Re: [cobalt-users] chkrootkit 0.35 on RaQ2

[Gerald Waugh <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>]

On Thursday 16 May 2002 01:23 pm, Mike Scioli wrote:
<snip>
> All of the returned the result "INFECTED" which, I assume is a Good Thing
> (TM).  The only anomaly reported was:
>
> Searching for anomalies in shell history files... Warning:
> `//root/.bash_history' file size is zero
>
> Is this anything to be concerned about?

http://list.cobalt.com/pipermail/cobalt-security/2001-December/004114.html

All my RaQ2s read like this; I logged in May 16 14:32 .bash_history, so the 
file was just created.
-rw-------   1 root     root            0 May 16 14:32 .bash_history
I logged out and back in;
-rw-------   1 root     root            0 May 16 14:38 .bash_history
and it created a new file, always zero though, 
I think its normal for a RaQ2.

It is different though on a RaQ3 and RaQ4


-- 
Gerald Waugh 
http://www.frontstreetnetworks.com :: Phone. [011] 203.785.0699
Front Street Networks LLC | SOHO Networks & Web Site Hosting
229 Front Street, Ste. #C, New Haven, CT, 06513-3203 United States