-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alejandro Cabrera Obed wrote: > Hola, corri chkrootkit en una Linux Fedora Core 3 y me da este resultado > dudoso que a continuacion les transcribo...alguna pista, a que se puede > deber ??? Los demas chequeos me dan OK. Mil gracias desde ya. > > Searching for suspicious files and dirs, it may take a while... > /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/mod_perl/.pack > list > /usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/Gaim/.packlist > /usr/lib/perl5/5.8.5/i386-linux-thread-multi/.packlist > /lib/modules/2.6.9-1.667smp/build/.config > /lib/modules/2.6.9-1.667smp/build/scripts/.conmakehash.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/genksyms/.genksyms.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/genksyms/.lex.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/genksyms/.genksyms.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/genksyms/.parse.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/.pnmtologo.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/basic/.docproc.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/basic/.fixdep.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/basic/.split-include.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/kconfig/.mconf.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/kconfig/.conf.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/kconfig/.libkconfig.so.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/kconfig/.conf.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/kconfig/.zconf.tab.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.file2alias.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.empty.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.modpost.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.sumversion.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.modpost.o.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.elfconfig.h.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/mod/.mk_elfconfig.cmd > /lib/modules/2.6.9-1.667smp/build/scripts/.kallsyms.cmd > /lib/modules/2.6.9-1.667/build/.config > /lib/modules/2.6.9-1.667/build/scripts/.conmakehash.cmd > /lib/modules/2.6.9-1.667/build/scripts/genksyms/.genksyms.cmd > /lib/modules/2.6.9-1.667/build/scripts/genksyms/.lex.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/genksyms/.genksyms.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/genksyms/.parse.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/.pnmtologo.cmd > /lib/modules/2.6.9-1.667/build/scripts/basic/.docproc.cmd > /lib/modules/2.6.9-1.667/build/scripts/basic/.fixdep.cmd > /lib/modules/2.6.9-1.667/build/scripts/basic/.split-include.cmd > /lib/modules/2.6.9-1.667/build/scripts/kconfig/.mconf.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/kconfig/.conf.cmd > /lib/modules/2.6.9-1.667/build/scripts/kconfig/.libkconfig.so.cmd > /lib/modules/2.6.9-1.667/build/scripts/kconfig/.conf.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/kconfig/.zconf.tab.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.file2alias.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.empty.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.modpost.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.sumversion.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.modpost.o.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.elfconfig.h.cmd > /lib/modules/2.6.9-1.667/build/scripts/mod/.mk_elfconfig.cmd > /lib/modules/2.6.9-1.667/build/scripts/.kallsyms.cmd > Se me ocurre que chrootkit encontro algo ahi que no le gusto y los marco como sospechoso... A primera vista, es sospechoso encontrar eso en los modulos del kernel... Que tienen? http://www.google.com/linux?hl=es&q=build%2Fscripts%2Fgenksyms%2F.parse.o.cmd&btnG=B%C3%BAsqueda&lr=
- -- Ricardo A.Frydman Consultor en Tecnología Open Source - Administrador de Sistemas jabber: [EMAIL PROTECTED] - http://www.eureka-linux.com.ar SIP # 1-747-667-9534 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFDQ8v9kw12RhFuGy4RAlyrAJ49OwMr7ueK9jZEVuXyRipq2myQyQCdGy3Y jvJJpH4DWE/P8thM4C4HKx0= =WaAr -----END PGP SIGNATURE----- -- Para desuscribirte tenés que visitar la página https://listas.linux.org.ar/mailman/listinfo/lugar-gral/ /* Publica y encontra trabajo relacionado con softlibre en http://www.usla.org.ar/modules/jobs/ */ Si tenés algún inconveniente o consulta escribí a mailto:[EMAIL PROTECTED]
