求助，我的Linux系统是不是被黑了

solink

各位高手：

我的系统最近连续两天死机，分析日志发现以下内容

Dec 15 10:40:37 116.23.93.126 [2011-12-15 19:12:49] EFW: IP_PROTO: prio=3 id=07000014 rev=1 event=ttl_low action=drop ttl=1 ttlmin=3
rule=TTLOnLowMulticast recvif=lan srcip=192.168.1.17 destip=234.34.23.234 ipproto=UDP ipdatalen=28 srcport=2547 destport=33674 udpt
otlen=28
Dec 15 10:40:37 116.23.93.126 [2011-12-15 19:12:50] EFW: RULE: prio=2 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
ropAll recvif=adsl srcip=180.112.94.108 destip=116.23.93.126 ipproto=UDP ipdatalen=48 srcport=1953 destport=9865 udptotlen=48
Dec 15 10:40:37 116.23.93.126 [2011-12-15 19:12:50] EFW: RULE: prio=2 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
ropAll recvif=adsl srcip=58.46.182.49 destip=116.23.93.126 ipproto=UDP ipdatalen=38 srcport=20497 destport=5218 udptotlen=38
Dec 15 10:40:37 116.23.93.126 [2011-12-15 19:12:50] EFW: CONN: prio=1 id=00600005 rev=1 event=conn_close_natsat action=close rule=la
n_to_internet conn=close connipproto=TCP connrecvif=lan connsrcip=192.168.1.43 connsrcport=1594 conndestif=adsl2 conndestip=58.68.25
4.26 conndestport=110 connnewsrcip=14.151.251.128 connnewsrcport=39946 connnewdestip=58.68.254.26 connnewdestport=110 origsent=503 t
ermsent=1058
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=58.253.217.186 destip=14.151.251.128 ipproto=UDP ipdatalen=48 srcport=6519 destport=4068 udpto
tlen=48
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: IP_PROTO: prio=3 id=07000014 rev=1 event=ttl_low action=drop ttl=1 ttlmin=3
rule=TTLOnLowMulticast recvif=lan srcip=192.168.1.36 destip=234.34.23.234 ipproto=UDP ipdatalen=28 srcport=3514 destport=33674 udpt
otlen=28
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=218.14.51.223 destip=14.151.251.128 ipproto=UDP ipdatalen=48 srcport=19394 destport=19765 udpt
otlen=48
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=2 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
ropAll recvif=adsl srcip=182.35.54.0 destip=116.23.93.126 ipproto=UDP ipdatalen=102 srcport=5041 destport=16725 udptotlen=102
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=2 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
ropAll recvif=adsl srcip=182.35.54.0 destip=116.23.93.126 ipproto=UDP ipdatalen=102 srcport=5041 destport=16725 udptotlen=102
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=121.207.210.177 destip=14.151.251.128 ipproto=TCP ipdatalen=20 srcport=8090 destport=29633 ack
=1 fin=1
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=119.139.100.107 destip=14.151.251.128 ipproto=UDP ipdatalen=54 srcport=3589 destport=35408 udp
totlen=54
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:51] EFW: CONN: prio=1 id=00600004 rev=1 event=conn_open_natsat rule=lan_to_internet
conn=open connipproto=UDP connrecvif=lan connsrcip=192.168.1.55 connsrcport=5686 conndestif=adsl2 conndestip=189.100.221.21 conndest
port=41149 connnewsrcip=14.151.251.128 connnewsrcport=12139 connnewdestip=189.100.221.21 connnewdestport=41149
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:52] EFW: RULE: prio=2 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
ropAll recvif=adsl srcip=219.128.45.140 destip=116.23.93.126 ipproto=TCP ipdatalen=20 srcport=8090 destport=46911 ack=1 fin=1
Dec 15 10:40:39 116.23.93.126 [2011-12-15 19:12:52] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=219.136.212.143 destip=14.151.251.128 ipproto=UDP ipdatalen=48 srcport=64224 destport=58250 ud
ptotlen=48
Dec 15 10:40:40 116.23.93.126 [2011-12-15 19:12:52] EFW: RULE: prio=3 id=06000051 rev=1 event=ruleset_drop_packet action=drop rule=D
efault_Access_Rule recvif=adsl2 srcip=114.104.12.65 destip=14.151.251.128 ipproto=UDP ipdatalen=48 srcport=53146 destport=61556 udpt
otlen=48

数据量非常大，看起来好像被人中了木马一直在向外发包，系统linux 2.6.18-8.el5求解决方案，谢谢！

dooros

看下流量，再ps看下有没有什么异常进程。

walleeee

netstat -ap
看一下连接情况，那些进程外连以及地址，然后去查一下ip情况看。如果有异常的，那么然后用netcat来监听一下这些连接端口做蜜罐看看。

还有用netstat扫出异常程序后可以用lsof来看一下到底在干什么。

walleeee

补充：
可否报一下你的系统版本？一般及时更新的系统，我觉得本身被黑的概率比较小，除非你运行了一些出问题的程序
uname -a