I want to analyze my ubuntu box to detect if it was been hacked. My question is: what are all the place where to look to discover if some malicious software are started ? The following is some kind of raw list:
- mbr
- kernel image (I have md5)
- /sbin/init (I have md5)
- Kernel modules in /etc/modules
- all the services script in /etc/init.d and /etc/init (I have md5)
- /etc/rc.local
- gnome autorun
and ?
My question is totally honest and not malicious. It's only to detect if my box was been compromised.