[Rkhunter-users] phalanx2

[Vincent M. <vin...@gm...>]

Hi,

I think I'm seeing a new variant of phalanx2 that 1.3.6 appears not to find.

It installed a semi-randomly named file in /etc/cron.d/ , "ruWJLciOgrfX-boot"
which contained just this line:

  * * * * * root /usr/share/ruWJLciOgrfX.p2/.p-2.4a i &> /dev/null

In the /usr/share directory are files named like this: .config
.p-2.4a  .p2rc  .sniff.
The binary (contains phalanx2 in 'strings' output) is .p-2.4a.

Reactions?

Cheers
Vince