Date: Sat, 30 Oct 2004 10:07:31 +1300 From: Jonathan Chen <jonc@chen.org.nz> To: Daniela <dgw@liwest.at> Cc: questions@freebsd.org Subject: Re: Strange file appeared in my home directory Message-ID: <20041029210731.GA15001@grimoire.chen.org.nz> In-Reply-To: <200410292251.40307.dgw@liwest.at> References: <200410282113.34529.dgw@liwest.at> <41814A0F.7050909@gmx.net> <200410292251.40307.dgw@liwest.at>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Oct 29, 2004 at 10:51:40PM +0000, Daniela wrote:
[...]
> I quickly checked my system with the native FreeBSD tool "chkrootkit". It
> showed the following files as infected: ps, ls, date, chsh and chfn.
> Now I'm really scared. However, I heard that this tool has a bug which gives
> false alarm for five files, but I don't know if I have a buggy version.
FreeBSD doesn't come with chrootkit. The one in the ports reports
so many false positives that it is practically useless. I wouldn't
depend on it to make any decision.
Having said this, if you're worried about system tampering, all you
really need to do is to grab an installation CD; backup /etc, and reinstall
the kernel, libraries and binaries, restore /etc and you're away.
Cheers.
--
Jonathan Chen <jonc@chen.org.nz>
----------------------------------------------------------------------
"Irrationality is the square root of all evil"
- Douglas Hofstadter
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041029210731.GA15001>