F12 Rkhunter, Have I a rootkit?
Simon Schneebeli
simon.schneebeli at okko.org
Tue Jan 5 12:05:28 UTC 2010
Hm. I think that telling someone to ignore a message like this would be
like telling people "hey there is a pandemia, but just ignore it".
Either there is a warning for a potential danger (if there is really a
danger) or there is no danger (and there should be no warning).
Otherwise, in the future, such warnings go unheard even if there is a
real danger.
Just my psychological bit of conclusion drawn from the current pandemia
hysteria...
Simon
Frank Murphy (Frankly3D) wrote:
> On 05/01/10 11:06, Andrew Haley wrote:
>> On 01/05/2010 10:54 AM, Frank Murphy (Frankly3D) wrote:
>>> ---------------------- Start Rootkit Hunter Scan ----------------------
>>> Warning: Network TCP port 47107 is being used by
>>> /usr/lib64/thunderbird-3.0/thunderbird-bin. Possible rootkit: T0rn
>>> Use the 'lsof -i' or 'netstat -an' command to check this.
>>>
>>>
>>> Results of lsof -i' and 'netstat -an'
>>> http://fpaste.org/xOOO/
>> Port 47107 isn't being used any more. This was just TCP using a random
>> unreserved port.
>>
>> Andrew.
>>
>
> Basically ignore this in future, with that port?
>
More information about the users
mailing list