Re: OT: Suspicious File found by chkrootkit

[Star King of the Grape Trees <thestar@fussycoder.id.au>]

Rick Friedman wrote:

> I run chkrootkit daily. Today it has found a file it calls, "suspicious". The 
> file is a zero byte, hidden file. The path is /usr/lib/xulrunner/.autoreg
>
> After seeing this warning, I also ran rkhunter (rootkit hunter). The report 
> from rkhunter comes up clean. It does not flag the .autoreg file (or any file 
> for that matter).
>
> I am running sid and I believe that the .autoreg file may come from the 
> libxul0d package.
>
> Is this a legitimate file or something I should be concerned about? I tend to 
> think chkrootkit flagged it simply because it's hidden and zero bytes. I 
> don't think it's really a threat but I want to make certain.
>
> Any help is appreciated. Thanks.
>
> Rick
>  
The best solution is to track down where that file came from and compare 
the original with the copy you have, and to determine its purpose. (Or 
failing that, the purpose of the program it came with).

Disclaimer: I do not have experience in this, just a comment I wanted to 
make.