summaryrefslogtreecommitdiff
path: root/system/chkrootkit/README
diff options
context:
space:
mode:
authorMichiel van Wessem <michiel.van.wessem@gmail.com>2010-05-11 15:18:34 +0200
committerRobby Workman <rworkman@slackbuilds.org>2010-05-11 15:18:34 +0200
commitf20809db3f7e86c8ec516efad57525545435d6ba (patch)
tree4dfd338c761ac4e81c59f7909d0844633a8ffcc7 /system/chkrootkit/README
parent5c160af0fa05ff3b602b4f6db3fc67f1431f9ab4 (diff)
downloadslackbuilds-f20809db3f7e86c8ec516efad57525545435d6ba.tar.gz
system/chkrootkit: Initial import
Diffstat (limited to 'system/chkrootkit/README')
-rw-r--r--system/chkrootkit/README16
1 files changed, 16 insertions, 0 deletions
diff --git a/system/chkrootkit/README b/system/chkrootkit/README
new file mode 100644
index 0000000000..31c9fa8506
--- /dev/null
+++ b/system/chkrootkit/README
@@ -0,0 +1,16 @@
+chkrootkit (Check Rootkit) is a common unix-based program intended to help
+system administrators check their system for known rootkits. It is a shell
+script using common UNIX/Linux tools like the strings and grep commands to
+search core system programs for signatures and for comparing a traversal of the
+/proc filesystem with the output of the ps (process status) command to look for
+discrepancies.
+
+It can be used from a "rescue disc" (typically a LiveCD) or it can optionally
+use an alternative directory from which to run all of its own commands. These
+techniques allow chkrootkit to trust the commands upon which it depends a bit
+more.
+
+There are inherent limitations to the reliability of any program that attempts
+to detect compromises (such as rootkits and computer viruses). Newer rootkits
+may specifically attempt to detect and compromise copies of the chkrootkit
+programs or take other measures to evade detection by them.