diff -Nur chkrootkit-0.43.orig/chkrootkit chkrootkit-0.43/chkrootkit --- chkrootkit-0.43.orig/chkrootkit 2003-12-28 17:48:16.000000000 +0100 +++ chkrootkit-0.43/chkrootkit 2003-12-30 09:09:25.887663096 +0100 @@ -151,20 +151,20 @@ fi if [ "${EXPERT}" = "t" ]; then - expertmode_output "./ifpromisc" -v + expertmode_output "/usr/bin/chkrootkit-ifpromisc" -v return 5 fi - if [ ! -x ./ifpromisc ]; then - echo "not tested: can't exec ./ifpromisc" + if [ ! -x /usr/bin/chkrootkit-ifpromisc ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-ifpromisc" return ${NOT_TESTED} else - [ "${QUIET}" != "t" ] && ./ifpromisc -v || ./ifpromisc -q + [ "${QUIET}" != "t" ] && /usr/bin/chkrootkit-ifpromisc -v || /usr/bin/chkrootkit-ifpromisc -q fi } z2 () { - if [ ! -x ./chklastlog ]; then - echo "not tested: can't exec ./chklastlog" + if [ ! -x /usr/bin/chkrootkit-chklastlog ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-chklastlog" return ${NOT_TESTED} fi @@ -178,32 +178,32 @@ fi if [ "${EXPERT}" = "t" ]; then - expertmode_output "./chklastlog -f ${WTMP} -l ${LASTLOG}" + expertmode_output "/usr/bin/chkrootkit-chklastlog -f ${WTMP} -l ${LASTLOG}" return 5 fi - if ./chklastlog -f ${WTMP} -l ${LASTLOG} + if /usr/bin/chkrootkit-chklastlog -f ${WTMP} -l ${LASTLOG} then if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi fi } wted () { - if [ ! -x ./chkwtmp ]; then - echo "not tested: can't exec ./chkwtmp" + if [ ! -x /usr/bin/chkrootkit-chkwtmp ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-chkwtmp" return ${NOT_TESTED} fi if [ "$SYSTEM" = "SunOS" ]; then - if [ ! -x ./check_wtmpx ]; then - echo "not tested: can't exec ./check_wtmpx" + if [ ! -x /usr/bin/chkrootkit-check_wtmpx ]; then + echo "not tested: can't exec /usr/bin/chkrootkit-check_wtmpx" else if [ "${EXPERT}" = "t" ]; then - expertmode_output "./check_wtmpx" + expertmode_output "/usr/bin/chkrootkit-check_wtmpx" return 5 fi if [ -f ${ROOTDIR}var/adm/wtmp ]; then - if ./check_wtmpx + if /usr/bin/chkrootkit-check_wtmpx then if [ "${QUIET}" != "t" ]; then \ echo "nothing deleted in /var/adm/wtmpx"; fi @@ -214,12 +214,12 @@ WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"` if [ "${EXPERT}" = "t" ]; then - expertmode_output "./chkwtmp -f ${WTMP}" + expertmode_output "/usr/bin/chkrootkit-chkwtmp -f ${WTMP}" return 5 fi fi - if ./chkwtmp -f ${WTMP} + if /usr/bin/chkrootkit-chkwtmp -f ${WTMP} then if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi fi @@ -258,8 +258,8 @@ prog="" if [ \( "${SYSTEM}" = "Linux" -o \( "${SYSTEM}" = "FreeBSD" -a \ ${V} -gt 43 \) \) -a "${ROOTDIR}" = "/" ]; then - [ ! -x ./chkproc ] && prog="./chkproc" - [ ! -x ./chkdirs ] && prog="$prog ./chkdirs" + [ ! -x /usr/bin/chkrootkit-chkproc ] && prog="/usr/bin/chkrootkit-chkproc" + [ ! -x /usr/bin/chkrootkit-chkdirs ] && prog="$prog /usr/bin/chkrootkit-chkdirs" if [ "$prog" != "" ]; then # echo "not tested: can't exec $prog" return ${NOT_TESTED} @@ -268,7 +268,7 @@ if [ "${EXPERT}" = "t" ]; then [ -r /proc/ksyms ] && ${egrep} -i "adore|sebek" < /proc/ksyms 2>/dev/null [ -d /proc/knark ] && ${ls} -la /proc/knark 2> /dev/null - expertmode_output "./chkproc -v -v" + expertmode_output "/usr/bin/chkrootkit-chkproc -v -v" return 5 fi @@ -289,7 +289,7 @@ echo "Warning: Knark LKM installed" fi - if ./chkproc + if /usr/bin/chkrootkit-chkproc then if [ "${QUIET}" != "t" ]; then echo "nothing detected"; fi else @@ -1505,18 +1505,18 @@ if [ "${SYSTEM}" = "Linux" ] then - if [ ! -x ./strings-static ]; then - printn "can't exec ./strings-static, " + if [ ! -x /usr/bin/chkrootkit-strings ]; then + printn "can't exec /usr/bin/chkrootkit-strings, " return ${NOT_TESTED} fi if [ "${EXPERT}" = "t" ]; then - expertmode_output "./strings -a ${CMD}" + expertmode_output "/usr/bin/chkrootkit-strings -a ${CMD}" return 5 fi ### strings must be a statically linked binary. - if ./strings-static -a ${CMD} > /dev/null 2>&1 + if /usr/bin/chkrootkit-strings -a ${CMD} > /dev/null 2>&1 then STATUS=${INFECTED} fi diff -Nur chkrootkit-0.43.orig/Makefile chkrootkit-0.43/Makefile --- chkrootkit-0.43.orig/Makefile 2003-12-30 09:08:57.815930648 +0100 +++ chkrootkit-0.43/Makefile 2003-12-30 09:09:59.581540848 +0100 @@ -25,13 +25,13 @@ SRCS = chklastlog.c chkwtmp.c ifpromisc.c chkproc.c chkdirs.c check_wtmpx.c strings.c -OBJS = chklastlog.o chkwtmp.o ifpromisc.o chkproc.o chkdirs.o check_wtmpx.o strings-static.o +OBJS = chklastlog.o chkwtmp.o ifpromisc.o chkproc.o chkdirs.o check_wtmpx.o strings.o all: @echo '*** stopping make sense ***' @exec make sense -sense: chklastlog chkwtmp ifpromisc chkproc chkdirs check_wtmpx strings-static +sense: chklastlog chkwtmp ifpromisc chkproc chkdirs check_wtmpx strings chklastlog: chklastlog.c ${CC} ${CFLAGS} -o $@ chklastlog.c @@ -51,8 +51,8 @@ check_wtmpx: check_wtmpx.c ${CC} ${LDFLAGS} -o $@ check_wtmpx.c -strings-static: strings.c +strings: strings.c ${CC} ${STATIC} ${LDFLAGS} -o $@ strings.c clean: - rm -f ${OBJS} core chklastlog chkwtmp ifpromisc chkproc chkdirs check_wtmpx strings-static + rm -f ${OBJS} core chklastlog chkwtmp ifpromisc chkproc chkdirs check_wtmpx strings