Hi, Am Sonntag, 1. Februar 2004 20:22 schrieb Anders Johansson:
On Sunday 01 February 2004 20.17, Hartmut Meyer wrote:
I use chkrootkit-0.43 and get no alarm on my SUSE 9.0. "rpm -Vf $(which top)" reports nothing here:
linux:~ # /usr/local/src/chkrootkit-0.43/chkrootkit | grep top Checking `top'... not infected linux:~ # rpm -Vf $(which top) linux:~ #
The problem is in the "top" in the ps package from /pub/people/kraxel The top binary in that contains the string "/prof", which chkrootkit detects as a sign of an infected binary
That string isn't in the src.rpm from kraxel's directory, and if you rebuild the rpm from that src.rpm you also won't see that string.
I admit: I hadn't followed the thread - I was not aware that this was about the rpm package from the people/kraxel directory. I have no clue about that but have forwarded your comments. Greetings from Bremen hartmut