Re: [arch-general] My Apache Sever Compromised?

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

You can also use pacman -Qkk

For example, boot from iso, mount your root device as /mnt pacman -Qkk -r /mnt

Not every warning means a compromission.

To find files not owned by a package, use: find /mnt/ -exec pacman -Qqo {} -r /mnt ;

Maybe you need better filtering here, like using /mnt/usr, /mnt/etc, ... instead /mnt, because lots of files should not be owned by a package.

I haven't tried this, it is only a comment.

Am 31.03.2014 07:05, schrieb Theo Jones: