Re: suspicious files in /tmp

[Marcel Weber <mmweber@ncpro.com>]

Rudolf Lohner wrote:

>
[snip]
> file hello.dyn 
> hello.dyn: ELF 32-bit LSB executable, Intel 80386, version 1, dynamically linked (uses shared libs), not stripped
>
> file hello.stat 
> hello.stat: ELF 32-bit LSB executable, Intel 80386, version 1, statically linked, not stripped
[snip]
> Greetings,  Rudolf

Great, thanks! So here it comes:

www:~/chkrootkit/bin # file netstat
netstat: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), not stripped

www:~/chkrootkit/usr/bin # file env
env: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
statically linked, not stripped


So everythings clear now: One was statically linked, the other 
dynamically and I guess, that the meaning of stripped is, if there is 
debugging information in the file or not(?), which would make the file 
even bigger...

Greettings

Marcel