On Thu, 6 Feb 2003, Remington L. wrote:

> I'm using 5.0 release
>
> OK I was just going through and I found that chkrootkit found that chfn,
> chsh, date, and ls are infected. I'm not sure if it's lying or not. I
> attempted to fix ls by recompiling from /usr/src/bin/ls and redoing but
> chkrootkit still says infected. That's all the information I can provide
> at this time. Has anyone come across this problem? Any suggestions?
> Could be 5.0 causing this or is there some validity to it?


You're not infected. chkrootkit checks for the presence of "/bin/sh" or
"/bin/csh" in output of `strings <binary>`, and apparently this no longer
works. You'll have to wait for chkrootkit to be updated to support FreeBSD
5.

- Jeff


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message

Reply via email to