![](https://seccdn.libravatar.org/avatar/067a8ec0e8913d7be67493308f3f4956.jpg?s=120&d=mm&r=g)
Op zaterdag 11 mei 2002 08:02, schreef LTG:
Hi all, I run cheroot-kit to control something on my Linux box. I have got result as following:
Searching for suspicious files and dirs, it may take a while... /usr/lib/perl5/5.6.0/i586-linux/.packlist /usr/lib/perl5/5.6.0/i586-linux/auto/GD/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/PDL/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tk/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Locale/gettext/.packli st /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Alien/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Storable/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/MIME/Base64/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tie/IxHash/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Net/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Digest/MD5/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Apache/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/w3mir/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Weblint/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Mail/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/URI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBD/Pg/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/libwww-perl/.packlist Searching for LPD Worm files and dirs... nothing found Does anyone have any idea on this? Do my box has got a bad installation? Do i have to delete thise files?
TIA Regards, LTG
NO, I don't think you have to worry about these "suspect" files, especially when chkrootkit didn't find any other signs of known rootkits. Some worms/rootkits are known to install scripts as (hidden) dotfiles. This is what chkrootkit looks for and subsequently reports. If you want to be shure, just open mentioned files in an editor and check what they are. You'll probably see that they are what their names imply: packlists. (However, if these files are indeed scripts or binaries, you're in real trouble. Deleting just these files won't be enough then.) cheers, Marcel