Chkrootkit question

[Paul Howarth]

On Tue, 2006-04-18 at 14:19 -0400, Gene Heskett wrote:
> On Tuesday 18 April 2006 09:24, Paul Howarth wrote:
> >Anne Wilson wrote:
> >> On Monday 17 April 2006 12:36, Gene Heskett wrote:
> >>> On Monday 17 April 2006 06:34, Anne Wilson wrote:
> >>>> These files appear in the 'Suspicious files' section:
> >>>>
> >>>> /usr/lib/qt-3.3/etc/settings/.qtpartedrc.lock
> >>>> /usr/lib/qt-3.3/etc/settings/.qtrc.lock
> >>>> /usr/lib/qt-3.3/etc/settings/.qt_plugins_3.3rc.lock
> >>>> /usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/DCOP/.
> >>>>pac klist /usr/lib/perl5/5.8.6/i386-linux-thread-multi/.packlist
> >>>>
> >>>> They have been there for some days, and I suspect they may have
> >>>> been left behind from a crash.  Should I try to get rid of them,
> >>>> or just ignore them? I wouldn't have thought they could be doing
> >>>> anything harmful.
> >>>
> >>> I have some like that Anne, been there for years. I've ignored
> >>> them.
> >
> >The .packlist files come from manually-installed (i.e. not from RPMs)
> >perl modules. If the file *does* come from an RPM, I'd suggest
> >bugzilla-ing the RPM in question as the .packlist file isn't needed
> > and shouldn't be packaged.
> >
> >Paul.
> 
> Humm, I didn't know that till now, thanks. 
> 
> Are they required Paul?, or can they be nuked?

They're nuked in the packaging process for most perl modules, since
they're not really needed and tend to cause file conflicts when they
occur in packages.

You can nuke them if you like, but equally they're not doing any harm if
they're for manually-installed modules.

Paul.