<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Use a bootable disc with either or both tools on it, boot the machine(s) in question with that media and then run the tests. Fedora 17, which just came out, has a bootable security spin you could/should try, too.<br></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Beartooth <beartooth@comcast.net><br> <b><span style="font-weight: bold;">To:</span></b> users@lists.fedoraproject.org <br> <b><span style="font-weight: bold;">Sent:</span></b>
Thursday, June 7, 2012 11:16 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Which to trust: chkrootkit or rkhunter?<br> </font> </div> <br>
<br> One tells me, on several machines, that /sbin/init is infected <br>with the Suckit rootkit; the other says not. Is there a way to tell <br>whether I'm seeing a false positive or a false negative? <br><br> Fwiw, this result occurs both on an F16 machine, and on an f17 <br>one with a fresh install. (Both are fully updated.)<br><br>-- <br>Beartooth Staffwright, Neo-Redneck Not Quite Clueless Power User<br>I have precious (very precious!) little idea where up is.<br><br><br>-- <br>users mailing list<br><a ymailto="mailto:users@lists.fedoraproject.org" href="mailto:users@lists.fedoraproject.org">users@lists.fedoraproject.org</a><br>To unsubscribe or change subscription options:<br><a href="https://admin.fedoraproject.org/mailman/listinfo/users" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/users</a><br>Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines<br>Have a question? Ask away:
http://ask.fedoraproject.org<br><br><br> </div> </div> </blockquote></div> </div></body></html>