On 2/13/25 10:50 AM, home user via users wrote:
(f40; gnome; last patched minutes ago)
When I ran chkrootkit, I got the following (including a few lines of context) regarding
"wted":
- - - - - -
[snip]
Checking `w55808'... not infected
Checking `wted'... 1 deletion(s) between Tue Jan 28 07:33:49 2025 and Tue Jan
28 07:36:08 2025
1 deletion(s) between Fri Feb 7 08:13:43 2025 and Fri Feb 7 08:15:51 2025
1 deletion(s) between Sat Feb 8 15:26:59 2025 and Sat Feb 8 15:29:22 2025
1 deletion(s) between Sat Feb 8 15:29:22 2025 and Sat Feb 8 15:31:27 2025
Checking `scalper'... not infected
[snip]
bash.5[~]:
- - - - - -
I got the same thing both before and after "dnf upgrade". rkhunter made no mention of
"wted".
I tried to find what "wted" is:
- - - - - -
bash.5[~]: which wted
/usr/bin/which: no wted in
(/usr/lib64/qt-3.3/bin:/usr/lib64/ccache:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/root/bin)
bash.6[~]: whereis wted
wted:
bash.7[~]: man wted
No manual entry for wted
bash.8[~]: dnf info wted
Last metadata expiration check: 0:23:46 ago on Thu 13 Feb 2025 10:05:51 AM MST.
Error: No matching Packages to list
bash.9[~]:
- - - - - -
duck-duck-go and google gave me nothing useful.
What is "wted", and is there a security problem?
My apologies for the delay in closing this.
As recommended, I no longer run chkrootkit.
As recommended, I no longer run rkhunter.
As recommended, I re-installed fail2ban and launched it.
Most likely, the deletions noted by chkrootkit coincided in time to boot
failures and crashes. These seem to be random.
I thank everyone for their time and effort trying to help.
--
_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
