From owner-freebsd-stable@FreeBSD.ORG  Wed May  5 03:29:45 2004
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D292416A4CF
	for <freebsd-stable@freebsd.org>;
	Wed,  5 May 2004 03:29:45 -0700 (PDT)
Received: from grunt22.ihug.com.au (grunt22.ihug.com.au [203.109.249.142])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5210F43D2D
	for <freebsd-stable@freebsd.org>;
	Wed,  5 May 2004 03:29:45 -0700 (PDT)
	(envelope-from ebroh@ihug.com.au)
Received: from p278-tnt10.syd.ihug.com.au [203.173.154.24] 
	by grunt22.ihug.com.au with esmtp (Exim 3.35 #1 (Debian))
	id 1BLJeo-0000pS-00; Wed, 05 May 2004 20:29:43 +1000
From: Ebroh <ebroh@ihug.com.au>
Organization: Idlemen
To: freebsd-stable@freebsd.org
Date: Wed, 5 May 2004 20:30:00 +1000
User-Agent: KMail/1.6.2
References: <200405050951.i459psAN032283@gir.olymail.net>
In-Reply-To: <200405050951.i459psAN032283@gir.olymail.net>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200405052030.01223.ebroh@ihug.com.au>
Subject: Re: chkrootkit
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: ebroh@ihug.com.au
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 05 May 2004 10:29:45 -0000

Mentioned files has been incorrectly detected for ages, in both 4.x and 
5.x

I quit feeding my paranoid mind long ago by not using chkrootkit, do the
same :)

On Wed, 5 May 2004 07:54 pm, jeff wrote:
> The latest version of chkrootkit marks 3 files as being "INFECTED"; "chfn
> chsh date"
> The system is FreeBSD 4.10-BETA #2: Sun Apr 18 00:31:19 PDT 2004
>
> These files are not detected correctly by the chkrootkit program or all my
> 4.10 boxes have been "owned" or the source has been compromised.
>
>
>
> _______________________________________________
> freebsd-stable@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"