--- chkrootkit.orig 2008-04-12 13:39:50.000000000 +0300 +++ chkrootkit 2008-04-12 13:31:03.000000000 +0300 @@ -12,6 +12,7 @@ # Gentoo specific : Could use `type | cut -f 3 -d " "` IFPROMISC="/usr/sbin/ifpromisc" +CHKDIRS="/usr/sbin/chkdirs" CHKLASTLOG="/usr/sbin/chklastlog" CHKPROC="/usr/sbin/chkproc" CHKWTMP="/usr/sbin/chkwtmp" @@ -723,8 +724,8 @@ if [ "${QUIET}" != "t" ]; then printn \ "Searching for suspicious files and dirs, it may take a while... "; fi - files=`${find} ${DIR} -name ".[A-Za-z]*" -o -name "...*" -o -name ".. *"` - dirs=`${find} ${DIR} -type d -name ".*"` + files=`${find} ${DIR} ! -type d ! -size 0 ! -name .packlist -name ".[A-Za-z]*" -o -name "...*" -o -name ".. *"` + dirs=`${find} ${DIR} ! -path /usr/lib/nessus/plugins/.desc -type d -name ".*"` if [ "${files}" = "" -a "${dirs}" = "" ] then if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi @@ -1616,7 +1617,7 @@ expertmode_output "${CMD} -l -u nobody" return 5 fi - if ${CMD} -l -u nobody >/dev/null 2>&1 ; then + if [ -n "$(${CMD} -l -u nobody 2>/dev/null)" ]; then ${echo} "Warning: crontab for nobody found, possible Lupper.Worm... " if ${CMD} -l -u nobody 2>/dev/null | ${egrep} $CRONTAB_I_L >/dev/null 2>&1 then