Package: chkrootkit Version: 0.47-1.1 Severity: normal
------ From: Cron Daemon <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Cron <[EMAIL PROTECTED]> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) /etc/cron.daily/chkrootkit: The following suspicious files and directories were found: /lib/init/rw/.ramfs INFECTED (PORTS: 3049) ------ [EMAIL PROTECTED]:~# netstat -a | grep 3049 tcp 0 0 *:3049 *:* LISTEN [EMAIL PROTECTED]:~# lsof -i:3049 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME rpc.statd 1784 statd 7u IPv4 4371 TCP *:3049 (LISTEN) [EMAIL PROTECTED]:~# this deamon is provided by nfs-common package, and is automaticly started on boot if it was installed (don't need any configuration). -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (500, 'stable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18-6-686 Locale: LANG=pl_PL.UTF-8, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) Versions of packages chkrootkit depends on: ii binutils 2.17-3 The GNU assembler, linker and bina ii debconf [debconf-2.0] 1.5.11etch1 Debian configuration management sy ii libc6 2.3.6.ds1-13etch5 GNU C Library: Shared libraries ii net-tools 1.60-17 The NET-3 networking toolkit ii procps 1:3.2.7-3 /proc file system utilities chkrootkit recommends no packages. -- debconf information: chkrootkit/run_daily_opts: -q chkrootkit/run_daily: false chkrootkit/diff_mode: false -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
