Hi all, I run cheroot-kit to control something on my Linux box. I have got result as following: Searching for suspicious files and dirs, it may take a while... /usr/lib/perl5/5.6.0/i586-linux/.packlist /usr/lib/perl5/5.6.0/i586-linux/auto/GD/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/PDL/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tk/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Locale/gettext/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Alien/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Storable/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/MIME/Base64/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tie/IxHash/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Net/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Digest/MD5/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Apache/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/w3mir/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Weblint/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Mail/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/URI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBD/Pg/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/libwww-perl/.packlist Searching for LPD Worm files and dirs... nothing found Does anyone have any idea on this? Do my box has got a bad installation? Do i have to delete thise files? TIA Regards, LTG
Hi Gang, I've just done an install of 8.0 and all appeared to go well, except for the CD-ROM. I have an HP 8100i IDE burner on /dev/hdb, which has worked fine as a cdrom on 7.3, but 8.0 detects it as a burner, and allows me to mount stuff on it, and will not recognise it as /dev/cdrom... Any clues ? Jon
Jon Biddell wrote:
Hi Gang,
I've just done an install of 8.0 and all appeared to go well, except for the CD-ROM.
I have an HP 8100i IDE burner on /dev/hdb, which has worked fine as a cdrom on 7.3, but 8.0 detects it as a burner, and allows me to mount stuff on it, and will not recognise it as /dev/cdrom...
Go to: http://sdb.suse.de/en/sdb/html/SUSE.80.html Read: Package Installation from the CD with YaST2 Not Possible (07. May 2002) (http://sdb.suse.de/en/sdb/html/yast2_pakete_installieren.html) P.S. /dev/cdrom is a link to the actual device file. I assume your cd burner is now /dev/sr0. Remove /dev/cdrom and run this command: ln -s /dev/sr0 /dev/cdrom -- Rafael
On Sat, 11 May 2002 13:02:18 +0700 "LTG" <012801849@mobitel.com.kh> wrote:
Does anyone have any idea on this? Do my box has got a bad installation? Do i have to delete thise files?
Leave the files alone they are part of a perl install. What this part of checkrootkit does is to search for hidden dot files in non home directories (rootkits sometimes uses this to hide files). You need to be familiar with what is installed on your system to make a judgement here. Charles
Op zaterdag 11 mei 2002 08:02, schreef LTG:
Hi all, I run cheroot-kit to control something on my Linux box. I have got result as following:
Searching for suspicious files and dirs, it may take a while... /usr/lib/perl5/5.6.0/i586-linux/.packlist /usr/lib/perl5/5.6.0/i586-linux/auto/GD/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/PDL/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tk/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Locale/gettext/.packli st /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Alien/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Storable/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/MIME/Base64/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Tie/IxHash/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/HTML/Parser/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Net/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Digest/MD5/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Apache/DBI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/w3mir/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Weblint/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/Mail/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/URI/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/DBD/Pg/.packlist /usr/lib/perl5/site_perl/5.6.0/i586-linux/auto/libwww-perl/.packlist Searching for LPD Worm files and dirs... nothing found Does anyone have any idea on this? Do my box has got a bad installation? Do i have to delete thise files?
TIA Regards, LTG
NO, I don't think you have to worry about these "suspect" files, especially when chkrootkit didn't find any other signs of known rootkits. Some worms/rootkits are known to install scripts as (hidden) dotfiles. This is what chkrootkit looks for and subsequently reports. If you want to be shure, just open mentioned files in an editor and check what they are. You'll probably see that they are what their names imply: packlists. (However, if these files are indeed scripts or binaries, you're in real trouble. Deleting just these files won't be enough then.) cheers, Marcel
participants (5)
-
Charles Philip Chan -
Jon Biddell -
LTG -
Marcel Broekman -
Rafael E. Herrera