Gentoo Attachment #8302 for bug #15743

View | Details | Raw Unified
Collapse All | Expand All

(-) chkrootkit-0.39a/chkrootkit (-129 / +139 lines)

Lines 10-15	Link Here

# (C)1997-2003 Nelson Murilo, Pangeia Informatica, AMS Foundation and others.

# (C)1997-2003 Nelson Murilo, Pangeia Informatica, AMS Foundation and others.

# All rights reserved

# All rights reserved

# Gentoo specific : Could use `type <command> | cut -f 3 -d " "`

IFPROMISC="/usr/sbin/ifpromisc"

CHKLASTLOG="/usr/sbin/chklastlog"

CHKPROC="/usr/sbin/chkproc"

CHKWTMP="/usr/sbin/chkwtmp"

CHECK_WTMPX="/usr/sbin/check_wtmpx"

# ebuild doesn't install chkrootkit's strings; use gnus.

STRINGS="/usr/bin/strings"

### workaround for some Bourne shell implementations

### workaround for some Bourne shell implementations

unalias login > /dev/null 2>&1

unalias login > /dev/null 2>&1

unalias ls > /dev/null 2>&1

unalias ls > /dev/null 2>&1

Lines 96-102	Link Here

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${egrep} ^asp ${ROOTDIR}etc/inetd.conf"

        expertmode_output "${egrep} ^asp ${ROOTDIR}etc/inetd.conf"

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

Lines 112-118	Link Here

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${ASP_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${ASP_LABEL}" >/dev/null 2>&1

       then

       then

          echo "INFECTED"

          echo "INFECTED"

          STATUS=${INFECTED}

          STATUS=${INFECTED}

Lines 130-151	Link Here

       return ${NOT_TESTED}

       return ${NOT_TESTED}

fi

fi

    if [ ! -x ./ifpromisc ]; then

    if [ ! -x ${IFPROMISC} ]; then

      echo "not tested: can't exec ./ifpromisc"

      echo "not tested: can't exec ${IFPROMISC}"

      return ${NOT_TESTED}

      return ${NOT_TESTED}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "./ifpromisc"

        expertmode_output "${IFPROMISC}"

        return 5

        return 5

fi

fi

    echo

    echo

    ./ifpromisc

    ${IFPROMISC}

z2 () {

z2 () {

    if [ ! -x ./chklastlog ]; then

    if [ ! -x ${CHKLASTLOG} ]; then

      echo "not tested: can't exec ./chklastlog"

      echo "not tested: can't exec ${CHKLASTLOG}"

      return ${NOT_TESTED}

      return ${NOT_TESTED}

fi

fi

Lines 153-183	Link Here

    LASTLOG=`loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm"`

    LASTLOG=`loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm"`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "./chklastlog -f ${WTMP} -l ${LASTLOG}"

        expertmode_output "${CHKLASTLOG} -f ${WTMP} -l ${LASTLOG}"

        return 5

        return 5

fi

fi

    if ./chklastlog -f ${WTMP} -l ${LASTLOG}

    if ${CHKLASTLOG} -f ${WTMP} -l ${LASTLOG}

    then

    then

      if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi

      if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi

fi

fi

wted () {

wted () {

    if [ ! -x ./chkwtmp ]; then

    if [ ! -x ${CHKWTMP} ]; then

      echo "not tested: can't exec ./chkwtmp"

      echo "not tested: can't exec ${CHKWTMP}"

      return ${NOT_TESTED}

      return ${NOT_TESTED}

fi

fi

   if [ "$SYSTEM" = "SunOS" ]; then

   if [ "$SYSTEM" = "SunOS" ]; then

       if [ ! -x ./check_wtmpx ]; then

       if [ ! -x ${CHECK_WTMPX} ]; then

          echo "not tested: can't exec ./check_wtmpx"

          echo "not tested: can't exec ${CHECK_WTMPX}"

