Re: can netstat be infected

["Jeremy C. Reed" <reed%reedmedia.net@localhost>]

On Tue, 10 Jul 2012, Darrel wrote:

> I have a recent installation of NetBSD beta, which has been rebuilt
> once.
> 
> chkrootkit reports that fstat is infected:

netstat not fstat.

> Checking `mingetty'... not found
> Checking `netstat'... INFECTED
> Checking `named'... not infected

The chkrootkit looks for a pattern in the strings output.

strings -a /usr/bin/netstat | egrep 
"/dev/hdl0/dev/xdta|/dev/ttyoa|/dev/pty[pqrsx]|/dev/cui|/dev/hdn0|/dev/cui221|/dev/dszy|/dev/ddth3|/dev/caca|^/prof|/dev/tux|grep|addr\.h"

So why does it think it is infected for you?

The package message says "Please note that using chkrootkit on a 
non-supported platform may lead to false positive results." It is only 
documented to have been tested on NetBSD for version 1.6.x.