Re: rootkithunter gives warnings for sh and perl

[Hugo Vanwoerkom <hvw59601@care2.com>]

sp11 wrote:
> Hello,
>
> rkhunter gives warnings for sh and perl:
>
> [23:01:57] Warning: The file properties have changed:
> [23:01:57]          File: /bin/sh
> [23:01:57]          Current hash: add19e504c254758f2ea8dcda3821c77fafb4923 
> [23:01:57]          Stored hash : 3e4f053d7520819f5e45a7792c972b05e4ff234e 
> [23:01:57]          Current inode: 1958022    Stored inode: 1957896
> [23:01:57]          Current file modification time: 1359928637 (03-Feb-2013 22:57:17) 
> [23:01:57]          Stored file modification time : 1342538237 (17-Jul-2012 17:17:17)
>
>
> [23:02:04] Warning: The file properties have changed:
> [23:02:04]          File: /usr/bin/perl
> [23:02:04]          Current hash: 13e50d52280d120bf8c71c7eaf4e7431c9afa392 
> [23:02:04]          Stored hash : f62bbb9e85d386d16f97ea0f3e8afaaf36a36696
> [23:02:04]          Current inode: 65882    Stored inode: 66294
> [23:02:04]          Current file modification time: 1355246023 (11-Dec-2012 18:13:43) 
> [23:02:04]          Stored file modification time : 1324459850 (21-Dec-2011 10:30:50)
>
> When I reinstall dash (delivers /bin/sh) and perl these warning don't
> go away.
>
> Any idea?

run 'rkhunter --propupd' first and then 'rkhunter -c'

Hugo