Re: Virus and file /proc/kcore
colemw@cox.net wrote:
> I did a virus scan with clamscan and then f-prot. Clamscan notified
> me of one virus: V801 in file /proc/kcore. Going to this file it is
> VERY large (in fact takes up the majority of my partition). I can't
> seem to rm or shred this file. f-prot called it a W32 virus? But
> neither application will remove the file. It has permissions set at
> '-r--------' with owners root.root. What does this file do? Is
> there any way to get rid of the virus without wiping the partition
> which is /? Let me know if you need more info.
1st hit at www.google.com for /proc/kcore:
http://www.unixguide.net/linux/faq/04.16.shtml
"What Is /proc/kcore?
None of the files in /proc are really there--they're all, "pretend,"
files made up by the kernel, to give you information about the system
and don't take up any hard disk space.
/proc/kcore is like an "alias" for the memory in your computer. Its
size is the same as the amount of RAM you have, and if you read it as
a file, the kernel does memory reads."
Bob Scott
Reply to: