| 1 |
On Sun, Mar 27, 2011 at 4:09 PM, walt <w41ter@×××××.com> wrote: |
| 2 |
> I just got an email from cron on my ~amd64 machine, containing these lines: |
| 3 |
> |
| 4 |
> Checking 'find'... INFECTED |
| 5 |
> Checking 'netstat'... INFECTED |
| 6 |
> |
| 7 |
> Took me a few minutes to deduce that sys-forensics/chkrootkit was the source |
| 8 |
> of those messages. I ran chkrootkit manually and found the same messages in |
| 9 |
> the output. |
| 10 |
> |
| 11 |
> I then nervously re-emerged findutils and net-tools, but chkrootkit again |
| 12 |
> found |
| 13 |
> the same binaries to be "INFECTED". |
| 14 |
> |
| 15 |
> Running chkrootkit on my ~x86 machine turns up no such infections even |
| 16 |
> though |
| 17 |
> the same packages are installed on both machines. |
| 18 |
> |
| 19 |
> Anyone have any insight into how chkrootkit works, or why the different |
| 20 |
> results? |
| 21 |
> |
| 22 |
> Or, can anyone reproduce my problem? |
| 23 |
|
| 24 |
chkrootkit is old, has not been updated in years+, and those are false |
| 25 |
alarms. I got the exact same ones. Basically, chkrootkit is just |
| 26 |
grepping for a string inside those files: |
| 27 |
|
| 28 |
/usr/bin/find: sharefile.h |
| 29 |
/bin/netstat: sockaddr.h |
| 30 |
|
| 31 |
You may find that if you strip those 2 binaries of debug data, the |
| 32 |
false positives go away. |
Archives