unsp...@hushmail.com wrote: > Let's not guess or speculate but ask you to post nfo: > - from syslog or yum.log the packages that got installed as deps of ImageMagick,
Nov 11 08:45:21 Updated: libacl-2.2.39-8.el5.x86_64 Nov 11 08:45:22 Installed: libgsf-1.14.1-6.1.x86_64 Nov 11 08:45:22 Installed: libfontenc-1.0.2-2.2.el5.x86_64 Nov 11 08:45:22 Installed: libXfont-1.2.2-1.0.4.el5_7.x86_64 Nov 11 08:45:22 Installed: 1:xorg-x11-font-utils-7.1-3.x86_64 Nov 11 08:45:22 Installed: libcroco-0.6.1-2.1.x86_64 Nov 11 08:45:22 Updated: gamin-0.1.7-10.el5.x86_64 Nov 11 08:45:22 Installed: ttmkfdir-3.0.9-23.el5.x86_64 Nov 11 08:45:23 Installed: libFS-1.0.0-3.1.x86_64 Nov 11 08:45:23 Installed: lcms-1.18-0.1.beta1.el5_3.2.x86_64 Nov 11 08:45:23 Installed: libwmf-0.2.8.4-10.2.x86_64 Nov 11 08:45:23 Installed: avahi-0.6.16-10.el5_6.i386 Nov 11 08:45:23 Installed: libattr-2.4.32-1.1.i386 Nov 11 08:45:24 Installed: libacl-2.2.39-8.el5.i386 Nov 11 08:45:24 Installed: avahi-glib-0.6.16-10.el5_6.i386 Nov 11 08:45:24 Installed: libIDL-0.8.7-1.fc6.i386 Nov 11 08:45:24 Installed: ORBit2-2.14.3-5.el5.i386 Nov 11 08:45:25 Installed: GConf2-2.14.0-9.el5.i386 Nov 11 08:45:26 Installed: libbonobo-2.16.0-1.1.el5_5.1.i386 Nov 11 08:45:26 Installed: gamin-0.1.7-10.el5.i386 Nov 11 08:45:27 Installed: gnome-vfs2-2.16.2-8.el5.i386 Nov 11 08:45:27 Installed: librsvg2-2.16.1-1.el5.x86_64 Nov 11 08:45:28 Installed: libgsf-1.14.1-6.1.i386 Nov 11 08:45:28 Installed: libcroco-0.6.1-2.1.i386 Nov 11 08:45:28 Installed: librsvg2-2.16.1-1.el5.i386 Nov 11 08:45:28 Installed: libwmf-0.2.8.4-10.2.i386 Nov 11 08:45:28 Installed: lcms-1.18-0.1.beta1.el5_3.2.i386 Nov 11 08:45:28 Updated: acl-2.2.39-8.el5.x86_64 Nov 11 08:45:28 Installed: chkfontpath-1.10.1-1.1.x86_64 Nov 11 08:45:31 Installed: urw-fonts-2.3-6.1.1.noarch Nov 11 08:45:33 Installed: ghostscript-8.70-14.el5_8.1.x86_64 Nov 11 08:45:35 Installed: ghostscript-fonts-5.50-13.1.1.noarch Nov 11 08:45:36 Installed: 1:xorg-x11-xfs-1.0.2-5.el5_6.1.x86_64 Nov 11 08:45:37 Installed: ImageMagick-6.2.8.0-15.el5_8.x86_64 Nov 11 08:45:39 Installed: ghostscript-8.70-14.el5_8.1.i386 Nov 11 08:45:40 Installed: ImageMagick-6.2.8.0-15.el5_8.i386 > - the result of running 'rpm -Vv' on those package names filtered with 'grep -v "^\.\{8\}", That yields: package 1:xorg-x11-font-utils-7.1-3.x86_64 is not installed package 1:xorg-x11-xfs-1.0.2-5.el5_6.1.x86_64 is not installed Was that what you expected? The unfiltered output contains a long list of files that have been changed; they do not include any of the ones identified by RKHunter (see below). > - the relevant rkhunter.log entries. [04:04:40] /bin/tcsh [ Warning ] [04:04:40] Warning: The file properties have changed: [04:04:40] File: /bin/tcsh [04:04:40] Current hash: Unavailable [04:04:41] Stored hash : eb1fc564a9ae8947339ccb7229bbb1bcc2858b87 [04:04:41] Try running the command 'prelink /bin/tcsh' to resolve dependency errors. [04:04:41] /usr/sbin/adduser [ OK ] [04:04:41] /usr/sbin/chroot [ OK ] [04:04:41] /usr/sbin/groupadd [ Warning ] [04:04:41] Warning: The file properties have changed: [04:04:41] File: /usr/sbin/groupadd [04:04:41] Current hash: Unavailable [04:04:41] Stored hash : 0cd9817545f4f8bd8780dd90a3b49215bee7b95b [04:04:41] Try running the command 'prelink /usr/sbin/groupadd' to resolve dependency errors. [04:04:41] /usr/sbin/groupdel [ Warning ] [04:04:41] Warning: The file properties