rkhunter found this...

[Daniel B. Thurman]

Daniel B. Thurman wrote:
> Tom Horsley wrote:
>> On Thu, 26 Mar 2009 20:07:54 -0400
>> brian wrote:
>>
>>>> It means some script somewhere did an rm -f on /dev/null
>>>> then later some other script redirected output to /dev/null
>>>> thus creating it as a regular file.
>>> It looks more like a typo, as another poster said (one L).
>>
>> Could be, but I had /dev/null deleted on a machine once and
>> the ensuing fun was really spectacular :-).
>>
>> Doing "whatever > /dev/null" wasn't too bad, but when
>> someone said "whatever < /dev/null" amazingly random things
>> could happen.
>>
> The point is, it is not MY scripts doing this! I have had
> this bugger for quite some time on F9 and it does not
> go away! Grr. I just deleted it every time rkhunter
> reports it. Probably just ignore the darn thing....
Since there is this nsdc: found in the text, I looked it up:

> NSDC(8) BSD System Manager’s Manual NSDC(8)
>
> NAME
> nsdc - Name Server Daemon (NSD) control script
So perhaps somewhere in there is the offending /dev/nul script somewhere...
any idea where to look?