[Pkg-sysvinit-devel] Bug#403863: Cron <root@stfu> test -x /usr/sbin/anacron || run-parts --report /etc/cron.daily

[Michael Holzt]

I just found this bug report and i would like to add to the "It also looks
remarkably like something left by a break-in or rootkit.". In fact the
chkrootkit package _does_ warn about this file and identifies it as a
possible rootkit:

> /etc/cron.daily/chkrootkit:
> The following suspicious files and directories were found:
> /lib/init/rw/.ramfs

As chkrootkit also warned about two other suspicios findings, this really
scared the hell out of me. So if even chkrootkit finds this file wrong,
please get rid of it. Or if you must have it there, please contact the
chkrootkit maintainer to have this file excluded from checking.


Regards
Michael

-- 
      It's an insane world, but i'm proud to be a part of it. -- Bill Hicks