On 8/4/06, <b class="gmail_sendername">Anthony Boynes</b> &lt;<a href="mailto:aboynes@gmail.com">aboynes@gmail.com</a>&gt; wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
These are known issues.<br><br>&gt;From /usr/share/doc/rkhunter/README.Debian<br><br>Below is a list of common hidden files and directories known to set off<br>false alarms in rkhunter:<br><br>&nbsp;&nbsp;* /dev/.static/, /dev/.udev &amp; /dev/.udevdb/ - used by udev
<br><br>IIRC, there are already bug reports filed about initramfs false positives.<br><br><br>Anthony<br><br></blockquote></div><br>&nbsp;The reason it sets off alarms, is because rkhunter was written assuming /dev would always contain static files(ie. 
2.4.x vs 2.6.x), so when it sees .blah it assumes it's an attackers hidden directory(/dev is a popular place for rootkits and trojans to hide their dirs). Personally, I'd recommend chkrootkit over rkhunter, but both are about equally useless since people don't really use rookits from 2001 anymore, nor are recent updates to either checker reflective of advancements in backdoor technology. :-\
<br>