       else

       else

          if [ "${EXPERT}" = "t" ]; then

          if [ "${EXPERT}" = "t" ]; then

             expertmode_output "./check_wtmpx"

             expertmode_output "${CHECK_WTMPX}"

              return 5

              return 5

fi

fi

          if ./check_wtmpx

          if ${CHECK_WTMPX}

             then

             then

             if [ "${QUIET}" != "t" ]; then \

             if [ "${QUIET}" != "t" ]; then \

                echo "nothing deleted in /var/adm/wtmpx"; fi

                echo "nothing deleted in /var/adm/wtmpx"; fi

Lines 187-198	Link Here

       WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"`

       WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"`

       if [ "${EXPERT}" = "t" ]; then

       if [ "${EXPERT}" = "t" ]; then

          expertmode_output "./chkwtmp -f ${WTMP}"

          expertmode_output "${CHKWTMP} -f ${WTMP}"

          return 5

          return 5

fi

fi

fi

fi

    if ./chkwtmp -f ${WTMP}

    if ${CHKWTMP} -f ${WTMP}

    then

    then

      if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi

      if [ "${QUIET}" != "t" ]; then echo "nothing deleted"; fi

fi

fi

Lines 231-237	Link Here

    prog=""

    prog=""

    if [ \( "${SYSTEM}" = "Linux"  -o \( "${SYSTEM}" = "FreeBSD" -a \

    if [ \( "${SYSTEM}" = "Linux"  -o \( "${SYSTEM}" = "FreeBSD" -a \

       ${V} -gt 43 \) \) -a "${ROOTDIR}" = "/" ]; then

       ${V} -gt 43 \) \) -a "${ROOTDIR}" = "/" ]; then

      [ ! -x ./chkproc ] && prog="./chkproc"

      [ ! -x ${CHKPROC} ] && prog="${CHKPROC}"

      [ ! -x ./chkdirs ] && prog="$prog ./chkdirs"

      [ ! -x ./chkdirs ] && prog="$prog ./chkdirs"

      if [ "$prog" != "" ]; then

      if [ "$prog" != "" ]; then

#        echo "not tested: can't exec $prog"

#        echo "not tested: can't exec $prog"

Lines 241-247	Link Here

      if [ "${EXPERT}" = "t" ]; then

      if [ "${EXPERT}" = "t" ]; then

         [ -r /proc/ksyms ] &&  ${egrep} -i "adore|sebek" < /proc/ksyms 2>/dev/null

         [ -r /proc/ksyms ] &&  ${egrep} -i "adore|sebek" < /proc/ksyms 2>/dev/null

         [ -d /proc/knark ] &&  ${ls} -la /proc/knark 2> /dev/null

         [ -d /proc/knark ] &&  ${ls} -la /proc/knark 2> /dev/null

          expertmode_output "./chkproc -v -v"

          expertmode_output "${CHKPROC} -v -v"

          return 5

          return 5

fi

fi

Lines 262-268	Link Here

         echo "Warning: Knark LKM installed"

         echo "Warning: Knark LKM installed"

fi

fi

      if ./chkproc

      if ${CHKPROC}

      then

      then

           if [ "${QUIET}" != "t" ]; then echo "nothing detected"; fi

           if [ "${QUIET}" != "t" ]; then echo "nothing detected"; fi

      else

      else

Lines 920-938	Link Here

    CMD=`loc chfn chfn $pth`

    CMD=`loc chfn chfn $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    case "${SYSTEM}" in

    case "${SYSTEM}" in

       Linux)

       Linux)

          if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

          if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

             >/dev/null 2>&1

             >/dev/null 2>&1

          then

          then

             STATUS=${INFECTED}

             STATUS=${INFECTED}

          fi;;

          fi;;

       FreeBSD)

       FreeBSD)

          if [ `${strings} -a ${CMD} | \

          if [ `${STRINGS} -a ${CMD} | \

                ${egrep} -c "${GENERIC_ROOTKIT_LABEL}"` -ne 2 ]

