Re: F12 Rkhunter, Have I a rootkit?

[Simon Schneebeli]

Hm. I think that telling someone to ignore a message like this would be 
like telling people "hey there is a pandemia, but just ignore it".

Either there is a warning for a potential danger (if there is really a 
danger) or there is no danger (and there should be no warning). 
Otherwise, in the future, such warnings go unheard even if there is a 
real danger.

Just my psychological bit of conclusion drawn from the current pandemia 
hysteria...

Simon

Frank Murphy (Frankly3D) wrote:
On 05/01/10 11:06, Andrew Haley wrote:
On 01/05/2010 10:54 AM, Frank Murphy (Frankly3D) wrote:
---------------------- Start Rootkit Hunter Scan ----------------------
Warning: Network TCP port 47107 is being used by
/usr/lib64/thunderbird-3.0/thunderbird-bin. Possible rootkit: T0rn
         Use the 'lsof -i' or 'netstat -an' command to check this.


Results of lsof -i' and 'netstat -an'
http://fpaste.org/xOOO/
Port 47107 isn't being used any more.  This was just TCP using a random
unreserved port.

Andrew.


Basically ignore this in future, with that port?


--
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines