Have I been rooted?

[Charred_Phoenix]

A few days ago, my XF86Config was somehow changed, and today opera has been updated. I did nothing to either. That my security has been compromised is the only solution I can think of, but at the same time I find it hard to believe that someone would break into my computer and then update opera. I think I might be going insane. -_-

[bandwidth_pig]

If you suspect you have been rooted download the chkrootkit. It will scan your machine for common root kits.

http://www.chkrootkit.org/

Also have a look at your log files.

[Charred_Phoenix]

Well, chkrootkit found nothing, and I can't see anything suspicious in my logs. But what can have happened?

[bandwidth_pig]

Hard telling. As you pointed out, the odds of somebody hacking in and screwing with your XF86Config and your browser settings is highly unlikely. What do you mean by XF86Config was changed anyway? Changed in what way?

[Charred_Phoenix]

Well, the NVidia driver stopped working and the screens section of the file changed a bit (though I hadn't looked at it in a while). It really doesn't make any sense whatsoever. :confused:

[X_console]

You sure you didn't run some kind of update program that downloaded and updated certain files? Maybe you set it up as a cronjob or something?

[Charred_Phoenix]

Absolutely certain. :confused:

[bandwidth_pig]

Did you update your kernel recently?

[Charred_Phoenix]

Another no. I'm sorry I'm not being more helpful in finding a solution, but I really can't think of anything.

[Loki3]

Look at from the hacker's point of view. If you went to all the time and effort to break into someone's system (and that requires A LOT of time and effort) would you just change video drivers and helpfully update their browser for them? I doubt you've been hacked. However, it's really easily to accidently mess things up so it's quite possible you updated something by accident (I do it all the time).

[Charred_Phoenix]

Look, don't get the idea that I'm really paranoid and blame everything on the phantom hacker. Like I said, I find it very hard to believe that something would bother. And it doesn't always require a lot of time and effort. :p How could I update something though? I don't have any tools like apt-get.

[X_console]

Or maybe some grey hat cracked into your system and decided to do you a favor and upgrade and patch everything up for you. :cool:

[bandwidth_pig]

Actually I had scenario C come into mind. If I had a sploit I wanted to use real bad on target A, but didn't want to alert target A to my plan for domination, I would find another machine to test it on who had the exact same conditions in place as target A. Target B...which would be you. Of course, I am leaning to the whole read too many 80s hacker text files scenario....scenario D. :D

Don't feel bad about it. I remember I went through something quite similar once. I thought for sure I had been hacked. I had left Samba wide open to the internet (so I had a good reason to be nervous). And I had something change similar to what you have. It turned out it was me. It took me a few days to figure it out...but I did. But on a positive note, I had found lots of people trying to access my Samba shares and corrected the mistake.

[JohnT]

It's possible there is some type of auto-update feature in Opera that is responsible.

[Charred_Phoenix]

Or maybe some grey hat cracked into your system and decided to do you a favor and upgrade and patch everything up for you.


:D


Don't feel bad about it. I remember I went through something quite similar once. I thought for sure I had been hacked. I had left Samba wide open to the internet (so I had a good reason to be nervous). And I had something change similar to what you have. It turned out it was me. It took me a few days to figure it out...but I did. But on a positive note, I had found lots of people trying to access my Samba shares and corrected the mistake.


What exactly happened?


It's possible there is some type of auto-update feature in Opera that is responsible.


I thought about that too, but I couldn't find anything about it on google.