Big trouble?

[e2k]

I just found something very interesting in my root..

[i92guboj]

¿¿ ??
Strange thing, overall counting that all of them has exactly the same creation date. There is nothing to worry about the files that the figure shows, but you should look if any file created that same date on your system (not just / directory only) has the x permissions set on. If so you should put that file(s) in quarantine, untill you are sure that holds nothing related to an exploit, backdoor or trojan.

That files were put there by someone, if not you. Portage did not do it for sure, so something is happening. Has someone else access to that machine?

[e2k]

[i92guboj]

You can do with kfind, i think (not sure, I dont use it).

You can also do a hard search, by

[e2k]

I checked it, but not sure if I found anything suspicious
Apparently I installed my gentoo on Dec 3, or were just very active, cause I found quite a lot

If anyone knows any potential hazardous filenames, you can check the ls -lR | grep 'Dec 3' here..
Thanks 6thpink for your assistance.. Maybe I don't have to reinstall my whole system (or maybe I should, just to be on the safe side )

EDIT: I ran rkhunter and chkrootkit, and neither of them found anything suspicious.. Can this be trusted? Anyother apps like this?

[rex123]

I'd guess the most likely thing is that you made some command-line error as root. I don't know exactly what is inside a stage 3 tarball, but it looks like you've untarred one on Dec 3, and quite possibly done some other things at the same time by accident.
This is a case of least weird explanation, rather than anything like a certainty.

[e2k]

[i92guboj]

I thought of that also. The strange things is, as you say, that all files are 0 bytes lenght, but that can be caused by losts of issues, for example, a hard lockup or a manual reset when untarring a file, its not a frequent thing but it can happen with relative frequency.

In fact, the point that all files are zero and none has x persimission suggests that there is no reason to think that this could be a remote atack.

[christsong84]

the . and .. are supposed to be there...

the rest though...try moving them to another directory and see if they reappear (trace when too and what you were doing at the time)
_________________
while(true) {self.input(sugar);}