have changed: [04:04:41] File: /usr/sbin/groupdel [04:04:41] Current hash: Unavailable [04:04:41] Stored hash : a08849a7cfcca39894441c005d39c43e0ed3548d [04:04:41] Try running the command 'prelink /usr/sbin/groupdel' to resolve dependency errors. [04:04:42] /usr/sbin/groupmod [ Warning ] [04:04:42] Warning: The file properties have changed: [04:04:42] File: /usr/sbin/groupmod [04:04:42] Current hash: Unavailable [04:04:42] Stored hash : fdc370a9873d52e2b60b5d6c7147837b8e8d845c [04:04:42] Try running the command 'prelink /usr/sbin/groupmod' to resolve dependency errors. [04:04:42] /usr/sbin/grpck [ Warning ] [04:04:42] Warning: The file properties have changed: [04:04:42] File: /usr/sbin/grpck [04:04:42] Current hash: Unavailable [04:04:42] Stored hash : 9cb37fcf1c7873a644aa45d4c917846e1b701dc6 [04:04:42] Try running the command 'prelink /usr/sbin/grpck' to resolve dependency errors. [04:04:42] /usr/sbin/kudzu [ OK ] [04:04:43] /usr/sbin/prelink [ OK ] [04:04:43] /usr/sbin/pwck [ Warning ] [04:04:43] Warning: The file properties have changed: [04:04:43] File: /usr/sbin/pwck [04:04:43] Current hash: Unavailable [04:04:43] Stored hash : f725b6b58296870cd09291ea19179b3284f5e786 [04:04:43] Try running the command 'prelink /usr/sbin/pwck' to resolve dependency errors. [04:04:46] /usr/bin/lastlog [ Warning ] [04:04:46] Warning: The file properties have changed: [04:04:46] File: /usr/bin/lastlog [04:04:46] Current hash: Unavailable [04:04:46] Stored hash : 06bf0ba31256bf48d557979baf6e3152200218ba [04:04:46] Try running the command 'prelink /usr/bin/lastlog' to resolve dependency errors. [04:04:47] /usr/bin/md5sum [ OK ] [04:04:47] /usr/bin/newgrp [ Warning ] [04:04:47] Warning: The file properties have changed: [04:04:47] File: /usr/bin/newgrp [04:04:47] Current hash: Unavailable [04:04:47] Stored hash : 47c7f213c709fff5828cb8d760a24610e53e43ce [04:04:47] Try running the command 'prelink /usr/bin/newgrp' to resolve dependency errors. [04:04:48] /usr/bin/passwd [ Warning ] [04:04:48] Warning: The file properties have changed: [04:04:48] File: /usr/bin/passwd [04:04:48] Current hash: Unavailable [04:04:48] Stored hash : ad18c16f689622f4eed9b67264f3ce1b6b277a4c [04:04:48] Try running the command 'prelink /usr/bin/passwd' to resolve dependency errors. [04:04:48] /usr/bin/perl [ Warning ] [04:04:48] Warning: The file properties have changed: [04:04:48] File: /usr/bin/perl [04:04:48] Current hash: Unavailable [04:04:48] Stored hash : e7435448df8f92d5ac07cdc4d54ab7485030fce6 [04:04:48] Try running the command 'prelink /usr/bin/perl' to resolve dependency errors. [04:04:48] /usr/bin/pgrep [ OK ] (some snippage to leave out a bunch of files that RKHunter saw as OK). RKHunter does not report any known rootkits or other issues. I think this may relate to one of your FAQs, about unfindable hashes, but I'm not sure why those particular files should have changed. Thanks for your help, and for any more light that you can shed on this. Angus ------------------------------------------------------------------------------ Monitor your physical, virtual and cloud infrastructure from a single web console. Get in-depth insight into apps, servers, databases, vmware, SAP, cloud infrastructure, etc. Download 30-day Free Trial. Pricing starts from $795 for 25 servers or applications! http://p.sf.net/sfu/zoho_dev2dev_nov _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users