rkhunter found suspicious files

mikieboy · 08-10-2010, 07:44 AM

I got this warning in the log of rkhunter:

Quote:

Checking /dev for suspicious file types [ Warning ]
[13:37:16] Warning: Suspicious file types found in /dev:
[13:37:16] /dev/shm/pulse-shm-43136623: data
[13:37:16] /dev/shm/pulse-shm-3215123132: data
[13:37:16] /dev/shm/pulse-shm-3896941330: data
[13:37:17] /dev/shm/pulse-shm-1633930369: data
[13:37:17] Checking for hidden files and directories [ Warning ]
[13:37:17] Warning: Hidden directory found: /etc/.java
[13:37:17] Warning: Hidden directory found: /dev/.udev
[13:37:17] Warning: Hidden directory found: /dev/.initramfs
[13:37:29]
[13:37:29] Info: Test 'apps' disabled at users request.

Is this something to be concerned about and if so what can I do about it?

druuna · 08-10-2010, 08:52 AM

Hi,

/etc/.java, /dev/.udev and /dev/.initramfs are normal files you can white-list.

/dev/shm/pulse-shm-xyz did not ring a bell, but a little search came up with this: Re: Rkhunter issued some warnings... what to do?

Seems that these are also not harmful.

Hope this helps.

mikieboy · 08-10-2010, 11:00 AM

Hi druuna,

I have read the link that you posted and feel reassured that my system isn't compromised. Thank you so much for your help,

Mikie