I installed ckrootkit and its reports includes:
ROOTDIR is `/'
<snip>
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Locale/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Net/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Bit/Vector/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Date/Calc/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/WebFetch/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/AppConfig/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/Template/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/GD/Graph/.packlist
/usr/lib/perl5/site_perl/5.6.1/i386-linux/auto/GD/Text/.packlist
<snip>
Checking `sniffer'... Checking `wted'... nothing deleted
Checking `z2'... user root deleted or never loged from lastlog!
.. interesting.
I suspect the tool is not flawless.
On the other hand I probably logged in as root at some time. But I cannot
tell for sure. It must have been a long time ago anyway.
--
Michal Suchanek
[EMAIL PROTECTED]
Want to buy your Pack or Services from MandrakeSoft?
Go to http://www.mandrakestore.com
