Use a bootable disc with either or both tools on it, boot the machine(s) in question with that media and then run the tests. Fedora 17, which just came out, has a bootable security spin you could/should try, too.
From: Beartooth <beartooth@xxxxxxxxxxx>
To: users@xxxxxxxxxxxxxxxxxxxxxxx
Sent: Thursday, June 7, 2012 11:16 AM
Subject: Which to trust: chkrootkit or rkhunter?
One tells me, on several machines, that /sbin/init is infected
with the Suckit rootkit; the other says not. Is there a way to tell
whether I'm seeing a false positive or a false negative?
Fwiw, this result occurs both on an F16 machine, and on an f17
one with a fresh install. (Both are fully updated.)
--
Beartooth Staffwright, Neo-Redneck Not Quite Clueless Power User
I have precious (very precious!) little idea where up is.
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
-- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
