[OT]Re: The End of Linux

[John Dangler]

On Thu, 2006-12-07 at 13:41 +1000, Nikolai wrote:
> Brian Fahrlander wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> > 
> > Nikolai wrote:
> > 
> >> http://www.citkit.ru/articles/178/
> >> http://zeus.sai.msu.ru:7000/open_source/linux_mobile/
> > 
> >     OK, now that most of the group has taken him up on his argument, and
> > visited the site....has anyone checked for rootkits?
> 
> 
> Don't you see what's in the URL? kit.ru :-)

now that the alarm has been raised about this...
so I setup chkrootkit, and found this...

Searching for suspicious files and dirs, it may take a while...
/usr/lib/jvm/.java-gcj.jinfo
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/VMware/VmPerl/.exists
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/VMware/VmdbPerl/.exists
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/VMware/HConfig/.exists
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/XML/DOM/.packlist
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/XML/Parser/.packlist
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/MIME/Base64/.packlist
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/URI/.packlist
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/auto/Authen/PAM/.packlist
/usr/lib/vmware/perl5/site_perl/5.005/i386-linux/VMware/.exists
/lib/modules/2.6.15-27-386/volatile/.mounted

Anyone with good knowledge of the output of chkrootkit know whether this
indicates anything I should be wary of?  I do have vmware server
installed on this machine, so at first glance, it didn't make me
suspicious...

Thanks for the input.