s-S-i-dAc---- ./df
   
7. s-S-i-dAc---- ./ed
   
8. s-S-i-dAc---- ./ex
   
9. s-S-i-dAc---- ./ln
   
10. s-S-i-dAc---- ./ls
    
11. s-S-i-dAc---- ./mt
    
12. s-S-i-dAc---- ./mv
    
13. s-S-i-dAc---- ./ps
    
14. s-S-i-dAc---- ./rm
    
15. s-S-i-dAc---- ./sh
    
16. s-S-i-dAc---- ./su
    
17. s-S-i-dAc---- ./vi
    
18. s-S-i-dAc---- ./ash
    
19. s-S-i-dAc---- ./awk
    
20. s-S-i-dAc---- ./cat
    
21. s-S-i-dAc---- ./bsh
    
22. s-S-i-dAc---- ./csh
    
23. s-S-i-dAc---- ./cut
    
24. s-S-i-dAc---- ./env
    
25. s-S-i-dAc---- ./pwd
    
26. s-S-i-dAc---- ./red
    
27. s-S-i-dAc---- ./sed
    
28. s-S-i-dAc---- ./rpm
    
29. s-S-i-dAc---- ./rvi
    
30. s-S-i-dAc---- ./tar
    
31. s-S-i-dAc---- ./bash
    
32. s-S-i-dAc---- ./arch
    
33. s-S-i-dAc---- ./date
    
34. s-S-i-dAc---- ./cpio
    
35. s-S-i-dAc---- ./echo
    
36. s-S-i-dAc---- ./gawk
    
37. s-S-i-dAc---- ./grep
    
38. s-S-i-dAc---- ./gtar
    
39. s-S-i-dAc---- ./gzip
    
40. s-S-i-dAc---- ./kill
    
41. s-S-i-dAc---- ./link
    
42. s-S-i-dAc---- ./mail
    
43. s-S-i-dAc---- ./more
    
44. s-S-i-dAc---- ./nice
    
45. s-S-i-dAc---- ./ping
    
46. s-S-i-dAc---- ./tcsh
    
47. s-S-i-dAc---- ./sort
    
48. s-S-i-dAc---- ./stty
    
49. s-S-i-dAc---- ./sync
    
50. s-S-i-dAc---- ./true
    
51. s-S-i-dAc---- ./view
    
52. s-S-i-dAc---- ./zcat
    
53. s-S-i-dAc---- ./unicode_stop
    
54. s-S-i-dAc---- ./bash2
    
55. s-S-i-dAc---- ./chgrp
    
56. s-S-i-dAc---- ./chmod
    
57. s-S-i-dAc---- ./chown
    
58. s-S-i-dAc---- ./dmesg
    
59. s-S-i-dAc---- ./egrep
    
60. s-S-i-dAc---- ./false
    
61. s-S-i-dAc---- ./fgrep
    
62. s-S-i-dAc---- ./igawk
    
63. s-S-i-dAc---- ./login
    
64. s-S-i-dAc---- ./mkdir
    
65. s-S-i-dAc---- ./mknod
    
66. s-S-i-dAc---- ./mount
    
67. s-S-i-dAc---- ./pgawk
    
68. s-S-i-dAc---- ./rmdir
    
69. s-S-i-dAc---- ./rview
    
70. s-S-i-dAc---- ./sleep
    
71. s-S-i-dAc---- ./touch
    
72. s-S-i-dAc---- ./uname
    
73. s-S-i-dAc---- ./kbd_mode
    
74. s-S-i-dAc---- ./setfont
    
75. s-S-i-dAc---- ./unicode_start
    
76. s-S-i-dAc---- ./domainname
    
77. s-S-i-dAc---- ./aumix-minimal
    
78. s-S-i-dAc---- ./doexec
    
79. s-S-i-dAc---- ./setserial
    
80. s-S-i-dAc---- ./gettext
    
81. s-S-i-dAc---- ./netstat
    
82. s-S-i-dAc---- ./gunzip
    
83. s-S-i-dAc---- ./ipcalc
    
84. s-S-i-dAc---- ./hostname
    
85. s-S-i-dAc---- ./nisdomainname
    
86. s-S-i-dAc---- ./mktemp
    
87. s-S-i-dAc---- ./dnsdomainname
    
88. s-S-i-dAc---- ./loadkeys
    
89. s-S-i-dAc---- ./ash.static
    
90. s-S-i-dAc---- ./umount
    
91. s-S-i-dAc---- ./unlink
    
92. s-S-i-dAc---- ./usleep
    
93. s-S-i-dAc---- ./ypdomainname
    
94. s-S-i-dAc---- ./basename
    
95. s-S-i-dAc---- ./dumpkeys

复制代码

另外一台机器上就不是这个样子的。

1. 
   
2. ------------- ./.
   
3. ------------- ./..
   
4. ------------- ./dnsdomainname
   
5. ------------- ./ping
   
6. ------------- ./mktemp
   
7. ------------- ./mount
   
8. ------------- ./umount
   
9. ------------- ./nisdomainname
   
10. ------------- ./domainname
    
11. ------------- ./hostname
    
12. ------------- ./netstat
    
13. ------------- ./cpio
    
14. ------------- ./sh
    
15. ------------- ./ypdomainname
    
16. ------------- ./setserial
    
17. ------------- ./bash
    
18. ------------- ./bash2
    
19. ------------- ./gawk
    
20. ------------- ./ed
    
21. ------------- ./red
    
22. ------------- ./awk
    
23. ------------- ./basename
    
24. ------------- ./igawk
    
25. ------------- ./pgawk
    
26. ------------- ./egrep
    
27. ------------- ./fgrep
    
28. ------------- ./grep
    
29. ------------- ./chgrp
    
30. ------------- ./cat
    
31. ------------- ./ash.static
    
32. ------------- ./chmod
    
33. ------------- ./chown
    
34. ------------- ./cp
    
35. ------------- ./cut
    
36. ------------- ./date
    
37. ------------- ./dd
    
38. ------------- ./df
    
39. ------------- ./echo
    
40. ------------- ./env
    
41. ------------- ./false
    
42. ------------- ./link
    
43. ------------- ./ln
    
44. ------------- ./ls
    
45. ------------- ./mkdir
    
46. ------------- ./mknod
    
47. ------------- ./mv
    
48. ------------- ./nice
    
49. ------------- ./pwd
    
50. ------------- ./rm
    
51. ------------- ./rmdir
    
52. ------------- ./sleep
    
53. ------------- ./sort
    
54. ------------- ./stty
    
55. ------------- ./su
    
56. ------------- ./sync
    
57. ------------- ./touch
    
58. ------------- ./true
    
59. ------------- ./uname
    
60. ------------- ./unlink
    
61. ------------- ./ash
    
62. ------------- ./gunzip
    
63. ------------- ./bsh
    
64. ------------- ./dumpkeys
    
65. ------------- ./gzip
    
66. ------------- ./zcat
    
67. ------------- ./ps
    
68. ------------- ./rpm
    
69. ------------- ./sed
    

复制代码

大家给点意见。自己认为是给黑了。这个机器基本上不开服务的，比较怪的事情。