[axxs-sysadmin] suspicious directory in /tmp

[pabs]

Hi all,

I noticed apache was down and wouldn't restart due to insufficient disk
space. Running du -bxS | sort -rn | head lead me to the 2.1G of videos
in /tmp/.home/.lib, which looks very suspicious to me. Anyone know what
this is about, perhaps we got cracked again?

[root at axxs pabs]# ls -lSsh /tmp/.home/.lib
total 2.1G
699M -rw-r--r--  1 apache apache 699M Apr 18 18:04 The.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi
695M -rw-r--r--  1 apache apache 695M Apr 17 18:19 I.Fichissimi.DVDRip-D3F.avi
694M -rw-r--r--  1 apache apache 693M Apr 12 15:50 Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar
4.0K -rw-r--r--  1 apache apache  944 Apr 19 01:59 SoWstate
4.0K -rw-r--r--  1 apache apache  944 Apr 19 01:57 SoWstate~

[root at axxs .lib]# file *
I.Fichissimi.DVDRip-D3F.avi:                                                  RIFF (little-endian) data, AVI, 608 x 320, 25.00 fps, video: XviD, audio: MPEG-1 Layer 3 (stereo, 44100 Hz)
Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar:                             RIFF (little-endian) data, AVI, 640 x 352, 25.00 fps, video: XviD, audio: MPEG-1 Layer 3 (stereo, 48000 Hz)
SoWstate:                                                                     data
SoWstate~:                                                                    data
The.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi: data
[root at axxs .lib]# less SoWstate
[root at axxs .lib]# strings SoWstate*
IRFR
Diroffer v1.4.b02 [20050116230512], Linux 2.6.10-1.771_FC2
9Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar
9Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar
$I.Fichissimi.DVDRip-D3F.avi
$I.Fichissimi.DVDRip-D3F.avi
UThe.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi
UThe.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi
*~')
Hrd{
IRFR
Diroffer v1.4.b02 [20050116230512], Linux 2.6.10-1.771_FC2
9Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar
9Interview.2007.iTALiAN.LD.DVDRip.XviD-SiLENT.tar
$I.Fichissimi.DVDRip-D3F.avi
$I.Fichissimi.DVDRip-D3F.avi
UThe.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi
UThe.Oil.Crash.Un.Futuro.Inquietante.2006.iTALiAN.LiMiTED.DVDRip.XviD-SVD.avi
*~')

-- 
bye,
pabs

http://docs.indymedia.org/view/Main/PaulWise
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.indymedia.org/pipermail/axxs-sysadmin/attachments/20080419/c8774a61/attachment.pgp