+- Linux Lite Forums (https://www.freecinema2022.gq/forums)
+-- Forum: Software - Support (https://www.freecinema2022.gq/forums/forumdisplay.php?fid=5)
+--- Forum: Other (https://www.freecinema2022.gq/forums/forumdisplay.php?fid=20)
+--- Thread: z2 and message in chkrootkit (/showthread.php?tid=4724)
z2 and message in chkrootkit - ian_r_h - 12-04-2017
Hi, all,
I've installed chkrootkit on one of my units; but some time after the initial build rather than straightaway as I would have liked to have done (in order to establish a baseline for a fresh build).
I've got one line which I don't understand, and which I've drawn a blank when Googling and am hoping someone might be able to give me some pointers:
Checking `z2'... user ian deleted or never logged from lastlog!
Does anyone know to what "z2" is referring?
I'm unfamiliar with the lastlog command also, being new to the terminal, etc.
I don't think it's necessarily related, but I also get a strange entry under
Checking `chkutmp'... The tty of the following user process(es) were not found
in /var/run/utmp !
Which looks like some form of bug(?) in chkrootkit, when connected to the Internet (and in this case running firefox which returns 57.0.1 64-bit in firejail):
! RUID PID TTY CMD
! �⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire 0 ‧ ??? ??? ? ‹›⁁⁄⁒ ⅓�⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire �⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire
! �⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire 0 ‧ ??? ??? ? ‹›⁁⁄⁒ ⅓�⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire �⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire
! �⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire 0 ‧ ??? ??? ? ‹›⁁⁄⁒ ⅓�⅙⅚?⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire �⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞?．／｡ﾠ ??? �|159:4;high| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/fire
before more expected entries which generally seem to refer to running chkrootkit as sudo:
! ian 31063 pts/4 /bin/bash
! root 31070 pts/4 /bin/sh /usr/sbin/chkrootkit
! root 31726 pts/4 ./chkutmp
! root 31728 pts/4 ps axk tty,ruser,args -o tty,pid,ruser,args
! root 31727 pts/4 sh -c ps axk "tty,ruser,args" -o "tty,pid,ruser,args"
! root 31069 pts/4 sudo chkrootkit
chkutmp: nothing deleted
Thanks all,
Ian
Re: z2 and message in chkrootkit - trinidad - 12-04-2017
I believe z2 refers to a backgrounded process error message, 2 being the error status and z referring to its being a backgrounded process.
Here you go:
http://write.flossmanuals.net/command-line/processes/
TC
Re: z2 and message in chkrootkit - ian_r_h - 12-05-2017
Thanks, TC.