From owner-freebsd-questions@FreeBSD.ORG Fri Oct 29 21:07:34 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 171D316A4CE for ; Fri, 29 Oct 2004 21:07:34 +0000 (GMT) Received: from chen.org.nz (chen.org.nz [210.54.19.51]) by mx1.FreeBSD.org (Postfix) with ESMTP id CB03943D67 for ; Fri, 29 Oct 2004 21:07:33 +0000 (GMT) (envelope-from jonc@chen.org.nz) Received: by chen.org.nz (Postfix, from userid 1000) id 000DFC13E; Sat, 30 Oct 2004 10:07:31 +1300 (NZDT) Date: Sat, 30 Oct 2004 10:07:31 +1300 From: Jonathan Chen To: Daniela Message-ID: <20041029210731.GA15001@grimoire.chen.org.nz> References: <200410282113.34529.dgw@liwest.at> <41814A0F.7050909@gmx.net> <200410292251.40307.dgw@liwest.at> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200410292251.40307.dgw@liwest.at> User-Agent: Mutt/1.4.2.1i cc: questions@freebsd.org Subject: Re: Strange file appeared in my home directory X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Oct 2004 21:07:34 -0000 On Fri, Oct 29, 2004 at 10:51:40PM +0000, Daniela wrote: [...] > I quickly checked my system with the native FreeBSD tool "chkrootkit". It > showed the following files as infected: ps, ls, date, chsh and chfn. > Now I'm really scared. However, I heard that this tool has a bug which gives > false alarm for five files, but I don't know if I have a buggy version. FreeBSD doesn't come with chrootkit. The one in the ports reports so many false positives that it is practically useless. I wouldn't depend on it to make any decision. Having said this, if you're worried about system tampering, all you really need to do is to grab an installation CD; backup /etc, and reinstall the kernel, libraries and binaries, restore /etc and you're away. Cheers. -- Jonathan Chen ---------------------------------------------------------------------- "Irrationality is the square root of all evil" - Douglas Hofstadter