Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.os.linux.misc > #14148

Re: GUI terminated suddenly and restarted..

From The Natural Philosopher <tnp@invalid.invalid>
Newsgroups comp.os.linux.misc
Subject Re: GUI terminated suddenly and restarted..
Date 2015-03-18 18:51 +0000
Organization albasani.net
Message-ID <meches$5th$1@news.albasani.net> (permalink)
References <mebv4r$26c$1@news.albasani.net> <slrnmgjflg.ss2.BitTwister@wb.home.test>

Show all headers | View raw


On 18/03/15 18:05, Bit Twister wrote:
> On Wed, 18 Mar 2015 13:38:34 +0000, The Natural Philosopher wrote:
>>
>> Simply put after aroudn 7 hours of flawless operation a Mint 17.1 Mate
>> computer lost the GUI completely, dropped back briefly to a text login
>> and then presented me with a logon screen.
>>
>> I assume the X server had crashed and restarted.
>> First of all, is that a valid and comprehensive assumption?
>
> I'll +1 on that assumption.
>
>> Secondly any clues as to why?
>
> Not really at this point.
>
>> It was synchronous with trying to access a particular web page in
>> Firefox, but that is all.
>
> Based on the inordinate amount of information provided, my WAG is that
> the web page attempted a malware exploit. The exploit was a
> deliberate DOS attack, or it just screwed up and corrupted the
> software stack with the resulting JOW.
>
> As for clues, the only possible places I would know to look would be in
> /var/log/Xorg.0.log*, ~/xsession-errors and a core.
>
> As far as I know, default installs do not have core enabled.
> Each gui login causes /var/log/Xorg.0.log.old to be over written
> so you better get a copy for forensic study.
>
> I have found it helpful to get a copy of .xsession-errors just after
> starting the Desktop Manager. That way I know how far down to start
> looking around for something having to do with an application.
>
>> After relogging in the web page was just fine.
>
> That does not surprise me. The better malware will blacklist any ip
> address it has made an attempt at infecting. That is to help prevent
> analysis by anti-virus software.
>
It wasn't malware. I know the person whose site it was and he is highly 
technical and runs a tight ship.


Sadly the x log file is gone now..


-- 
Everything you read in newspapers is absolutely true, except for the 
rare story of which you happen to have first-hand knowledge. – Erwin Knoll

Back to comp.os.linux.misc | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

GUI terminated suddenly and restarted.. The Natural Philosopher <tnp@invalid.invalid> - 2015-03-18 13:38 +0000
  Re: GUI terminated suddenly and restarted.. Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-03-18 07:19 -0700
    Re: GUI terminated suddenly and restarted.. Charlie Gibbs <cgibbs@kltpzyxm.invalid> - 2015-03-18 17:01 +0000
  Re: GUI terminated suddenly and restarted.. Aragorn <thorongil@telenet.be.invalid> - 2015-03-18 17:24 +0100
    Re: GUI terminated suddenly and restarted.. Baho Utot <baho-utot@columbus.rr.com> - 2015-03-18 16:34 -0400
      Re: GUI terminated suddenly and restarted.. Dan Espen <despen@verizon.net> - 2015-03-18 16:52 -0400
      Re: GUI terminated suddenly and restarted.. Aragorn <thorongil@telenet.be.invalid> - 2015-03-18 22:27 +0100
        Re: GUI terminated suddenly and restarted.. The Natural Philosopher <tnp@invalid.invalid> - 2015-03-19 09:45 +0000
          Re: GUI terminated suddenly and restarted.. Aragorn <thorongil@telenet.be.invalid> - 2015-03-19 18:59 +0100
            Re: GUI terminated suddenly and restarted.. The Natural Philosopher <tnp@invalid.invalid> - 2015-03-19 18:43 +0000
          Re: GUI terminated suddenly and restarted.. faeychild <faeychild@nomail.afraid.org> - 2015-03-20 08:19 +1100
  Re: GUI terminated suddenly and restarted.. Bit Twister <BitTwister@mouse-potato.com> - 2015-03-18 18:05 +0000
    Re: GUI terminated suddenly and restarted.. The Natural Philosopher <tnp@invalid.invalid> - 2015-03-18 18:51 +0000
      Re: GUI terminated suddenly and restarted.. J G Miller <miller@yoyo.ORG> - 2015-03-18 20:41 +0000

csiph-web