Re: F12 Rkhunter, Have I a rootkit?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 05 Jan 2010 10:54:13 +0000
"Frank Murphy (Frankly3D)" <frankly3d@xxxxxxxxx> wrote:

> ---------------------- Start Rootkit Hunter Scan
> ---------------------- Warning: Network TCP port 47107 is being used
> by /usr/lib64/thunderbird-3.0/thunderbird-bin. Possible rootkit: T0rn
>          Use the 'lsof -i' or 'netstat -an' command to check this.
> 
> 
> Results of lsof -i' and 'netstat -an'
> http://fpaste.org/xOOO/

This is a false positive. 

basically it saw that something was using port 47107, which is used by
a known rootkit. It then printed a warning for you to check it. 

Likely thunderbird just happened to be using that tranisitory port when
the check was run. 

If you re-run it now does it show ok?

kevin

Attachment: signature.asc
Description: PGP signature

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux