rkhunter -c 이후 갑자기...

하루에 한번씩

rkhunter --update

rkhunter -c

하는게 일인데요.

어제는 별이상이 없었습니다.

그런데 오늘 실행하는데....

* System tools
  Performing 'known good' check...
   /bin/cat                                                   [ BAD ]
   /bin/chmod                                                 [ BAD ]
   /bin/chown                                                 [ BAD ]
   /bin/dmesg                                                 [ BAD ]
   /bin/egrep                                                 [ BAD ]
   /bin/env                                                   [ BAD ]
   /bin/fgrep                                                 [ BAD ]
   /bin/grep                                                  [ BAD ]
   /bin/kill                                                  [ BAD ]
   /bin/login                                                 [ BAD ]
   /bin/ls                                                    [ BAD ]
   /bin/mount                                                 [ BAD ]
   /bin/netstat                                               [ BAD ]
   /bin/ps                                                    [ OK ]
   /bin/su                                                    [ BAD ]
   /sbin/chkconfig                                            [ OK ]
   /sbin/depmod                                               [ OK ]
   /sbin/ifconfig                                             [ BAD ]
   /sbin/init                                                 [ BAD ]
   /sbin/insmod                                               [ OK ]
   /sbin/modinfo                                              [ OK ]
   /sbin/runlevel                                             [ BAD ]
   /sbin/sysctl                                               [ OK ]
   /sbin/syslogd                                              [ OK ]
   /usr/bin/file                                              [ BAD ]
   /usr/bin/find                                              [ OK ]
   /usr/bin/groups                                            [ OK ]
   /usr/bin/kill                                              [ BAD ]
   /usr/bin/killall                                           [ OK ]
   /usr/bin/lsattr                                            [ OK ]
   /usr/bin/pstree                                            [ OK ]
   /usr/bin/sha1sum                                           [ BAD ]
   /usr/bin/stat                                              [ BAD ]
   /usr/bin/users                                             [ BAD ]
   /usr/bin/w                                                 [ OK ]
   /usr/bin/watch                                             [ OK ]
   /usr/bin/who                                               [ BAD ]
   /usr/bin/whoami                                            [ BAD ]

이렇게 빨간 글씨로....BAD 가 뜹니다.

일단 해당 파일들을 살펴봤는데.....

날짜는 설치 날짜그대로이거든요.

이거 어떻게 된걸까요;;;어제까지는 전부다 OK 였는데.....

해킹 당해서 파일이 변조가 된건지...어떻게 된건지 모르겠네요;;;;

/var/log/messages, /var/log/secure 로그 살펴 봤는데....별이상은 없거든요.

뭐가 문제일까요..

해킹 당했는지 아닌지 여부를 파악하는 방법으로 뭐가 있죠 ?
불안불안 하네요..ㅠㅠ