Hi, Am Sonntag, 1. Februar 2004 18:49 schrieb David Herman:
I was really hoping that checkroot was giving a false positive. I did fill out the webform at feedback.suse but who knows how long that will take.
You won't get a reply (other than the automatic one). The feedback form is by no means a support interface: http://portal.suse.com/sdb/en/2001/10/bugreport.html BTW: you might want to check what rpm thinks about your top binary: rpm -Vf $(which top) Of course: *if* your system is rooted, then you can't trust the output of rpm on that system either. But *if* rpm reports a changed MD5 checksum on the top binary (see "man rpm" for how to interpret the output of "rpm -V ..."), then you know you're done. I use chkrootkit-0.43 and get no alarm on my SUSE 9.0. "rpm -Vf $(which top)" reports nothing here: linux:~ # /usr/local/src/chkrootkit-0.43/chkrootkit | grep top Checking `top'... not infected linux:~ # rpm -Vf $(which top) linux:~ # Greetings from Bremen hartmut