[Bug Cygwin Applications/575] Unknown HZ value! message from procps commands

Tue Dec 14 12:30:00 GMT 2004

Chris January schrieb:
>>>>>>>Volker Zell writes:
>>>>>>>Chris January writes:
>> >> In both cases what is the actual value of HZ you are seeing?
>> > 01:02 AM [555]> w
>> > Unknown HZ value! (483) Assume 100.

That's unrelated, but interesting, because I got rooted yesterday on 
some linux box (a new t0rnkit with some libsh), which had some libproc 
hack (process hiding), which led to the same error message on the procps 
utils.
 "Unknown HZ value! (11) Assume 100"
At least it was very easy to fix without reinstall. ttyload got hijacked 
(right after mingetty loading). rootkit in /usr/lib/libsh (hidden of 
course). But he forgot to hijack lsof. So lsof|grep LISTEN showed the 
intruder.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/