| View previous topic :: View next topic |
| Author |
Message |
Dralnu
Veteran
Joined: 24 May 2006
Posts: 1919
|
 Posted: Thu Feb 05, 2009 1:35 am Post subject: strange output from chkrootkit |
 |
|
http://dpaste.com/116764
the suspect PHP files section at the start. I havn't been able to find a file like that, and when running chkrootkit under expert mode, I wasn't able to find a path to this file.
How could I find out where this is coming from?
_________________
The day Microsoft makes a product that doesn't suck, is the day they make a vacuum cleaner. |
|
| Back to top |
|
 |
yabbadabbadont
Advocate
Joined: 14 Mar 2003
Posts: 4791
Location: 2 exits past crazy
|
| Posted: Thu Feb 05, 2009 3:46 am Post subject: |
|
|
| Boot a live cd that has chkrootkit and run it from there. If it is possible to check the non-running system that is... I've never tried it. |
|
| Back to top |
|
|
Mistwolf
Apprentice
Joined: 07 Mar 2007
Posts: 189
Location: Edmonton, AB
|
| Posted: Thu Feb 05, 2009 5:17 am Post subject: |
|
|
| You mean the line that starts with "GIF87a"? That is the beginning string for a GIF file. All the "junk" after that is the ascii representation of an image. |
|
| Back to top |
|
|
Dralnu
Veteran
Joined: 24 May 2006
Posts: 1919
|
| Posted: Thu Feb 05, 2009 7:22 pm Post subject: |
|
|
| Mistwolf wrote: | | You mean the line that starts with "GIF87a"? That is the beginning string for a GIF file. All the "junk" after that is the ascii representation of an image. |
Any idea on how to track it down, and why chkrootkit would think it is a suspect PHP file?
_________________
The day Microsoft makes a product that doesn't suck, is the day they make a vacuum cleaner. |
|
| Back to top |
|
|
Dralnu
Veteran
Joined: 24 May 2006
Posts: 1919
|
| Posted: Thu Feb 05, 2009 7:22 pm Post subject: |
|
|
| yabbadabbadont wrote: | | Boot a live cd that has chkrootkit and run it from there. If it is possible to check the non-running system that is... I've never tried it. |
I'll have to do that. Thanks
_________________
The day Microsoft makes a product that doesn't suck, is the day they make a vacuum cleaner. |
|
| Back to top |
|
|
|
Networking & Security