                ${egrep} -c "${GENERIC_ROOTKIT_LABEL}"` -ne 2 ]

          then

          then

             STATUS=${INFECTED}

             STATUS=${INFECTED}

Lines 947-962	Link Here

    REDHAT_PAM_LABEL="*NOT*"

    REDHAT_PAM_LABEL="*NOT*"

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    case "${SYSTEM}" in

    case "${SYSTEM}" in

       Linux)

       Linux)

          if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

          if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

          >/dev/null 2>&1

          >/dev/null 2>&1

             then

             then

             if ${strings} -a ${CMD} | ${egrep} "${REDHAT_PAM_LABEL}" \

             if ${STRINGS} -a ${CMD} | ${egrep} "${REDHAT_PAM_LABEL}" \

             >/dev/null 2>&1

             >/dev/null 2>&1

                then

                then

Lines 965-971	Link Here

fi

fi

          fi;;

          fi;;

       FreeBSD)

       FreeBSD)

          if [ `${strings} -a ${CMD} | ${egrep} -c "${GENERIC_ROOTKIT_LABEL}"` -ne 2 ]

          if [ `${STRINGS} -a ${CMD} | ${egrep} -c "${GENERIC_ROOTKIT_LABEL}"` -ne 2 ]

             then

             then

             STATUS=${INFECTED}

             STATUS=${INFECTED}

          fi;;

          fi;;

Lines 981-993	Link Here

    CMD=`loc login login $pth`

    CMD=`loc login login $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    GENERAL="^root$"

    GENERAL="^root$"

    TROJED_L_L="vejeta|xlogin|^@\(#\)klogin\.c|lets_log|sukasuka|/usr/lib/.ark?|SucKIT"

    TROJED_L_L="vejeta|xlogin|^@\(#\)klogin\.c|lets_log|sukasuka|/usr/lib/.ark?|SucKIT"

    ret=`${strings} -a ${CMD} | ${egrep} -c "${GENERAL}"`

    ret=`${STRINGS} -a ${CMD} | ${egrep} -c "${GENERAL}"`

    if [ ${ret} -gt 0 ]; then

    if [ ${ret} -gt 0 ]; then

        case ${ret} in

        case ${ret} in

        1) [ "${SYSTEM}" = "OpenBSD" -a ${V} -le 27 -o ${V} -ge 30 ] && \

        1) [ "${SYSTEM}" = "OpenBSD" -a ${V} -le 27 -o ${V} -ge 30 ] && \

Lines 998-1004	Link Here

        *) STATUS=${INFECTED};;

        *) STATUS=${INFECTED};;

        esac

        esac

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TROJED_L_L}" 2>&1 >/dev/null

    if ${STRINGS} -a ${CMD} | ${egrep} "${TROJED_L_L}" 2>&1 >/dev/null

       then

       then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1014-1027	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

       expertmode_output "${strings} -a ${CMD}"

       expertmode_output "${STRINGS} -a ${CMD}"

fi

fi

    if [ "${SYSTEM}" = "OpenBSD" -o "${SYSTEM}" = "SunOS" ]

    if [ "${SYSTEM}" = "OpenBSD" -o "${SYSTEM}" = "SunOS" ]

    then

    then

       return ${NOT_TESTED}

       return ${NOT_TESTED}

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}|/lib/security" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}|/lib/security" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1039-1049	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1062-1072	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${SYSLOG_I_L}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${SYSLOG_I_L}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1083-1093	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${HDPARM_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${HDPARM_INFECTED_LABEL}" \

       >/dev/null 2>&1

       >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1105-1115	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GPM_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${GPM_INFECTED_LABEL}" \

       >/dev/null 2>&1

       >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1127-1137	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${MINGETTY_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${MINGETTY_INFECTED_LABEL}" \

