Detection

• Several copies of inetd running

• /kernel/pssys exists

• /usr/bin/ps and /usr/ucb/ps same size.

• /usr/man/tmp/[update|output] exist

• Log messages from first slide

Previous slide

Back to first slide

View graphic version