Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Does anyone recognise this activity?

From: GaryT <gary@xxxxxxxx>
Date: Fri, 12 Jul 2013 21:28:54 +1000
Thanks, Evan.
W/shark version is 1.2.7
Loaded and installed directly from Canonical.

But, the important part is that this happened while I was asleep. The computer was on but the Internet was isolated (i.e. I have a switch between the computer and the router). Clearly I've been hacked and the program that ran this "command" is operating from within. The one important thing I want to know is just exactly how critical is this command? Was is intended to change Wireshark, or to simply disable it in readiness for some further command.or whatever....

Hence, does anyone recognise it?
GT


On 12/07/13 20:59, Evan Huus wrote:
Sounds like just a bug in wireshark, possibly the same as http://code.google.com/p/darkice/issues/detail?id=86

What version of wireshark and GTK are you running?

Evan

On 2013-07-12, at 2:15 AM, GaryT <gary@xxxxxxxx> wrote:

Happened while I was asleep.

(wireshark:2009): GLib-GObject-WARNING **: /build/buildd/glib2.0-2.24.1/gobject/gsignal.c:3079: signal name `depressed' is invalid for instance `0x21de3820'

(wireshark:2009): GLib-GObject-WARNING **: /build/buildd/glib2.0-2.24.1/gobject/gsignal.c:3079: signal name `depressed' is invalid for instance `0x21de3820'

It was attempted twice, then obviously the operation was aborted.
It stayed visible on my Terminal screen until I found it next morning.

Did it attempt to alter Wireshark?  Disable it?  Just kill it?
I have no idea.

GaryT
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe