diff -burN chkrootkit-0.42b.orig/chkrootkit chkrootkit-0.42b/chkrootkit --- chkrootkit-0.42b.orig/chkrootkit 2003-09-22 22:57:30.383435144 +0200 +++ chkrootkit-0.42b/chkrootkit 2003-09-22 23:07:24.364136352 +0200 @@ -151,15 +151,15 @@ fi if [ "${EXPERT}" = "t" ]; then - expertmode_output "./ifpromisc" + expertmode_output "/usr/bin/chkrootkit-ifpromisc" return 5 fi if [ ! -f ${ROOTDIR}proc/net/packet ]; then - if [ ! -x ./ifpromisc ]; then - echo "not tested: can't exec ./ifpromisc" + if [ ! -x /usr/bin/chkrootkit-ifpromisc ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-ifpromisc" return ${NOT_TESTED} fi - [ "${QUIET}" != "t" ] && ./ifpromisc || ./ifpromisc -q + [ "${QUIET}" != "t" ] && /usr/bin/chkrootkit-ifpromisc || /usr/bin/chkrootkit-ifpromisc -q else if [ `${egrep} -c "3 0003" ${ROOTDIR}proc/net/packet 2>/dev/null` -gt 0 ]; then set `${egrep} ":" $ROOTDIR/proc/net/dev | ${egrep} -v "lo:" | cut -f 1 -d:` @@ -174,8 +174,8 @@ } z2 () { - if [ ! -x ./chklastlog ]; then - echo "not tested: can't exec ./chklastlog" + if [ ! -x /usr/bin/chkrootkit-chklastlog ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-chklastlog" return ${NOT_TESTED} fi @@ -183,31 +183,31 @@ LASTLOG=`loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm"` if [ "${EXPERT}" = "t" ]; then - expertmode_output "./chklastlog -f ${WTMP} -l ${LASTLOG}" + expertmode_output "/usr/bin/chkrootkit-chklastlog -f ${WTMP} -l ${LASTLOG}" return 5 fi - if ./chklastlog -f ${WTMP} -l ${LASTLOG} + if /usr/bin/chkrootkit-chklastlog -f ${WTMP} -l ${LASTLOG} then if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi fi } wted () { - if [ ! -x ./chkwtmp ]; then - echo "not tested: can't exec ./chkwtmp" + if [ ! -x /usr/bin/chkrootkit-chkwtmp ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-chkwtmp" return ${NOT_TESTED} fi if [ "$SYSTEM" = "SunOS" ]; then - if [ ! -x ./check_wtmpx ]; then - echo "not tested: can't exec ./check_wtmpx" + if [ ! -x /usr/bin/chkrootkit-check_wtmpx ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-check_wtmpx" else if [ "${EXPERT}" = "t" ]; then - expertmode_output "./check_wtmpx" + expertmode_output "/usr/bin/chkrootkit-check_wtmpx" return 5 fi - if ./check_wtmpx + if /usr/bin/chkrootkit-check_wtmpx then if [ "${QUIET}" != "t" ]; then \ echo "nothing deleted in /var/adm/wtmpx"; fi @@ -217,12 +217,12 @@ WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"` if [ "${EXPERT}" = "t" ]; then - expertmode_output "./chkwtmp -f ${WTMP}" + expertmode_output "/usr/bin/chkrootkit-chkwtmp -f ${WTMP}" return 5 fi fi - if ./chkwtmp -f ${WTMP} + if /usr/bin/chkrootkit-chkwtmp -f ${WTMP} then if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi fi @@ -261,8 +261,8 @@ prog="" if [ \( "${SYSTEM}" = "Linux" -o \( "${SYSTEM}" = "FreeBSD" -a \ ${V} -gt 43 \) \) -a "${ROOTDIR}" = "/" ]; then - [ ! -x ./chkproc ] && prog="./chkproc" - [ ! -x ./chkdirs ] && prog="$prog ./chkdirs" + [ ! -x /usr/bin/chkrootkit-chkproc ] && prog="/usr/bin/chkrootkit-chkproc" + [ ! -x /usr/bin/chkrootkit-chkdirs ] && prog="$prog /usr/bin/chkrootkit-chkdirs" if [ "$prog" != "" ]; then # echo "not tested: can't exec $prog" return ${NOT_TESTED} @@ -271,7 +271,7 @@ if [ "${EXPERT}" = "t" ]; then [ -r /proc/ksyms ] && ${egrep} -i "adore|sebek" < /proc/ksyms 2>/dev/null [ -d /proc/knark ] && ${ls} -la /proc/knark 2> /dev/null - expertmode_output "./chkproc -v -v" + expertmode_output "/usr/bin/chkrootkit-chkproc -v -v" return 5 fi @@ -292,7 +292,7 @@ echo "Warning: Knark LKM installed" fi - if ./chkproc + if /usr/bin/chkrootkit-chkproc then if [ "${QUIET}" != "t" ]; then echo "nothing detected"; fi else @@ -1463,18 +1463,18 @@ if [ "${SYSTEM}" = "Linux" ] then - if [ ! -x ./strings ]; then - printn "can't exec ./strings-static, " + if [ ! -x /usr/bin/chkrootkit-strings ]; then + printn "can't exec /usr/bin/chkrootkit-strings-static, " return ${NOT_TESTED} fi if [ "${EXPERT}" = "t" ]; then - expertmode_output "./strings -a ${CMD}" + expertmode_output "/usr/bin/chkrootkit-strings -a ${CMD}" return 5 fi ### strings must be a statically linked binary. - if ./strings -a ${CMD} > /dev/null 2>&1 + if /usr/bin/chkrootkit-strings -a ${CMD} > /dev/null 2>&1 then STATUS=${INFECTED} fi