Date: Sun, 8 Jun 2003 9:20:32 -0400 From: cas <xcas@cox.net> To: "Perry S. Glenn" <psglenn@yahoo.com>, freebsd-current@freebsd.org Subject: Re: chkrootkit w/ current Message-ID: <20030608132039.IAFQ27845.fed1mtao04.cox.net@smtp.west.cox.net>
next in thread | raw e-mail | index | archive | help
============================================================ From: "Perry S. Glenn" <psglenn@yahoo.com> Date: 2003/06/08 Sun AM 03:44:35 EDT To: freebsd-current@freebsd.org Subject: chkrootkit w/ current Hello, I'm running current and I had left forgot to turn the ftp knob in inetd.conf off. I came back after a drive to find my /var/ filesystem full. I did not (per sysinstall)have anon ftp on, but someone made lots of bogus directories in /var/ftp/pub anyway. I decided to install /ports/security/chkrootkit after a short google. chkrootkit says it finds 12 processes hidden from ps command and a possible LKM Trojan installed. chkroot also calls ls ps date chsh and chfn "INFECTED" Is chkrootkit giving accurate info for FreeBSD-5 ? Could someone check to see if they get false positives with this script on current. TIA --psglenn ============================================================ yes.. it does give false positives.. I asked the same question about those commands. :-)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030608132039.IAFQ27845.fed1mtao04.cox.net>