- updated for 0.36

[packages/chkrootkit.git] / chkrootkit-names.patch

diff --git a/chkrootkit-names.patch b/chkrootkit-names.patch
index 38742227cfef8b604b7c41fc203bccbd60498d61..7d619a7c76b7480ab9fa193a671495d2b5824355 100644 (file)
--- a/chkrootkit-names.patch
+++ b/chkrootkit-names.patch
@@ -1,20 +1,6 @@
-diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
---- chkrootkit-0.35/chkrootkit Fri Jan 18 11:49:46 2002
-+++ chkrootkit-0.35-new/chkrootkit     Wed Feb 13 12:00:38 2002
-@@ -1,6 +1,11 @@
--#! /bin/sh
-+#! /bin/bash
- # -*- Shell-script -*-
- 
-+# We have to go to a dir with chkrootkit-* binaries
-+# Otherwise some tests will not get executed.
-+
-+cd /usr/bin
-+
- # $Id: chkrootkit, v 0.35 2002/01/17
- CHKROOTKIT_VERSION='0.35'
- 
-@@ -47,7 +52,7 @@
+--- ./chkrootkit.org   Tue Jul  9 15:20:07 2002
++++ ./chkrootkit       Tue Jul  9 15:19:45 2002
+@@ -47,7 +47,7 @@
  
      if [ "${EXPERT}" = "t" ]; then
          expertmode_output "${egrep} ^asp ${ROOTDIR}etc/inetd.conf"
@@ -23,7 +9,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
          return 5
      fi
  
-@@ -63,7 +68,7 @@
+@@ -63,7 +63,7 @@
          STATUS=${INFECTED}
      fi
  
@@ -32,7 +18,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         then
            echo "INFECTED"
            STATUS=${INFECTED}
-@@ -81,22 +86,22 @@
+@@ -81,22 +81,22 @@
         return ${NOT_TESTED}
      fi
  
@@ -61,7 +47,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
        return ${NOT_TESTED}
      fi
  
-@@ -104,31 +109,31 @@
+@@ -104,31 +104,31 @@
      LASTLOG=`loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -92,7 +78,8 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
 +          echo "not tested: can't exec ./chkrootkit-check_wtmpx"
         else
            if [ "${EXPERT}" = "t" ]; then
-              expertmode_output "./chec_wtmpx"
+-             expertmode_output "./chec_wtmpx"
++             expertmode_output "./chkrootkit-check_wtmpx"
                return 5
            fi
 -          if ./check_wtmpx
@@ -100,8 +87,8 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
               then
               if [ "${QUIET}" != "t" ]; then \
                  echo "nothing deleted in /var/adm/wtmpx"; fi
-@@ -139,11 +144,11 @@
-     WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
+@@ -139,11 +139,11 @@
+     WTMP=`loc wtmpx wtmpx "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
  
      if [ "${EXPERT}" = "t" ]; then
 -        expertmode_output "./chkwtmp -f ${WTMP}"
@@ -114,7 +101,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
        if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi
      fi
-@@ -181,15 +186,15 @@
+@@ -181,15 +181,15 @@
  {
      if [ \( "${SYSTEM}" = "Linux"  -o \( "${SYSTEM}" = "FreeBSD" -a \
         ${V} -gt 43 \) \) -a "${ROOTDIR}" = "/" ]; then
@@ -133,7 +120,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
            return 5
        fi
  
-@@ -204,7 +209,7 @@
+@@ -204,7 +204,7 @@
           echo "Warning: Knark LKM installed"
        fi
  
@@ -142,7 +129,25 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
        then
             if [ "${QUIET}" != "t" ]; then echo "nothing detected"; fi
        else
-@@ -742,19 +747,19 @@
+@@ -324,7 +324,7 @@
+         expertmode_output "${find} ${ROOTDIR}dev/cuc 2>&1 /dev/null"
+ 
+         ### Monkit
+-        expertmode_output "${find} ${ROOTDIR}lib/defs \
++        expertmode_output "${find} ${ROOTDIR}lib/defs" \
+ 
+         ### Showtee
+        expertmode_output "${ls} ${ROOTDIR}usr/lib/.egcs \
+@@ -332,7 +332,7 @@
+ ${ROOTDIR}usr/lib/.kinetic ${ROOTDIR}/usr/lib/liblog.o \
+ ${ROOTDIR}/usr/include/addr.h  ${ROOTDIR}usr/include/cron.h \
+ ${ROOTDIR}/usr/include/file.h ${ROOTDIR}usr/include/proc.h \
+-${ROOTDIR}/usr/include/syslogs.h ${ROOTDIR}/usr/include/chk.h  2> /dev/null
++${ROOTDIR}/usr/include/syslogs.h ${ROOTDIR}/usr/include/chk.h  2> /dev/null"
+ 
+        ### Optickit
+        expertmode_output "${find} ${ROOTDIR}usr/bin -name xchk -o -name xsf"
+@@ -805,19 +805,19 @@
      CMD=`loc chfn chfn $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -165,7 +170,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
                  ${egrep} -c "${GENERIC_ROOTKIT_LABEL}"` -ne 2 ]
            then
               STATUS=${INFECTED}
-@@ -769,16 +774,16 @@
+@@ -832,16 +832,16 @@
      REDHAT_PAM_LABEL="*NOT*"
  
      if [ "${EXPERT}" = "t" ]; then
@@ -185,7 +190,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
               >/dev/null 2>&1
                  then
                  :
-@@ -787,7 +792,7 @@
+@@ -850,7 +850,7 @@
               fi
            fi;;
         FreeBSD)
@@ -194,7 +199,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
               then
               STATUS=${INFECTED}
            fi;;
-@@ -803,12 +808,12 @@
+@@ -866,12 +866,12 @@
      CMD=`loc login login $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -203,13 +208,13 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
          return 5
      fi
  
-     TROJED_L_L="^root$|vejeta|xlogin|^@\(#\)klogin\.c|lets_log|sukasuka|/usr/lib/.ark?"
+     TROJED_L_L="^root$|vejeta|xlogin|^@\(#\)klogin\.c|lets_log|sukasuka|/usr/lib/.ark?|SucKIT"
 -    ret=`${strings} -a ${CMD} | ${egrep} -c "${TROJED_L_L}"`
 +    ret=`${chkrootkit-strings} -a ${CMD} | ${egrep} -c "${TROJED_L_L}"`
      if [ ${ret} -gt 0 ]; then
          case ${ret} in
          1) [ "${SYSTEM}" = "OpenBSD" -a ${V} -le 27 ] && \
-@@ -831,14 +836,14 @@
+@@ -894,14 +894,14 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -226,7 +231,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -856,11 +861,11 @@
+@@ -919,11 +919,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -240,7 +245,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -879,11 +884,11 @@
+@@ -942,11 +942,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -254,7 +259,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -900,11 +905,11 @@
+@@ -963,11 +963,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -268,7 +273,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -922,11 +927,11 @@
+@@ -985,11 +985,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -282,7 +287,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -944,11 +949,11 @@
+@@ -1007,11 +1007,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -296,7 +301,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -966,11 +971,11 @@
+@@ -1029,11 +1029,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -310,7 +315,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -984,11 +989,11 @@
+@@ -1047,11 +1047,11 @@
      CMD=`loc ls ls $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -324,7 +329,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1001,11 +1006,11 @@
+@@ -1064,11 +1064,11 @@
      CMD=`loc du du $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -338,7 +343,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1025,11 +1030,11 @@
+@@ -1088,11 +1088,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -352,7 +357,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -1043,11 +1048,11 @@
+@@ -1106,11 +1106,11 @@
      CMD=`loc netstat netstat $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -366,7 +371,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      >/dev/null 2>&1
      then
         STATUS=${INFECTED}
-@@ -1062,11 +1067,11 @@
+@@ -1125,11 +1125,11 @@
     CMD=`loc ps ps $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -380,7 +385,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1084,11 +1089,11 @@
+@@ -1147,11 +1147,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -394,7 +399,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1106,11 +1111,11 @@
+@@ -1169,11 +1169,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -408,7 +413,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1128,11 +1133,11 @@
+@@ -1191,11 +1191,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -422,7 +427,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1150,11 +1155,11 @@
+@@ -1213,11 +1213,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -436,14 +441,13 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1167,18 +1172,18 @@
+@@ -1230,18 +1230,18 @@
  
     if [ "${SYSTEM}" = "Linux" ]
     then
 -      if [ ! -x ./strings ]; then
--        printn "can't exec ./strings-static, "
 +      if [ ! -x ./chkrootkit-strings ]; then
-+        printn "can't exec ./chkrootkit-strings-static, "
+         printn "can't exec ./strings-static, "
          return ${NOT_TESTED}
        fi
  
@@ -460,7 +464,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
        then
           STATUS=${INFECTED}
        fi
-@@ -1193,11 +1198,11 @@
+@@ -1256,11 +1256,11 @@
     CMD=`loc basename basename $pth`
  
     if [ "${EXPERT}" = "t" ]; then
@@ -474,7 +478,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
     then
         STATUS=${INFECTED}
     fi
-@@ -1213,11 +1218,11 @@
+@@ -1276,11 +1276,11 @@
      CMD=`loc dirname dirname $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -488,7 +492,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1238,11 +1243,11 @@
+@@ -1301,11 +1301,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -502,7 +506,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1254,12 +1259,12 @@
+@@ -1317,12 +1317,12 @@
      CMD=`loc rpcinfo rpcinfo $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -517,7 +521,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1275,12 +1280,12 @@
+@@ -1338,12 +1338,12 @@
      CMD=`loc date date $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -532,7 +536,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1296,12 +1301,12 @@
+@@ -1359,12 +1359,12 @@
      CMD=`loc echo echo $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -547,7 +551,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1317,12 +1322,12 @@
+@@ -1380,12 +1380,12 @@
      CMD=`loc env env $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -562,7 +566,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1344,11 +1349,11 @@
+@@ -1407,11 +1407,11 @@
         fi
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -576,7 +580,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1362,11 +1367,11 @@
+@@ -1425,11 +1425,11 @@
         return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -590,7 +594,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1380,11 +1385,11 @@
+@@ -1443,11 +1443,11 @@
         return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -604,7 +608,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1398,11 +1403,11 @@
+@@ -1461,11 +1461,11 @@
          return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -618,7 +622,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1414,12 +1419,12 @@
+@@ -1477,12 +1477,12 @@
      CMD=`loc write write $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -633,7 +637,21 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1455,7 +1460,7 @@
+@@ -1499,11 +1499,11 @@
+     W_INFECTED_LABEL="uname -a"
+ 
+     if [ "${EXPERT}" = "t" ]; then
+-        expertmode_output "${strings} -a ${CMD}"
++        expertmode_output "${chkrootkit-strings} -a ${CMD}"
+         expertmode_output "${ls} -l ${CMD}"
+         return 5
+     fi
+-    if ${strings} -a ${CMD} | ${egrep} "${W_INFECTED_LABEL}" > /dev/null 2>&1
++    if ${chkrootkit-strings} -a ${CMD} | ${egrep} "${W_INFECTED_LABEL}" > /dev/null 2>&1
+     then
+         STATUS=${INFECTED}
+     fi
+@@ -1535,7 +1535,7 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -642,7 +660,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
          return 5
      fi
      STATUS=${INFECTED}
-@@ -1473,12 +1478,12 @@
+@@ -1553,12 +1553,12 @@
      MAIL_INFECTED_LABEL="sh -i"
  
      if [ "${EXPERT}" = "t" ]; then
@@ -657,7 +675,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1498,12 +1503,12 @@
+@@ -1578,12 +1578,12 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -672,7 +690,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1520,11 +1525,11 @@
+@@ -1600,11 +1600,11 @@
      CMD=`loc egrep egrep $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -686,7 +704,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1537,12 +1542,12 @@
+@@ -1617,12 +1617,12 @@
      CMD=`loc grep grep $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -701,7 +719,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1564,11 +1569,11 @@
+@@ -1644,11 +1644,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -715,7 +733,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1586,10 +1591,10 @@
+@@ -1666,10 +1666,10 @@
         fi
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -728,7 +746,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1604,10 +1609,10 @@
+@@ -1684,10 +1684,10 @@
           return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -741,7 +759,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1622,10 +1627,10 @@
+@@ -1702,10 +1702,10 @@
           return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -754,7 +772,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1640,10 +1645,10 @@
+@@ -1720,10 +1720,10 @@
           return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -767,7 +785,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1662,10 +1667,10 @@
+@@ -1742,10 +1742,10 @@
          return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -780,7 +798,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
         STATUS=${INFECTED}
      fi
-@@ -1677,12 +1682,12 @@
+@@ -1757,18 +1757,18 @@
      CMD="${ROOTDIR}sbin/ifconfig"
  
      if [ "${EXPERT}" = "t" ]; then
@@ -790,12 +808,19 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      fi
  
      IFCONFIG_NOT_INFECTED_LABEL="PROMISC"
+     IFCONFIG_INFECTED_LABEL="/dev/tux"
 -    if ${strings} -a ${CMD} | ${egrep} "${IFCONFIG_NOT_INFECTED_LABEL}" \
 +    if ${chkrootkit-strings} -a ${CMD} | ${egrep} "${IFCONFIG_NOT_INFECTED_LABEL}" \
      >/dev/null 2>&1
      then
         STATUS=${NOT_INFECTED}
-@@ -1702,12 +1707,12 @@
+     fi
+-    if ${strings} -a ${CMD} | ${egrep} "${IFCONFIG_INFECTED_LABEL}" \
++    if ${chkrootkit-strings} -a ${CMD} | ${egrep} "${IFCONFIG_INFECTED_LABEL}" \
+     >/dev/null 2>&1
+     then
+        STATUS=${INFECTED}
+@@ -1788,12 +1788,12 @@
         return ${NOT_FOUND}
      fi
      if [ "${EXPERT}" = "t" ]; then
@@ -810,7 +835,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
          if ${egrep} "^#.*rshd" ${ROOTDIR}etc/inetd.conf >/dev/null 2>&1 -o \
-@@ -1733,11 +1738,11 @@
+@@ -1819,11 +1819,11 @@
      CMD=${ROOTDIR}${CMD}
  
      if [ "${EXPERT}" = "t" ]; then
@@ -824,7 +849,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1754,11 +1759,11 @@
+@@ -1840,11 +1840,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -838,7 +863,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         > /dev/null 2>&1
      then
          STATUS=${INFECTED}
-@@ -1775,11 +1780,11 @@
+@@ -1861,11 +1861,11 @@
      CMD=`loc su su $pth`
  
      if [ "${EXPERT}" = "t" ]; then
@@ -852,7 +877,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
      then
          STATUS=${INFECTED}
      fi
-@@ -1799,11 +1804,11 @@
+@@ -1885,11 +1885,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -866,7 +891,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
  > /dev/null 2>&1
      then
          STATUS=${INFECTED}
-@@ -1851,11 +1856,11 @@
+@@ -1937,11 +1937,11 @@
      fi
  
      if [ "${EXPERT}" = "t" ]; then
@@ -880,7 +905,7 @@ diff -Nru chkrootkit-0.35/chkrootkit chkrootkit-0.35-new/chkrootkit
         >/dev/null 2>&1
      then
          STATUS=${INFECTED}
-@@ -1935,7 +1940,7 @@
+@@ -2021,7 +2021,7 @@
  netstat
  ps
  sed