On 2/13/25 10:50 AM, home user via users wrote:
(f40; gnome; last patched minutes ago)
When I ran chkrootkit, I got the following (including a few lines of context) regarding "wted":
[snip] Checking `w55808'... not infected Checking `wted'... 1 deletion(s) between Tue Jan 28 07:33:49 2025 and Tue Jan 28 07:36:08 2025 1 deletion(s) between Fri Feb 7 08:13:43 2025 and Fri Feb 7 08:15:51 2025 1 deletion(s) between Sat Feb 8 15:26:59 2025 and Sat Feb 8 15:29:22 2025 1 deletion(s) between Sat Feb 8 15:29:22 2025 and Sat Feb 8 15:31:27 2025 Checking `scalper'... not infected [snip] bash.5[~]:
I got the same thing both before and after "dnf upgrade". rkhunter made no mention of "wted".
I tried to find what "wted" is:
bash.5[~]: which wted /usr/bin/which: no wted in (/usr/lib64/qt-3.3/bin:/usr/lib64/ccache:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/root/bin) bash.6[~]: whereis wted wted: bash.7[~]: man wted No manual entry for wted bash.8[~]: dnf info wted Last metadata expiration check: 0:23:46 ago on Thu 13 Feb 2025 10:05:51 AM MST. Error: No matching Packages to list bash.9[~]:
duck-duck-go and google gave me nothing useful.
What is "wted", and is there a security problem?
My apologies for the delay in closing this.
As recommended, I no longer run chkrootkit. As recommended, I no longer run rkhunter. As recommended, I re-installed fail2ban and launched it.
Most likely, the deletions noted by chkrootkit coincided in time to boot failures and crashes. These seem to be random.
I thank everyone for their time and effort trying to help.