Rkhunter

[Correo de Google]

On Wed, 20 Oct 2010 22:16:18 +0200
"Juan B.Campos Suarez" <ferranes en yahoo.es> wrote:

> Hola acabo de actualizar Lucid...
> 
> Al pasar rkhunter -c --sk --rwo
> 
> y me da esto
> 
> Warning: The file properties have changed:
>           File: /bin/cat
>           Current hash: 4df842763f7b1a6b9510e15048e56ed2f975a8f5
>           Stored hash : d6e3b1575f2319b2a6a90de093b956297b4f6718
>           Current inode: 283447    Stored inode: 260632
>           Current file modification time: 1285093975 (21-sep-2010 20:32:55)
>           Stored file modification time : 1267760476 (05-mar-2010 04:41:16)
> Warning: The file properties have changed:
>           File: /bin/chmod
>           Current hash: 16b742b73e63a35e8fef27b043eff9d05a80dd46
>           Stored hash : 086f6df2d9007d902eeb60388383e2f16b4c408a
>           Current inode: 282667    Stored inode: 260635
>           Current file modification time: 1285093975 (21-sep-2010 20:32:55)
>           Stored file modification time : 1267760476 (05-mar-2010 04:41:16)
> Warning: The file properties have changed:
>           File: /bin/chown
>           Current hash: ed48c56118f2411ff65127d29327fed256b79e67
>           Stored hash : 4dd9c5e21a729f08c8c77df0d63b1d09a20d49ef
>           Current inode: 282666    Stored inode: 260636
>           Current file modification time: 1285093975 (21-sep-2010 20:32:55)
>           Stored file modification time : 1267760476 (05-mar-2010 04:41:16)
> .........
> ...
> ..
> .
> 
> muchos mas
> .
> .
> .
> .
> .
> 
> 
> 
> Warning: The file properties have changed:
>           File: /usr/sbin/chroot
>           Current hash: 77eddb458ad439eac415230b009a5cc3da8b679f
>           Stored hash : 70c3b3c0f91caee262468582618434fa070d01af
>           Current inode: 1548    Stored inode: 11160
>           Current file modification time: 1285093976 (21-sep-2010 20:32:56)
>           Stored file modification time : 1267760477 (05-mar-2010 04:41:17)
> Warning: Suspicious file types found in /dev:
>           /dev/shm/pulse-shm-2791099205: data
>           /dev/shm/pulse-shm-1359191186: data
>           /dev/shm/pulse-shm-840598736: data
>           /dev/shm/pulse-shm-3395040607: data
>           /dev/shm/pulse-shm-1444642736: data
>           /dev/shm/pulse-shm-1713522061: data
>           /dev/shm/pulse-shm-1315958753: data
>           /dev/shm/pulse-shm-127268769: data
>           /dev/shm/pulse-shm-3476557000: data
> Warning: Hidden directory found: /etc/.java
> Warning: Hidden directory found: /dev/.udev
> Warning: Hidden directory found: /dev/.initramfs
> 
> One or more warnings have been found while checking the system.
> 
> ¿ Es preocupante ?
> O saido porque ha cambiado el nucleo ?
> 
> -- 
> ubuntu-es mailing list
> ubuntu-es en lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/ubuntu-es

Acabas de actualizar. Puede deberse a eso, creo. ¿Has corrido chkrootkit, para estar seguro?.

Saludos
-- 
Mario Guerra <guerramarioalberto en gmail.com>