From owner-freebsd-questions@FreeBSD.ORG  Thu May 13 12:25:49 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0C64016A4CE
	for <freebsd-questions@freebsd.org>;
	Thu, 13 May 2004 12:25:49 -0700 (PDT)
Received: from peter.smxy.org (smxy.org [64.32.179.41])
	by mx1.FreeBSD.org (Postfix) with ESMTP id AF03143D5F
	for <freebsd-questions@freebsd.org>;
	Thu, 13 May 2004 12:25:48 -0700 (PDT)	(envelope-from ste@smxy.org)
Received: from localhost (localhost [127.0.0.1])
	by peter.smxy.org (Postfix) with ESMTP id ED9EB250E
	for <freebsd-questions@freebsd.org>;
	Thu, 13 May 2004 15:25:47 -0400 (EDT)
Received: from smxy.org ([127.0.0.1])
 by localhost (peter.smxy.org [127.0.0.1]) (amavisd-new, port 10025)
 with ESMTP id 30018-08 for <freebsd-questions@freebsd.org>;
 Thu, 13 May 2004 15:25:47 -0400 (EDT)
Received: from smxy.org (watchdog.blackdogsoft.net [65.206.7.158])
	by peter.smxy.org (Postfix) with ESMTP
	for <freebsd-questions@freebsd.org>;
	Thu, 13 May 2004 15:25:47 -0400 (EDT)
Message-ID: <40A3CBB8.1090202@smxy.org>
Date: Thu, 13 May 2004 15:25:44 -0400
From: "Shaun T. Erickson" <ste@smxy.org>
User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new-20030616-p9 at smxy.org
Subject: chkrootkit says 'date' is infected
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: ste@smxy.org
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 May 2004 19:25:49 -0000

I just installed and ran the chkrootkit port on my 5.2.1-RELEASE-p5 
system. It says my date command is infected. Nothing else, just that. 
How can I determine if this is a false positive or if I'm truly hacked?

	-ste