LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-04-2004, 11:39 PM   #1
azebuski
Member
 
Registered: Jan 2004
Posts: 43

Rep: Reputation: 15
F-prot identified a suspicious file


I've been using Fedora for a while now and I've been loving it.
Today, just for fun I ran F-prot to check the entire file system and it came back clean except for this:

/usr/lib/debug/usr/bin/run.debug could be infected with an unknown virus

I looked at the file in vi and it's a text file but it is all garbled. It's 22 lines of...

insert_int^@@^^local_proc_walk_init~~~~^^^@^@alloc_string_node^@print_help^@
process_policy_option^@__dso_handle^@
...

What is this file and why would F-prot label it as "suspicious?"
 
Old 03-05-2004, 12:30 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
What is this file
Debug information for "run". If you check your rpm database, the package should be installed (so it's not a rogue file or installed from tarball) and the files md5sum should match (so it's integrity is confirmed). *Checking should preferably be done with a saved copy on readonly media that cant be tampered with, or the rpm from an ftp mirror, and provided no one had a chance to mod the db/rpm or otherwise subvert the system/mirror.


why would F-prot label it as "suspicious?"
Probably heuristics at work that should be tweaked. Send the file and error off to F-prot to have them determine it's clean and fix F-prot.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I know what hardware was not identified on my system ? hq4ever Linux - Hardware 5 11-23-2005 04:33 PM
F-prot Cant update file. amer_58 Linux - Newbie 3 02-20-2005 04:23 AM
kudzu identified the wrong card paulhoop Linux - Software 0 01-22-2005 05:52 AM
F-prot Anti-virus scan log, suspicous file question. webwolf70 Linux - Security 5 11-16-2004 09:15 AM
Partition drive letter cannot be identified? colly Linux - General 7 06-21-2004 11:03 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration