Re: rkhunter / chkrootkit

2004-11-07 Thread Mark-Walter
Hi Rick, > Why don't you make a copy of one or more of those binaries, then > re-retrieve and install the Woody package of the same release, and > compare md5sums of the resulting binaries? (Note that you should make > very sure it's the same release, or you'll get a different md5sum for > entire

Re: rkhunter / chkrootkit

2004-11-06 Thread Rick Moen
Quoting [EMAIL PROTECTED] ([EMAIL PROTECTED]): > Rootkit Hunter found some bad or unknown hashes. This can be happen due > replaced binaries or updated packages (which give other hashes). Be sure > your hashes are fully updated (rkhunter --update). If you're in doubt > about these hashes, contact

Re: rkhunter / chkrootkit

2004-11-06 Thread s. keeling
Incoming from [EMAIL PROTECTED]: > > chkrootkit found nothing but rkhunter found quite a lot: > > /bin/login /bin/su /usr/bin/locate /usr/sbin/useradd /usr/sbin/usermod > /usr/sbin/vip > > All these binaries have been alerted within rkhunter. > > I got a message like this [ and there was indeed