Re: [newbie] Rootkit ?

2005-01-04 Thread Bryan Phinney
On Tuesday 04 January 2005 08:20, Kaj Haulrich wrote: When doing a chkrootkit everything looks fine except this : Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... Checking `rexedcs'... not found Checking `sniffer'... eth0: PF_PACKET(/sbin/dhclient)

Re: [newbie] Rootkit ?

2005-01-04 Thread Avi Schwartz
Kaj Haulrich wrote: When doing a chkrootkit everything looks fine except this : Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... Checking `rexedcs'... not found Checking `sniffer'... eth0: PF_PACKET(/sbin/dhclient) Checking `w55808'... not infected Checking

Re: [newbie] Rootkit ?

2005-01-04 Thread Kaj Haulrich
On Tuesday 04 January 2005 15:07, Bryan Phinney wrote: On Tuesday 04 January 2005 08:20, Kaj Haulrich wrote: When doing a chkrootkit everything looks fine except this : Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... Checking `rexedcs'... not found

Re: [newbie] Rootkit ?

2005-01-04 Thread Avi Schwartz
Kaj Haulrich wrote: On Tuesday 04 January 2005 15:07, Bryan Phinney wrote: On Tuesday 04 January 2005 08:20, Kaj Haulrich wrote: When doing a chkrootkit everything looks fine except this : Checking `asp'... not infected Checking `bindshell'... not infected Checking `lkm'... Checking

Re: [newbie] Rootkit ?

2005-01-04 Thread Kaj Haulrich
On Tuesday 04 January 2005 16:38, Avi Schwartz wrote: snip Thanks Bryan and Avi, but I'm running snort or portsentry or anything. So where does this sniffer come from ? - To me it sounds pretty much like one of those thousands of Windows-spyware malignancies. Never thought a Linux system

Re: [newbie] Rootkit Hunter

2004-09-15 Thread Bryan Phinney
On Tuesday 14 September 2004 08:50 pm, Chris wrote: The source is super easy to install, it has its own install script, takes about two minutes to run through the complete installation. By the way, I was going to start another thread but since we're on the subject of root killer, it reports

Re: [newbie] Rootkit Hunter

2004-09-15 Thread Ron Hunter-Duvar
On September 14, 2004 18:17, Tom Brinkman wrote: On Tuesday 14 September 2004 12:35 pm, Ron Hunter-Duvar wrote: On September 14, 2004 07:37, Tom Brinkman wrote: ... urpmi rkhunter I have contrib defined (using proxad.net, b/c all the North American mirrors seem to be unreliable),

Re: [newbie] Rootkit Hunter

2004-09-14 Thread Lyvim Xaphir
On Mon, 2004-09-13 at 21:21, Chris wrote: Found this little app in my Freshmeat daily newsletter. Seems to check much more than chkrootkit. That being the case, you or someone else should go to Mandrakeclub and propose this program as an rpm for packaging by the contributors in the rpm voting

Re: [newbie] Rootkit Hunter

2004-09-14 Thread Ron Hunter-Duvar
On September 14, 2004 07:37, Tom Brinkman wrote: ... urpmi rkhunter I have contrib defined (using proxad.net, b/c all the North American mirrors seem to be unreliable), but urpmi rkhunter gives me no package named rkhunter. I tried a search for rk and one for hunt too, in case the spelling

Re: [newbie] Rootkit Hunter

2004-09-14 Thread Tom Brinkman
On Tuesday 14 September 2004 12:35 pm, Ron Hunter-Duvar wrote: On September 14, 2004 07:37, Tom Brinkman wrote: ... urpmi rkhunter I have contrib defined (using proxad.net, b/c all the North American mirrors seem to be unreliable), but urpmi rkhunter gives me no package named rkhunter. I

Re: [newbie] Rootkit Hunter

2004-09-14 Thread Bryan Phinney
On Tuesday 14 September 2004 08:17 pm, Tom Brinkman wrote: Mea culpa. Since it's just a noarch script, I thought it would be available for all Mandrake versions. I didn't check. Anyhow, you can get the 10.1 CE version here:

Re: [newbie] Rootkit Hunter

2004-09-14 Thread Chris
On Tuesday 14 September 2004 07:34 pm, Bryan Phinney wrote: On Tuesday 14 September 2004 08:17 pm, Tom Brinkman wrote: Mea culpa. Since it's just a noarch script, I thought it would be available for all Mandrake versions. I didn't check. Anyhow, you can get the 10.1 CE version here:

Re: [newbie] Rootkit Hunter

2004-09-13 Thread Angus Auld
- Original Message - From: Chris [EMAIL PROTECTED] Date: Mon, 13 Sep 2004 20:21:44 -0500 To: [EMAIL PROTECTED] Subject: [newbie] Rootkit Hunter Found this little app in my Freshmeat daily newsletter. Seems to check much more than chkrootkit. About: Rootkit Hunter scans files and

Re: [newbie] Rootkit?

2004-04-13 Thread Stephen Kuhn
On Wed, 2004-04-14 at 07:23, Job Evers wrote: My college sent me an email warning: There have been many recent break-ins to university Solaris and Linux systems, including ones for which the administrator puts a lot of effort into security. We have recently seen an increase in successful

Re: [newbie] rootkit

2002-08-21 Thread Derek Jennings
On Wednesday 21 Aug 2002 4:01 pm, Wilson, Jack wrote: Is there a script for checking for rootkits (chkrootkit) for Mandrake like there is for RH? Thanks Jack Yes... The search button in Mandrake Software Manager will find it for you. derek Want to buy your Pack or Services from

RE: [newbie] rootkit

2002-08-21 Thread Wilson, Jack
Thanks. I appreciate it. -Original Message- From: Derek Jennings [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 21, 2002 10:25 AM To: [EMAIL PROTECTED] Subject: Re: [newbie] rootkit On Wednesday 21 Aug 2002 4:01 pm, Wilson, Jack wrote: Is there a script for checking for rootkits

Re: [newbie] rootkit

2002-08-21 Thread Tom Brinkman
On Wednesday August 21 2002 10:01 am, Wilson, Jack wrote: Is there a script for checking for rootkits (chkrootkit) for Mandrake like there is for RH? Thanks Jack http://www.chkrootkit.org/ There's also Mandrake rmps,