Chkrootkit question

[Paul Howarth]

Anne Wilson wrote:
> On Tuesday 18 April 2006 14:24, Paul Howarth wrote:
>> Anne Wilson wrote:
>>> On Monday 17 April 2006 12:36, Gene Heskett wrote:
>>>> On Monday 17 April 2006 06:34, Anne Wilson wrote:
>>>>> These files appear in the 'Suspicious files' section:
>>>>>
>>>>> /usr/lib/qt-3.3/etc/settings/.qtpartedrc.lock
>>>>> /usr/lib/qt-3.3/etc/settings/.qtrc.lock
>>>>> /usr/lib/qt-3.3/etc/settings/.qt_plugins_3.3rc.lock
>>>>> /usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/DCOP/.pac
>>>>> klist /usr/lib/perl5/5.8.6/i386-linux-thread-multi/.packlist
>>>>>
>>>>> They have been there for some days, and I suspect they may have been
>>>>> left behind from a crash.  Should I try to get rid of them, or just
>>>>> ignore them? I wouldn't have thought they could be doing anything
>>>>> harmful.
>>>> I have some like that Anne, been there for years. I've ignored them.
>> The .packlist files come from manually-installed (i.e. not from RPMs)
>> perl modules. If the file *does* come from an RPM, I'd suggest
>> bugzilla-ing the RPM in question as the .packlist file isn't needed and
>> shouldn't be packaged.
>>
> Looks to me as though they came from Extras.  Is it worth bugzilla-ing, 
> though, I wonder?  They do no harm, and there are more important things for 
> the maintainers to consider.

Actually they appear to be from Core packages.

/usr/lib/perl5/site_perl/5.8.6/i386-linux-thread-multi/auto/DCOP/.packlist 
is from kdebindings

/usr/lib/perl5/5.8.6/i386-linux-thread-multi/.packlist is from the main 
perl package

I'd be inclined to ignore them too.

Paul.