[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [cobalt-users] RAQ2 chkrootkit - passwd INFECTED
- Subject: RE: [cobalt-users] RAQ2 chkrootkit - passwd INFECTED
- From: "Paul Alcock" <webmgr@xxxxxxxxxxxxxxxxxx>
- Date: Mon Oct 21 10:22:12 2002
- List-id: Mailing list for users to share thoughts on Sun Cobalt products. <cobalt-users.list.cobalt.com>
> > Hi, just installed the new version -0.37 of chkrootkit on my
> RAQ2 and all
> > seemed clear except
> > passwd - INFECTED
> > Is this an error result or a likely infection of something (no other
> errors)
> > If it is an infection (?) can I just replace/restore the
> appropriate (???)
> > passwd files?
> >
>
> try running it a couple of times more. sometimes chkrootkit can
> come up with
> false positives.
>
> andy
Thanks Andy, I'll do that (first few times it read the same.)
BTW, any idea which files it is inspecting when it does the passwd check?
(wondered if it's a file that has an md5 someplace..)
Paul