[expert] Chkrootkit shows nothing ??

2002-05-10 Thread Daniel Stiefel
A few days ago, I got some KWrited docs popping up on my Mandrake 8.1 desktop (Security warning: World Writeable files found followed by a long list of files located on both hardrives). I am a linux newbie and assumed the popups were the product of some kind of monitoring utility that I had

Re: [expert] Chkrootkit shows nothing ??

2002-05-10 Thread J. Craig Woods
Daniel Stiefel wrote: A few days ago, I got some KWrited docs popping up on my Mandrake 8.1 desktop (Security warning: World Writeable files found followed by a long list of files located on both hardrives). I am a linux newbie and assumed the popups were the product of some kind of

Re: [expert] Chkrootkit shows nothing ??

2002-05-10 Thread Jones,Daniel E.
You don't recall the names of some of the files, do you? Whether a particular file being world-readable is a security problem depends entirely on which file it is. It is entirely possible that one of your applications is saving files with this permission. Did this occur shortly after you

Re: [expert] Chkrootkit shows nothing ??

2002-05-10 Thread db
Daniel Stiefel wrote: A few days ago, I got some KWrited docs popping up on my Mandrake 8.1 desktop (Security warning: World Writeable files found followed by a long list of files located on both hardrives). I am a linux newbie and assumed the popups were the product of some kind of

Re: [expert] Chkrootkit shows nothing ??

2002-05-10 Thread Jones,Daniel E.
I have a pretty plausible guess for what is going on, and it is not a compromise. First, all the files in /usr/share/apps/kcsd/cddb are related to the CD player that comes with KDE. (that's the kscd part.) CDDB is a database of track information on lots of CDs that can be accessed over the

Re: [expert] Chkrootkit shows nothing ??

2002-05-10 Thread David Relson
Dan, The messages about world writeable files are from Mandrake Security (better known as /usr/sbin/msec). The first time it runs, it tells you about all the anomalies it detects - unusual file permision, etc. After that, each time it runs it compares what it finds (today) to what it found