This question already has an answer here:

Yesterday I noticed that the xterm title I use changed suddenly to something strange. So I suspect that someone hacked my Linux laptop (I'm using Arch). I changed the WiFi parameters (pass, essid) and changed my password on the computer. I also reinstalled all packages to overwrite files that may have been changed. I tried to take a look at the changed files, logs and so on, but I don't have experience in security, so it was like walking in the dark ;) and of course I didn't found any signs of intrusion. Do you think I should wipe the system and install from scratch?

marked as duplicate by Mat, Bernhard, Anthon, slm, jasonwryan Nov 24 '13 at 16:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Maybe you should be more precise about "something strange" first, unless you are positive there isn't any other possible explanation. This would be an odd clue for someone to give you if they actually meant harm. – goldilocks Nov 24 '13 at 11:21
  • yes, I agree that's strange, but I think something is wrong when a xterm window changes to something like "Thanks for the ride". it's not a configuration change. maybe it was just a script kiddie who wanted to signal that my wifi is poorly protected? i don't know. I checked the system with rkhunter and unhide and I don't see anythin suspicious. – yemu Nov 24 '13 at 19:55
  • As wilf points out, the title of a GUI terminal is easily changed; it could have been a legit application. So if that's all you have to go on and you've run some checks, don't worry. And of course always keep your important stuff backed up somewhere not attached to the system. Ideally somewhere not attached to any system. By "important" I don't mean everything. It is easy to re-install and backing up an entire installation is not worthwhile with a normal workstation. – goldilocks Nov 25 '13 at 14:05

I would add this as a comment - but I can't (currently 20 rep).

Apparently you can change the title by just running a command - but this does not work for me - http://tldp.org/HOWTO/Xterm-Title.html

You can also configure other stuff in xterm- http://lukas.zapletalovi.com/2013/07/hidden-gems-of-xterm.html

You can also check who has logged in and when by running the last command (look for tty - that may be the first port of call for anyone logging in remotely) - unless the 'hacker' (technically its 'cracker') modified the log file - http://www.cyberciti.biz/faq/linux-display-date-and-time-of-login/

For reinstalling, just back up your /home and anything else you want to keep, and then to a fresh install which would wipe the previous installtion.

But you may not need to do this, as it may be just your system ran an update which changed xterm's configuration - 'crackers' may have better things to do than modify Window title names.

Not the answer you're looking for? Browse other questions tagged or ask your own question.