View previous topic :: View next topic |
Author |
Message |
orange_juice Guru
Joined: 16 Feb 2006 Posts: 588 Location: Athens - Greece
|
Posted: Fri Aug 18, 2006 12:24 am Post subject: Chkrootkit output[solved] |
|
|
Hallo,
I have recently rebuilt my desktop and have implemented a cron job to chkrootkit my box daily. I keep getting this result:
Code: | Searching for suspicious files and dirs, it may take a while...
/usr/lib/locale/.keep /usr/lib/perl5/5.8.8/i686-linux/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Bit/Vector/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Carp/Clan/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Date/Calc/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Locale/gettext/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Pod/Parser/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Test/Harness/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Tie/IxHash/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/Unix/Syslog/.packlist
+/usr/lib/perl5/vendor_perl/5.8.8/i686-linux/auto/XML/Parser/.packlist /usr/lib/.keep /lib/dev-state/.keep
+/lib/rcscripts/awk/.keep /lib/udev-state/.keep
|
Is it a false positive? Because I keep getting it also in my other boxes...
Kind regards,
orange_juice
Last edited by orange_juice on Fri Aug 18, 2006 8:29 pm; edited 1 time in total |
|
Back to top |
|
|
kenthepostman Apprentice
Joined: 02 Jul 2004 Posts: 245 Location: Stanford, CA
|
Posted: Fri Aug 18, 2006 5:37 pm Post subject: |
|
|
I'm pretty sure that those are false positives because I had the same issue a while ago. Chrootkit checks for hidden files which might be malicious. .packlist and .keep are commonly used and sometimes create false positives. You can check to see if those files are anything to worry about but I doubt it. |
|
Back to top |
|
|
orange_juice Guru
Joined: 16 Feb 2006 Posts: 588 Location: Athens - Greece
|
Posted: Fri Aug 18, 2006 8:29 pm Post subject: |
|
|
Checking them, indeed, I did not find anything suspicious. Only path to files like man pages and perl staff.
Thank you!
Kind regards,
orange_juice |
|
Back to top |
|
|
|