while surfing the web, i entered into a horrible website (don't ask me to describe its contents); it looked suspicious, and popped up little boxes that floated around the screen

i was using firefox 0.9 on linux (of course) 2.6.5; is it likely that some malicious code could have been used to compromise my system? the only place i had write access to was in my home directory

i cleared my cache and history, checked my secure and messages log, and nothing looks suspcious... anything else i can check, or am i just being paranoid unnecessarily?

be paranoid..... delete ~/.firefox!

i doubt anything bad (at least for linux) was installed ... now if you were in windows then id be concerned

even if some bad code (that worked) got in, then it wont be able to do to much if you can only write into your home directory (and if you have grsecurity in the kernel then it would diffidently leave a message or 2)

i'll delete .firefox (for me it's ~/.mozilla/firefox); i just need to write down all the stored passwords (fortunately they're nothing massively important, so even if those were stolen, it's not a big deal; i'll just change my LQ password, of course)

i figured that most websites with code hidden in websites or the pictures would be targetting windows-based platforms, but you can never be too sure

btw, what is grsecurity?

its a combination of security patch's

the Pax patch's (i feel these are almost required for every kernel, esp the trusted path execution which can prevent users from executing stuff that is was not installed in /bin ,use/bin, etc

and also gives you some role based security if you want it, as well as more logging options

http://grsecurity.net/

check if out, its not that much of a pain to configure (tho i haven't set up role based controls yet, so i have no clue about how bad setup is once the kernel is configured)

You could use the find command with a pair of cmin options +cmin and -cmin to determine which files were created during the time you where online.

The hardest part is calculating what the time range should be.

Of course this assumes that files were not touched to give false dates.