From owner-freebsd-questions@FreeBSD.ORG  Wed Jan 28 22:14:01 2009
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 8DBCE106584D
	for <freebsd-questions@freebsd.org>;
	Wed, 28 Jan 2009 22:14:01 +0000 (UTC)
	(envelope-from lumiwa@gmail.com)
Received: from yx-out-2324.google.com (yx-out-2324.google.com [74.125.44.30])
	by mx1.freebsd.org (Postfix) with ESMTP id 4148A8FC22
	for <freebsd-questions@freebsd.org>;
	Wed, 28 Jan 2009 22:14:00 +0000 (UTC)
	(envelope-from lumiwa@gmail.com)
Received: by yx-out-2324.google.com with SMTP id 8so2859944yxb.13
	for <freebsd-questions@freebsd.org>;
	Wed, 28 Jan 2009 14:14:00 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:from:to:subject:date
	:user-agent:mime-version:content-type:content-transfer-encoding
	:content-disposition:message-id;
	bh=cjFU1EL8PbgjlMvLZCSL9+ujfa9zXb9ps6lU2bZteq8=;
	b=qbVBMyCmarFwBqLxjoqNizIbEhCzQ59Cmu+vheIbHVICq9YvzTiMfYukOUzAMelVtG
	ySNh7YwYuQ1kqDxb8gFgMaNdhn6r8A94x5zA/jI4sbCClRtWt10nl2mDQBCIY3Vpty7Y
	fX1xd2g4JPIQ4ZlYB7+i3OTzUHBtEI0txxj54=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=from:to:subject:date:user-agent:mime-version:content-type
	:content-transfer-encoding:content-disposition:message-id;
	b=aayAfy+X8OzcGS3IJo1sV/hxLgtThew23Pm456UVqA3IMh7oIjFkJ9vkeysfRLWC4R
	L+aEPlJwe5HWOwNA6h66A+Z8Vynla9dpkSxH3jXBkWM0dBZANwTCz4Nigp5DSzFbDqht
	BBvUeAw92D7ksY4hcPzs+N/p8gda4/XCAS8fc=
Received: by 10.100.92.2 with SMTP id p2mr1163771anb.52.1233180839952;
	Wed, 28 Jan 2009 14:13:59 -0800 (PST)
Received: from ?192.168.0.100? (CPE-65-29-54-222.wi.res.rr.com [65.29.54.222])
	by mx.google.com with ESMTPS id c40sm281936anc.8.2009.01.28.14.13.57
	(version=TLSv1/SSLv3 cipher=RC4-MD5);
	Wed, 28 Jan 2009 14:13:58 -0800 (PST)
From: ajtiM <lumiwa@gmail.com>
To: freebsd-questions@freebsd.org
Date: Wed, 28 Jan 2009 16:13:42 -0600
User-Agent: KMail/1.9.10
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200901281613.43066.lumiwa@gmail.com>
Subject: chkrootkit
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Jan 2009 22:14:02 -0000

Hi!
 
 My system: new installed FreeBSD 7.1, KDE 3.5.10
 
 I ran chkrootkit and I got:
 
 ...
 Checking `sshd'... /usr/bin/strings: Warning: '/' is not an ordinary file
 ...
 ...
 Searching for t0rn's default files and dirs... nothing found
 Searching for t0rn's v8 defaults... Possible t0rn v8 \(or variation\) rootkit 
installed...
 
 I ran rkhunter -c also and on the end I have:
 
 System checks summary
 =====================
 
 File properties checks...
 Required commands check failed
 Files checked: 103
 Suspect files: 0
 
 Rootkit checks...
 Rootkits checked : 77
 Possible rootkits: 0
 
 Applications checks...
 Applications checked: 4
 Suspect applications: 0
 
 I am confused about chkrootkit and the line:
 Searching for t0rn's v8 defaults... Possible t0rn v8 \(or variation\) rootkit 
installed...
 
 Thanks in advance.