Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189346

Re: [rkhunter] coyote.coyote.den - Daily report

Show all headers | View raw

On Monday 27 November 2017 17:32:44 deloptes wrote:

> Gene Heskett wrote:
> > Warning: The following suspicious shared
> >
> >> memory segments have been found: Process:
> >> /usr/lib/firefox-esr/firefox-esr    PID: 16994    Owner: gene
> >> Process: /usr/lib/firefox-esr/firefox-esr    PID: 16994    Owner:
> >> gene Warning:
>
> do you have this same today?
>
That is todays. I have it set to scan at nominally 14:30 each day.

So unless I run it by hand, I won't get another email from it till 
Tuesday afternoon.  So we'll see if its a fluke.

> the message is pretty clear - warning: suspicious shared memory
> segments
>
> might be rkhunter got smarter or there was really something messed in
> memory?

Dunno. Ran it by hand, and found this:
Warning: The following suspicious shared memory segments have been found:
[21:15:19]          Process: /usr/lib/firefox-esr/firefox-esr    PID: 
16994    Owner: gene
[21:15:19]          Process: /usr/lib/firefox-esr/firefox-esr    PID: 
16994    Owner: gene

And at the end of the log, "possible rootkits: 3", scanning back up the 
log now. Its fussing about the ports portsentry uses. Running it again 
after a --propupd run.

Didn't change much if anything. System "feels" absolutely normal. Goes 
off to see about an interface card I am changing on one of the other 
machines. If it keeps it up, I'll rejoin the rkhunter list and post it 
there.

rkhunter itself hasn't been updated in yonks, config files, yes, but not 
rkhunter itself.

Sorry bout the noise.

> regards


Cheers Deloptes, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-27 21:50 +0100
  Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-27 22:00 +0100
    Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-27 23:00 +0100
      Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-27 23:50 +0100
        Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 03:50 +0100
          Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 10:10 +0100
            Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-28 11:20 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 12:40 +0100
                Re: [rkhunter] coyote.coyote.den - Daily report Brian <ad44@cityscape.co.uk> - 2017-11-28 13:30 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 14:10 +0100
          Re: [rkhunter] coyote.coyote.den - Daily report Dejan Jocic <jodejka@gmail.com> - 2017-11-28 13:30 +0100
            Re: [rkhunter] coyote.coyote.den - Daily report Michael Stone <mstone@debian.org> - 2017-11-28 16:40 +0100
              Re: [rkhunter] coyote.coyote.den - Daily report Dejan Jocic <jodejka@gmail.com> - 2017-11-28 17:30 +0100
  Re: [rkhunter] coyote.coyote.den - Daily report deloptes <deloptes@gmail.com> - 2017-11-27 23:40 +0100
    Re: [rkhunter] coyote.coyote.den - Daily report Gene Heskett <gheskett@shentel.net> - 2017-11-28 03:50 +0100
      Re: [rkhunter] coyote.coyote.den - Daily report deloptes <deloptes@gmail.com> - 2017-11-28 08:10 +0100
        Re: [rkhunter] coyote.coyote.den - Daily report "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-11-28 09:10 +0100

csiph-web