Hi,<br><br>I did not find any file with a or i with your suggested commands.<br><br>Any other clues?<br><br>CK<br><br><div class="gmail_quote">On Fri, Jul 1, 2011 at 6:23 PM, A J Stiles <span dir="ltr"><<a href="mailto:asterisk_list@earthshod.co.uk">asterisk_list@earthshod.co.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On Friday 01 Jul 2011, asterisk asterisk wrote:<br>
> I have this error after upgrading to 1.8.4.4 on my centos 5.6 32it<br>
><br>
> When using GUI to access, I got this error<br>
><br>
> *** glibc detected *** /usr/sbin/asterisk: double free or corruption<br>
> (!prev): 0x0919c070 ***<br>
><br>
> The server cannot be connected via GUI and the asterisk CLI dropped and<br>
> exit into linux command line.<br>
<br>
</div>Ooo-er. Last time I got an error like this, it turned out that the box had<br>
been compromised with a rootkit.<br>
<br>
Luckily, most rootkits give themselves away in trying to make themselves hard<br>
to detect / remove: first they replace some system utilities (which, on<br>
Debian, also breaks colour directory listings) with specially munged ones<br>
(for instance, an ls command that will deliberately not show any of the<br>
rootkit's own extra files; a ps that will not show the extra processes; a<br>
netstat that will not show the rootkit's network connections; and so forth)<br>
and then they set the extended attributes on the new files to prevent them<br>
from being overwritten. So checking extended attributes can give you a clue<br>
that all is not well.<br>
<br>
Try<br>
<br>
# lsattr /bin<br>
# lsattr /usr/bin<br>
# lsattr /sbin<br>
# lsattr /usr/sbin<br>
<br>
All files should have a row of - signs in the left hand column. Any "a"<br>
or "i" in a file's attributes indicates that the file has had its extended<br>
attributes modified, and you should be suspicious.<br>
<br>
Note: ignore any errors such as "lsattr: Operation not supported While<br>
reading flags on /bin/nc" (this just means the file is a symbolic link, and<br>
these don't have extended attributes).<br>
<br>
--<br>
AJS<br>
<br>
Answers come *after* questions.<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</blockquote></div><br>