[mythtv-users] A bunch of files that start with "st" in myth based directories..

[David Herman]

On Wed, Apr 1, 2009 at 7:36 AM, Mike Perkins
<mikep at randomtraveller.org.uk>wrote:

> David Herman wrote:
>
>>
>> I am running .22, but I have seen these files on and off for the last year
>> (so it was there for .21).. I think it may be tied to nuvexport, but am
>> unsure... Yesterday, I did a cleanup when I did a trunk update and removed
>> all of them.  I have /usr/local as gloabally writeable (as I am the only
>> user on the box). All I run is Firefox, mythtv (and associated plugins)
>> and
>> mplayer on this box. As you know nothing about it, I will drop the topic.
>>
> e
>
> Whenever you find out where these files come from, we'd like to know, so
> that we (the community) can either cross this off the list or apply a
> fix/workaround. That would be good development practice.
>
> Those files may not have anything to do with myth. Your box might have been
> rootkitted/pwned instead. Whatever, a line or two with the cause would be
> useful, once you figure it out.
>
> --
>
> Mike Perkins
>
> Ok.. Files are back, but I think they are from actually building myth and
doing a checkinstall.

files...

in /usr/local/lib:
-rw------- 1 root root 0 2009-04-04 21:48 st3tHPvg
-rw------- 1 root root 0 2009-04-04 21:48 st6LIAgL
-rw------- 1 root root 0 2009-04-04 21:48 st8aWMFA
-rw------- 1 root root 0 2009-04-04 21:48 stbRgEOE
-rw------- 1 root root 0 2009-04-04 21:48 sthoDVWs
-rw------- 1 root root 0 2009-04-04 21:48 stJ6kH1M
-rw------- 1 root root 0 2009-04-04 21:48 stKWsXp4
-rw------- 1 root root 0 2009-04-04 21:48 stNTCqqj
-rw------- 1 root root 0 2009-04-04 21:48 stPkM4dN
-rw------- 1 root root 0 2009-04-04 21:48 stwgmUap
-rw------- 1 root root 0 2009-04-04 21:48 stZpH4fB

in /usr/local/bin:
-rw-------  1 root root       0 2009-04-04 21:56 st2NBgQt
-rw-------  1 root root       0 2009-04-04 21:48 st3yC0Fs
-rw-------  1 root root       0 2009-04-04 21:48 st41YmJR
-rw-------  1 root root       0 2009-04-04 21:48 st4ydexD
-rw-------  1 root root       0 2009-04-04 21:48 stbANtcu
-rw-------  1 root root       0 2009-04-04 21:48 steEp982
-rw-------  1 root root       0 2009-04-04 21:48 stEJgYuW
-rw-------  1 root root       0 2009-04-04 21:48 sti92FCi
-rw-------  1 root root       0 2009-04-04 21:48 stMKGyWn
-rw-------  1 root root       0 2009-04-04 21:48 stO6KZdE
-rw-------  1 root root       0 2009-04-04 21:48 ston6eKD
-rw-------  1 root root       0 2009-04-04 21:56 stq3SC9I
-rw-------  1 root root       0 2009-04-04 21:48 stTtPPlq
-rw-------  1 root root       0 2009-04-04 21:56 stUnI4h0
-rw-------  1 root root       0 2009-04-04 21:48 stV9C93n
-rw-------  1 root root       0 2009-04-04 21:48 stzOoxoy

I have verified that the file dates are IDENTICAL to the checkinstall run

Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mythtv.org/pipermail/mythtv-users/attachments/20090405/4de24483/attachment.htm>