Package: chkrootkit Version: 0.49-4.1 Severity: normal Dear Maintainer,
chkrootkit reports false positives blackbox:~# /etc/cron.daily/chkrootkit /usr/lib/jvm/.java-1.7.0-openjdk-i386.jinfo /usr/lib/jvm/.java-6-sun.jinfo /usr/lib/jvm/java-1.5.0-gcj-4.4/.java-gcj-4.4.jinfo /usr/lib/jvm/.java-1.6.0-openjdk-i386.jinfo /usr/lib/jvm/java-6-sun-1.6.0.26/.systemPrefs /usr/lib/python2.6/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/debug/.build-id /usr/lib/icedove/.autoreg /usr/lib/pymodules/python2.6/.path /usr/lib/pymodules/python2.7/.path /usr/lib/xulrunner-1.9.1/.autoreg /usr/lib/debug/.build-id eth0: PACKET SNIFFER(/sbin/dhclient[3584], /usr/sbin/ntop[3799]) The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! root 2504 tty7 /usr/bin/X :0 vt7 -br -nolisten tcp -auth /var/run/xauth/A:0-JbRRca ! root 18668 tty8 /usr/bin/X :1 vt8 -br -nolisten tcp -auth /var/run/xauth/A:1-Kntgia blackbox:~# on my system. Most of the files are even part of debian packages....wouldn't it make sense to run dpkg -S for all the suspicious files before reporting them? rd@blackbox:~/tmp.nobackup/Maps$ for f in /usr/lib/xulrunner/.autoreg /usr/lib/jvm/.java-1.7.0-openjdk-i386.jinfo /usr/lib/jvm/.java-6-sun.jinfo /usr/lib/jvm/java-1.5.0-gcj-4.4/.java-gcj-4.4.jinfo /usr/lib/jvm/.java-1.6.0-openjdk-i386.jinfo /usr/lib/jvm/java-6-sun-1.6.0.26/.systemPrefs /usr/lib/python2.6/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/debug/.build-id /usr/lib/icedove/.autoreg /usr/lib/pymodules/python2.6/.path /usr/lib/pymodules/python2.7/.path /usr/lib/xulrunner-1.9.1/.autoreg /usr/lib/debug/.build-id; do dpkg -S $f; done dpkg-query: Kein Pfad gefunden, der auf Muster /usr/lib/xulrunner/.autoreg passt openjdk-7-jre-headless:i386: /usr/lib/jvm/.java-1.7.0-openjdk-i386.jinfo sun-java6-bin: /usr/lib/jvm/.java-6-sun.jinfo gcj-4.4-jre-headless: /usr/lib/jvm/java-1.5.0-gcj-4.4/.java-gcj-4.4.jinfo openjdk-6-jre-headless:i386: /usr/lib/jvm/.java-1.6.0-openjdk-i386.jinfo sun-java6-jre: /usr/lib/jvm/java-6-sun-1.6.0.26/.systemPrefs python-qt4: /usr/lib/python2.6/dist-packages/PyQt4/uic/widget-plugins/.noinit python-qt4: /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit libqt4-dbg, libtelepathy-glib0-dbg:i386: /usr/lib/debug/.build-id icedove: /usr/lib/icedove/.autoreg dpkg-query: Kein Pfad gefunden, der auf Muster /usr/lib/pymodules/python2.6/.path passt dpkg-query: Kein Pfad gefunden, der auf Muster /usr/lib/pymodules/python2.7/.path passt xulrunner-1.9.1: /usr/lib/xulrunner-1.9.1/.autoreg libqt4-dbg, libtelepathy-glib0-dbg:i386: /usr/lib/debug/.build-id rd@blackbox:~/tmp.nobackup/Maps$ e.g. rd@blackbox:~/tmp.nobackup/Maps$ for f in /usr/lib/xulrunner/.autoreg /usr/lib/jvm/.java-1.7.0-openjdk-i386.jinfo /usr/lib/jvm/.java-6-sun.jinfo /usr/lib/jvm/java-1.5.0-gcj-4.4/.java-gcj-4.4.jinfo /usr/lib/jvm/.java-1.6.0-openjdk-i386.jinfo /usr/lib/jvm/java-6-sun-1.6.0.26/.systemPrefs /usr/lib/python2.6/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/debug/.build-id /usr/lib/icedove/.autoreg /usr/lib/pymodules/python2.6/.path /usr/lib/pymodules/python2.7/.path /usr/lib/xulrunner-1.9.1/.autoreg /usr/lib/debug/.build-id; do if ! dpkg -S $f > /dev/null 2>/dev/null; then echo $f; fi ; done /usr/lib/xulrunner/.autoreg /usr/lib/pymodules/python2.6/.path /usr/lib/pymodules/python2.7/.path rd@blackbox:~/tmp.nobackup/Maps$ reports the three really suspicous files. Thanks, Rainer -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (500, 'testing'), (300, 'unstable'), (200, 'experimental') Architecture: i386 (i686) Kernel: Linux 3.2.0-4-686-pae (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages chkrootkit depends on: ii binutils 2.22-7.1 ii debconf [debconf-2.0] 1.5.46 ii libc6 2.13-37 ii net-tools 1.60-24.2 ii procps 1:3.3.3-2 chkrootkit recommends no packages. chkrootkit suggests no packages. -- debconf information: * chkrootkit/run_daily: true * chkrootkit/run_daily_opts: -q * chkrootkit/diff_mode: false -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
