rpiz Posted March 7, 2004 Share Posted March 7, 2004 I opened Konqueror, and entered '/home/rp/tmp' and upon openingit, files such as: 'gs_nox68a ...60 bytes' and 'gs_nzPeM6 ....111.7K'began to be generated at will. This continued without stop until Iclosed Konqueror. I then opened Nautilus, here this did not occur; but I found a few hundred of these files. I deleted these files andclosed Nautilus. I then re-opened Konqueror to see if this occurence would repeat itself; and it did the same thing. It continuedto generate these files without stop. Can anyone explain just what is causing this; and of course howwould I stop this from happening.I ran F-prot on this '/home/rp/tmp' file to determine if it wouldidentify these files as viruses; and it didn't appear as a virus?I am running MDK 9.2 on a separate drive.Tnx Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 7, 2004 Share Posted March 7, 2004 Hi RpizVery strange, never heard of that one . . . . Did you install "anacron" ? It would do a maintenance on your computer daily if you do not have it running 24/7. ( If your computer is ON all the time "cron" will do those jobs, if not they might be forgotten )Would you, because you already ran f-prot, run chkrootkit as well ?? ( chkrootkit is available through your "contrib" source in the MCC , see Here how to add that source ) Bruno Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 7, 2004 Author Share Posted March 7, 2004 Hi Bruno;Yes I do have 'anacron' installed. And yes I do have the 'contrib' source available in MCC.Another bit of information, there is a folder in '/home/rp/tmp' called 'orbit-rp' that has 390 filesin it such as: 'bonobo-activation-register.lock' and many 'linc- ..........' only with different numbersafter the ..linc-Also recently I installed the Open Office Quickstarter program, and I wonder if that has someconnection to the 'qs_..........' files mentioned in my initial post.Further, I attempted to do a 'urpmi.update -a' as root and I received a message that theurpmi database is locked?????Lastly, I attempted to install the version of chkrootkit that appeared in MCC but I received anerror indicating a bad Signature. I had hoped to update my database which would haveperhaps provided the lasted version of chkrootkit. Strange indeed. Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 7, 2004 Author Share Posted March 7, 2004 Hi Bruno;A followup to the previous post, the 'urpmi.update -a' now worked andthe database is up to date. Something may have been open that causedthe lock; but it is functional now. Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 7, 2004 Share Posted March 7, 2004 Wiping the sweat of his forehead . . . . . Good job Rpiz !! Bruno Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 7, 2004 Author Share Posted March 7, 2004 Hi Bruno;The issue with the 'urpmi.update -a' has been resolved; but the generation offiles in Konqueror continues to be a problem. Do I force the install of 'chkrootkit' even with the invalid signature error?And what about the 'orbit-rp' file in my /home/rp directory that also has alarge amount of unknown files. Again, finding the root cause of all thesefiles being generated is the main issue at this point.LOL You remembered the 'sweat of his forehead' ... Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 7, 2004 Share Posted March 7, 2004 Oh . . yes sorry . . go ahead with the install, no matter the missing or invalid signature . . . those warnings are to be ignored, they just mean that the package was not made by Mandrake Himself . . . . . but by a third party packager.About the orbit-rp . . I have 1 orbit-bruno directory in /homr/bruno/tmp . . . in that directory there are 30 files starting with linc- and ending with a code ( they are 0 KB ) . . . . but the amount is not growing at any rate . . also there are "bonobo-activation-register.lock* and 'bonobo-activation-server-ior" ( 669 KB ). . . Those are not unusual. Bruno Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 8, 2004 Author Share Posted March 8, 2004 Hi Bruno;I installed chkrootkit and performed the check. There were no infected files and everythingwas clean.Now, could this file generation have anything to do with Open Office Quickstart programthat I installed?? I am only guessing because of the 'gs.......' for every file?And is there any reason these files would be generated in Konqueror and not in Nautilus?RPIZ Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 8, 2004 Share Posted March 8, 2004 (edited) Hi RpizGuess you are reasured now . . . and also it takes no space from your disk . . . I have a distro here without the Quickstarter and it has the files too . . . and they also show in Nautilus . . . So, what does that tell us ?? I honnestly don't know . . . All I can find that it are Gnome LibrariesB) Bruno Edited March 8, 2004 by Bruno Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 8, 2004 Author Share Posted March 8, 2004 Hi Bruno;The files that concern me are the ones that continue to be generated at a rapidpace in my /home/rp/tmp directory; and especially because they are of sufficientsize that it would eventually cause a real problem. Again, the sizes are 60bytesand 111.7K and they are generated every minute while I am in the directory.I guess I am looking for the root cause, so that I can control the installation of filesin any directory. Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 8, 2004 Share Posted March 8, 2004 Hi RpizI did not realize the files were that big . . . What you could do is press Ctrl+Esc and see what PID number the Bobono-activation server has and open a root terminal and kill it. Then see what happens. If that stops it, and it has no influence on any Gnome related apps ( Like Evolution or Galeon ) go to the MCC and at "services" stop it from starting at boot. ( the location is /usr/lib/bonobo-activation-server . . you could also rename that one to OLD-bonobo-activation-server after killing the process first )Let me know what the result is :DB) Bruno Quote Link to comment Share on other sites More sharing options...
rpiz Posted March 8, 2004 Author Share Posted March 8, 2004 Hi Bruno;Before I go ahead with your suggested solution, I would like toclarify the issue further.The 'orbit-rp' directory is in /home/rp/tmp and contains zero (0) bytesized files. This 'orbit-rp' is separate from the files that are causingthe concern.The point of concern is the separate files being generated in the'/home/rp/tmp' directory that are of sufficient size and could be aproblem.By killing 'bonobo-activation server', in the 'orbit-rp' directory; wouldthat stop this file generation?? Quote Link to comment Share on other sites More sharing options...
Bruno Posted March 8, 2004 Share Posted March 8, 2004 By killing 'bonobo-activation server', in the 'orbit-rp' directory; wouldthat stop this file generation?? NO No not that way !!!First kill the process in a root console with "kill 0000" and the 0000 is the PID number you see in Ctrl+EscOnly if that helps rename the "/usr/lib/bonobo-activation-server" to "/usr/lib/OLDbonobo-activation-server" . . that is much safer, that way you can always reverse the action !! Bruno Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.