On Tue, 08 May 2012 10:46:13 -0600 JD <jd1...@gmail.com> wrote: > Searching for Suckit rootkit... Warning: /sbin/init INFECTED > > lrwxrwxrwx 1 root root 14 May 8 10:19 /sbin/init -> ../bin/systemd > rwxr-x-r-x 1 root root 917320 Apr 17 01:50 /bin/systemd > $ sha256sum /bin/systemd > 73054e573603f8894c6df2078b7714f7533d5b95653b536e7f07d2c8f3f09bc1 > /bin/systemd > > Is chkrootkit confused?
Yes and no. It correctly detects that your /sbin/init is something hideous and nasty, but fails to realise that it's something hideous and nasty that Fedora ships 8) In all seriousness its a bug in chkrootkit, which has been reported repeatedly and ignored repeatedly. It treats the linked /sbin/init as suspicious because some rootkits did exactly that. Alan -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
