Strange file appeared in my home directory
Jonathan Chen
jonc at chen.org.nz
Fri Oct 29 14:07:34 PDT 2004
On Fri, Oct 29, 2004 at 10:51:40PM +0000, Daniela wrote:
[...]
> I quickly checked my system with the native FreeBSD tool "chkrootkit". It
> showed the following files as infected: ps, ls, date, chsh and chfn.
> Now I'm really scared. However, I heard that this tool has a bug which gives
> false alarm for five files, but I don't know if I have a buggy version.
FreeBSD doesn't come with chrootkit. The one in the ports reports
so many false positives that it is practically useless. I wouldn't
depend on it to make any decision.
Having said this, if you're worried about system tampering, all you
really need to do is to grab an installation CD; backup /etc, and reinstall
the kernel, libraries and binaries, restore /etc and you're away.
Cheers.
--
Jonathan Chen <jonc at chen.org.nz>
----------------------------------------------------------------------
"Irrationality is the square root of all evil"
- Douglas Hofstadter
More information about the freebsd-questions
mailing list