Strange file appeared in my home directory

Jonathan Chen jonc at chen.org.nz
Fri Oct 29 14:07:34 PDT 2004


On Fri, Oct 29, 2004 at 10:51:40PM +0000, Daniela wrote:

[...]
> I quickly checked my system with the native FreeBSD tool "chkrootkit". It 
> showed the following files as infected: ps, ls, date, chsh and chfn.
> Now I'm really scared. However, I heard that this tool has a bug which gives 
> false alarm for five files, but I don't know if I have a buggy version.

FreeBSD doesn't come with chrootkit. The one in the ports reports
so many false positives that it is practically useless. I wouldn't
depend on it to make any decision.

Having said this, if you're worried about system tampering, all you
really need to do is to grab an installation CD; backup /etc, and reinstall
the kernel, libraries and binaries, restore /etc and you're away.

Cheers.
-- 
Jonathan Chen <jonc at chen.org.nz>
----------------------------------------------------------------------
                        "Irrationality is the square root of all evil"
                                                  - Douglas Hofstadter


More information about the freebsd-questions mailing list