Rootkit Hunter Question

[mickalo]

Hello,

we run the rookit hunter daily on our machine, and today we got this report:

/usr/sbin/prelink: /bin/more: at least one of file's dependencies has changed since prelinking

 /bin/more  [ BAD ]

is this something to be concerned about, haven't seen this one before. We did run the "rookit --update" also, but got the same report afterwards.

Update:
Found the problem from the FAQ's had to do with the prelink out of sync, which fixed it.


TIA,
Mickalo

[chirpy]

It's quite common, especially on a new OS install or a major OS update. For anyone else who finds the thread, this will usually fix it:

prelink -ua

[mickalo]

It's quite common, especially on a new OS install or a major OS update. For anyone else who finds the thread, this will usually fix it:

prelink -ua

this is all that's needed to be done ??

Mickalo

[chirpy]

Yup, that's it

[mickalo]

Yup, that's it

is that the same as running /etc/cron.daily/prelink as recommended by the RootKit Hunter people ?? they also have small utility script that also runs called "hashupd.sh"
that is suppose to "fix local MD5 hash values" that the rootkit hunter uses, that's if your fimilar with this rootkit hunter utility.

Mickalo

[chirpy]

No, prelink -ua will remove the prelinks. The daily job will update existing ones and create new ones for those that have been removed. However that sometimes gets out of sync (AIUI) and removing the prelinks gets you back to a clean state.

[mickalo]

No, prelink -ua will remove the prelinks. The daily job will update existing ones and create new ones for those that have been removed. However that sometimes gets out of sync (AIUI) and removing the prelinks gets you back to a clean state.

Ok that make sense now.

Thx's again,
Mickalo