Re: False positives from chkrootkit? or hacked test server?

2004-04-15 Thread Matthew Seaman
On Wed, Apr 14, 2004 at 12:29:19PM -0700, Mike wrote: Well... I installed and ran chkrootkit. And the output shows that: Checking `chfn'... INFECTED Checking `chsh'... INFECTED Checking `date'... INFECTED Checking `ls'... INFECTED Checking `ps'... INFECTED No rootkits were found.

Re: False positives from chkrootkit? or hacked test server?

2004-04-15 Thread Martin Hudec
Hello, thanks for the info :), that explains why my 4.9-STABLE was not infected and 4.10-BETA shows false positives.. But I am still bit unsure why my 5.2.1-RELEASE-p4 (not mentioning one false positive) stops while checking lkm.. Cheers, Martin On Thu, Apr 15,

False positives from chkrootkit? or hacked test server?

2004-04-14 Thread Mike
Greetings: My test system: FreeBSD 4.9-stable Pentium III 800 I read an earlier post about using chkrootkit to check for root kits (intrusions). I'm still learning about FreeBSD so I thought I would run this too. Well... I installed and ran chkrootkit. And the output shows that: Checking

Re: False positives from chkrootkit? or hacked test server?

2004-04-14 Thread Bob Collins
On Wed, Apr 14, 2004, Mike clacked the keyboard to produce: Greetings: My test system: FreeBSD 4.9-stable Pentium III 800 I read an earlier post about using chkrootkit to check for root kits (intrusions). I'm still learning about FreeBSD so I thought I would run this too. Well...

Re: False positives from chkrootkit? or hacked test server? [SOLVED]

2004-04-14 Thread Mike
Jeff Maxwell wrote: upgrade your ports. The chkrootkit that ships with 4.9 gives false positives Jeff: Thanks for the tip. I deinstalled the chkrootkit (v-4.1) that came with 4.9. I then downloaded and installed the most recent version (v-4.3) from the chkrootkit.org site. I re-ran

Re: False positives from chkrootkit? or hacked test server?

2004-04-14 Thread Martin Hudec
Hello all, On Wed, Apr 14, 2004 at 02:11:34PM -0700 or thereabouts, Mike wrote: Jeff Maxwell wrote: upgrade your ports. The chkrootkit that ships with 4.9 gives false positives I'm using chrootkit from fresh ports update (v4.3). Results are as: System 1 on 4.9-STABLE: nothing