I think I was hacked....

[Bob Elzer]

Then i don't think you were hacked, I think you typed something wrong and
wound up there.

It wasn't clear the you wound up at an external web page.

I thought you pasted that log on that website

On Sep 15, 2016 7:22 AM, "Michael" <bmike1 at gmail.com> wrote:

> nope. those directories are not on the system.
> I don't actually know what https://paste.ubuntu.com/23179881/ is from.
> All I know is I tried to do a kodi log report and after I hit enter it
> immediately showed that website. As for security I update that computer
> about once a month.
>
> On Thu, Sep 15, 2016 at 9:56 AM, Bob Elzer <bob.elzer at gmail.com> wrote:
>
>> If it really is a minecraft server look for a directory named "world"
>> that contains another directory named "playerdata"
>>
>> There would also be a .jar file in the same directory as world
>>
>> Try   /usr/bin/ls -aCRF | less
>> And search for those directories
>>
>> You could at least find out the date the files were created
>>
>> On Sep 14, 2016 10:01 PM, "Eric Oyen" <eric.oyen at icloud.com> wrote:
>>
>>> well,
>>> there might be a way to tell which system utilities got changed. if you
>>> happen to have a spare box, install an identical setup to your current
>>> machine. then do an md5sum on all executables. do the same on your current
>>> box and then on the clean machine, run diff against both generated lists.
>>> you might find out that you have a root kit or trojan or some other malware
>>> in operation.
>>>
>>> Also, it is likely that someone may have found an exploit on your
>>> machine (when was it last updated with security patches?).  This is going
>>> to take a bit of work, but you might just find out what happened.
>>>
>>> I had this type of situation crop up in 2004 when I was using a debian
>>> machine as the house firewall. I thought I had locked everything down and
>>> even sealed off ports with the iptables script I wrote. NOPE! someone found
>>> an exploit and the next thing I knew was that I had several infected
>>> binaries on my system and some invisible process that tried running an
>>> additional networking service I hadn't previously installed.
>>>
>>> teaches me to think I was an expert (I was, but there is always someone
>>> better).
>>>
>>> ah well, its a bit of work, so get cracking.
>>>
>>> -eric (from the offices of the technomage guild).
>>> On Sep 14, 2016, at 4:15 PM, Michael wrote:
>>>
>>> I think my tvserver was hacked. I finally wrote to the kodi people
>>> because nothing 2 of 3 things weren't working and finally the third thing
>>> stopped working. Here is the message I sent them:
>>> //////////////////
>>> primewire has not worked for around 6 months, project free tv stopped
>>> working around 3 months ago and as of yesterday SALTS stopped working.
>>> Apparently I had to put the kodiogfile thing on my computer again and the
>>> log it gave me doesn't look right but here is what it gave me:
>>> https://paste.ubuntu.com/23179881/
>>> the prime wire thing I was told was because I needed the new version of
>>> kodi but I let apt take care of updatin and it hasn't updated yet so I
>>> figured it wasn't ready. PFTV I figured was following primewire.... and I
>>> just read in the forums how someone has primewire working so I am just
>>> messed up. Can ya help a poor ol soul?
>>>
>>> I just looked at that URL and it is something about minecraft. huh? I
>>> don't play minecraft! and that computer hasn't had minecraft.... did
>>> someone hack into that box?
>>> \\\\\\\\\\\\\\\
>>> So I turned the computer off, disconnected it from the internet, turned
>>> it back on, and changed my password. Then I reconnect the internet and now
>>> I ask you is there anything else I should do?
>>> --
>>> :-)~MIKE~(-:
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>>> To subscribe, unsubscribe, or to change your mail settings:
>>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>
>>>
>>>
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>>> To subscribe, unsubscribe, or to change your mail settings:
>>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>>
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> :-)~MIKE~(-:
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.phxlinux.org/pipermail/plug-discuss/attachments/20160915/bfb1872b/attachment.html>