Which operating system are you using (uname -a)? I never saw any system using this file load.zk, but it can be a false positive (it happened before with other files). Can you also show us the content of it?
Thanks for the report. -- Daniel B. Cid dcid ( at ) ossec.net On 7/30/06, Joe Barr <[EMAIL PROTECTED]> wrote:
Has anyone seen false positives on a ZK Rootkit alert referring to /etc/sysconfig/console/load.zk? I've gotten it twice on a brand new installation, with nothing having been done other than to install OSSEC-HIDS.
