Re: rootkit/virus/trojan on squeeze 32 bit

[Nate Bargmann <n0nb@n0nb.us>]

* On 2013 11 Mar 19:43 -0500, sp113438 wrote:
> After running on my amd64 squeeze:
> # rkhunter --update
> rkhunter -c
> 
> rkhunter showed one warning:
> 
>  Warning: Checking for possible rootkit strings    [ Warning ]
> [01:25:23]          Found string 'hdparm' in file
> '/etc/init.d/.depend.boot'. Possible rootkit: Xzibit Rootkit
> [01:25:23]          Found string 'hdparm' in file '/etc/init.d/hdparm'.
> Possible rootkit: Xzibit Rootkit

False positive?  This guy thinks so:

http://machine-cycle.blogspot.com/2011/03/getting-rid-of-rkhunters-false-warning.html

He notes Debian bug 576680

- Nate

-- 

"The optimist proclaims that we live in the best of all
possible worlds.  The pessimist fears this is true."

Ham radio, Linux, bikes, and more: http://www.n0nb.us