LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-03-2007, 03:46 AM   #1
Skillz
Member
 
Registered: Sep 2007
Posts: 252

Rep: Reputation: 32
Safe to delete these directories; v. chkrootkit


These directories are flagged as being "suspicious" by CHKRootKit; wanted to know if they are safe to remove, since the look kind of like old directories from updates, or something.

/usr/lib/php/.depdblock
/usr/lib/php/.lock
/usr/lib/php/.filemap
/usr/lib/php/.depdb
/usr/lib/php/.channels
/usr/lib/php/.channels/.alias
/usr/lib/php/.registry
/usr/lib/php/.registry/.channel.__uri
/usr/lib/php/.registry/.channel.pecl.php.net
/usr/lib/perl5/5.8.8/i686-linux/auto/CGI/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/ExtUtils/MakeMaker/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/ExtUtils/ParseXS/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Encode/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Getopt/Long/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Storable/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Test/Harness/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Test/Simple/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/CPAN/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/File/Temp/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Cwd/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Time/HiRes/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Net/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/List/Util/.packlist
/usr/lib/perl5/5.8.8/i686-linux/auto/Devel/PPPort/.packlist
/usr/lib/perl5/5.8.8/i686-linux/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/Parser/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/XSLT/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/Simple/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/RegExp/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/SAX/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/SAX/Base/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/SAX/Expat/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/LibXML/Common/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/LibXML/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML/NamespaceSupport/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Authen/SASL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Pod/Escapes/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Pod/Simple/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MD5/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/ExtUtils/CBuilder/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/DBI/Shell/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/DBI/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/RPC/PlServer/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/BSD/Resource/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Quota/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Error/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Tie/IxHash/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Tie/ShadowHash/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Tie/Watch/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/version/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Archive/Tar/Streamed/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Archive/Tar/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Archive/Zip/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/AppConfig/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/SpamAssassin/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/DomainKeys/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/SPF/Query/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/SPF/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/DKIM/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Mail/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/Clean/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/Parser/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/Template/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/SimpleParse/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/Tagset/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTML/FillInForm/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Acme/Spork/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MIME/Lite/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MIME/Types/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/lib/restrict/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Curses/UI/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Curses/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Template/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Filesys/Virtual/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Filesys/Virtual/Plain/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Filesys/Df/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Filesys/Statvfs/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MLDBM/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MLDBM/Sync/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/MIME-tools/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Tree/MultiNode/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Safe/Hole/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/SQL/Statement/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/String/CRC32/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IPC/Run/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Test/Pod/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Image/ButtonMaker/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Image/Button/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Image/Size/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/SVG/TT/Graph/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/libxml-perl/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/YAML/Syck/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/YAML/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Sys/Hostname/Long/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Expect/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Geo/IPfree/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Lchown/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Digest/SHA/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Digest/MD5/File/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Digest/SHA1/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Digest/HMAC/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Term/ReadLine/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Term/ReadKey/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/RRDp/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Convert/ASN1/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Convert/BER/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Slurp/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/HomeDir/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Copy/Recursive/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Tail/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/MMagic/XS/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Find/Rule/Filesys/Virtual/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Find/Rule/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Which/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/File/Touch/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Spreadsheet/WriteExcel/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Spreadsheet/ParseExcel/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Email/Simple/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Email/Date/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Email/Abstract/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Number/Compare/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Time/Piece/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/DBD/Multiplex/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/DBD/mysql/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/RRDs/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/URI/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Proc/Daemon/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/XML-DOM/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/GD/Graph3d/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/GD/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/GD/Text/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/GD/Graph/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IP/Country/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Persistent/DBI/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Persistent/MySQL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Persistent/Base/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Readonly/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/OSCAR/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/Daemon/SSL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/Daemon/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/SSLeay/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/Telnet/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/CIDR/Lite/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/DAV/Server/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/FTPSSL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/IP/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/DNS/Resolver/Programmable/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/DNS/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/AIM/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/LDAP/Server/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Net/LDAP/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Apache/Admin/Config/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTTP/Daemon/SSL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/HTTP/Daemon/App/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/TimeDate/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Zlib/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Tty/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Stringy/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Socket/SSL/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Socket/ByteCounter/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Interactive/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Stty/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Compress/Zlib/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Compress/Base/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/IO/Tee/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Business/OnlinePayment/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Business/OnlinePayment/AuthorizeNet/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Business/UPS/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/LWP/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/OLE/Storage_Lite/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/NetAddr/IP/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Text/CSV_XS/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Text/Query/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Text/Glob/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Text/Reform/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Set/Crontab/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Class/Accessor/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Class/Std/Utils/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Class/Std/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Parse/RecDescent/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Compress/Zlib/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Compress/Bzip2/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Compress/Raw/Zlib/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Unix/PID/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Devel/Symdump/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/CBC/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/Blowfish/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/SSLeay/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/GPG/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/OpenSSL/RSA/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/OpenSSL/Random/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/Blowfish_PP/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Crypt/DES/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Filter/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Module/Pluggable/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Module/Build/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/PNGgraph/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Graph/Easy/.packlist
/usr/lib/perl5/site_perl/5.8.8/i686-linux/auto/Graph/Flowchart/.packlist
/usr/lib/perl5/vendor_perl/5.8.5/i386-linux-thread-multi/auto/mod_perl/.packlist
/usr/lib/perl5/5.8.5/i386-linux-thread-multi/.packlist
/usr/lib/php/.channels
/usr/lib/php/.channels/.alias
/usr/lib/php/.registry
/usr/lib/php/.registry/.channel.__uri
/usr/lib/php/.registry/.channel.pecl.php.net
 
Old 09-03-2007, 01:20 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
These files are flagged simply because their filename starts with a dot. In ancient times a dot-file was considered a nifty way to hide a file because you'd have to supply 'ls' with the "-a" switch to see them. To check if these files where modified you could use your package manager (if it can verify package contents) or a dedicated file integrity tool like Aide or Samhain (if you did install it way before). Else a visual inspection should tell. Perl packfiles aren't "evil" by definition. They can be used to uninstall a module. Some distro's do not to ship them.
 
Old 09-04-2007, 12:15 AM   #3
Skillz
Member
 
Registered: Sep 2007
Posts: 252

Original Poster
Rep: Reputation: 32
Would it mess anything up if I just removed all those directories?
 
Old 09-04-2007, 01:12 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Dunno. If you use something like or similar to 'perlwh' it could. Else just tar 'em up and *then* delete. At least then you've got a backup to fall back on.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Is it safe to delete the contents of /tmp? tramni1980 Slackware 19 01-15-2007 03:39 PM
Safe to delete mail file? svenger Linux - General 6 12-31-2006 01:24 PM
What Slackware Packages are safe for me to delete? C. nemoralis Slackware 8 07-18-2004 02:50 PM
What is safe do delete in slack9? kleptophobiac Slackware 10 08-13-2003 10:30 PM
Is it safe to delete default nobody user? dunkyb Linux - General 2 03-16-2003 01:38 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:02 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration