Recovering from a compromised server. Pretty sure the aprlog (768773 -rw-r—– 1 root root root 18K 2015-05-03 12:22 aprlog) that is located in my home dir and presents itself as a bunch of encrypted gibberish is not anything important, but is it spurious? I'm hoping you can tell me.
-
first thought is networking log dealing with ARP calls but the naming is wrong– linuxdev2013May 4, 2015 at 23:30
-
'aprlog' seems pretty suspect. Do an 'updatedb' and 'locate aprlog', see what comes up. You can also 'grep -rl aprlog /etc' to see if any ascii files mention the file. Might be worth running it against /init.d also. 'ps aux | grep apr' might turn up something. Good luck.– EvilKittenLordMay 4, 2015 at 23:34
Add a comment
|