(adding to my original post)
More information that I didn't think of before, but now comes to mind as
relevant...
Here is the sequence of things I did this morning:
1. I powered up at about 8am this morning.
2. An automated rkhunter scan ran at about 8:15am.
3. I launched firefox as a common user at about the same time.
4. At about 10am, I logged out as a common user (I had already quit
firefox some 30 minutes earlier) and logged in as root.
5. I did a manual rkhunter scan; no warnings.
6. I did my weekly patches.
7. I re-booted.
8. I ran another manual rkhunter scan; no warnings not related to the
patching.
9. I did a manual rkhunter --propupd to take care of the patch-replated
warnings.
10. I ran another manual rkhunter scan; no warnings.
11. I checked root e-mail (using mailx), and found from rkhunter the
message containing the warning that I put in the original post.
This does seem to answer one of sixpack13's questions:
> - if it survives a reboot,
The rkhunter warning of concern did not recur after the re-boot.
I did a bunch of internet searching regarding zaRwT.KiT; nothing that
seems to me to be useful so far. I'll do more and reply to sixpack13
when done.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
