[FreeNX-kNX] Chkrootkit, false positive

[Paul van der Vlis]

Hello,

This morning I got an e-mail from chkrootkit, it says:
INFECTED (PORTS:  4000)

This is a false positive when you have a running nx-connection with
services. I had a Samba-connection with both a printer and a share.
I had a connection to localhost, so I don't know or it is the server or
the client what opens port 4000, I think the server.

Read the sources of chkrootkit and search for "4000".

Chkrootkit checks this ports:
114 145 465 511 600 1008 1524 1999 1978 2881 3049 3133 3879 4000 4369
5190 5665 10008 12321 23132 27374 29364 30999 31336 31337 45454 47017
47889 60001

Maybe this message saves time to other people!  Pffff.

With regards,
Paul van der Vlis.

-- 
http://www.vandervlis.nl/