       >/dev/null 2>&1

       >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1149-1159	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${SENDMAIL_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${SENDMAIL_INFECTED_LABEL}" \

       >/dev/null 2>&1

       >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1167-1177	Link Here

    CMD=`loc ls ls $pth`

    CMD=`loc ls ls $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${LS_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${LS_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1184-1194	Link Here

    CMD=`loc du du $pth`

    CMD=`loc du du $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${DU_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${DU_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1208-1218	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${NAMED_I_L}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${NAMED_I_L}" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1226-1236	Link Here

    CMD=`loc netstat netstat $pth`

    CMD=`loc netstat netstat $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${NETSTAT_I_L}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${NETSTAT_I_L}" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1245-1255	Link Here

   CMD=`loc ps ps $pth`

   CMD=`loc ps ps $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${PS_I_L}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${PS_I_L}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1267-1277	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${PSTREE_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${PSTREE_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1289-1299	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1311-1321	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1333-1343	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1350-1367	Link Here

   if [ "${SYSTEM}" = "Linux" ]

   if [ "${SYSTEM}" = "Linux" ]

   then

   then

      if [ ! -x ./strings ]; then

      if [ ! -x ${STRINGS} ]; then

        printn "can't exec ./strings-static, "

        printn "can't exec ${STRINGS}-static, "

        return ${NOT_TESTED}

        return ${NOT_TESTED}

fi

fi

      if [ "${EXPERT}" = "t" ]; then

      if [ "${EXPERT}" = "t" ]; then

          expertmode_output "./strings -a ${CMD}"

          expertmode_output "${STRINGS} -a ${CMD}"

          return 5

          return 5

fi

fi

      ### strings must be a statically linked binary.

      ### strings must be a statically linked binary.

      if ./strings-static -a ${CMD} > /dev/null 2>&1

      if ${STRINGS}-static -a ${CMD} > /dev/null 2>&1

      then

      then

         STATUS=${INFECTED}

         STATUS=${INFECTED}

fi

fi

Lines 1376-1386	Link Here

   CMD=`loc basename basename $pth`

   CMD=`loc basename basename $pth`

   if [ "${EXPERT}" = "t" ]; then

   if [ "${EXPERT}" = "t" ]; then

       expertmode_output "${strings} -a ${CMD}"

       expertmode_output "${STRINGS} -a ${CMD}"

       expertmode_output "${ls} -l ${CMD}"

       expertmode_output "${ls} -l ${CMD}"

       return 5

       return 5

fi

fi

   if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

   if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

   then

   then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1396-1406	Link Here

    CMD=`loc dirname dirname $pth`

    CMD=`loc dirname dirname $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1421-1431	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1437-1448	Link Here

    CMD=`loc rpcinfo rpcinfo $pth`

    CMD=`loc rpcinfo rpcinfo $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1458-1469	Link Here

    CMD=`loc date date $pth`

    CMD=`loc date date $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1479-1490	Link Here

    CMD=`loc echo echo $pth`

    CMD=`loc echo echo $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1500-1511	Link Here

    CMD=`loc env env $pth`

    CMD=`loc env env $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1527-1537	Link Here

fi

fi

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1545-1555	Link Here

       return ${NOT_FOUND}

       return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1563-1573	Link Here

       return ${NOT_FOUND}

       return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1581-1591	Link Here

        return ${NOT_FOUND}

        return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1597-1608	Link Here

    CMD=`loc write write $pth`

    CMD=`loc write write $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" | grep -v locale > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" | grep -v locale > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1619-1629	Link Here

    W_INFECTED_LABEL="uname -a"

    W_INFECTED_LABEL="uname -a"

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${W_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${W_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1655-1661	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    STATUS=${INFECTED}

    STATUS=${INFECTED}

Lines 1673-1684	Link Here

    MAIL_INFECTED_LABEL="sh -i"

    MAIL_INFECTED_LABEL="sh -i"

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${MAIL_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${MAIL_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1698-1709	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GENERIC_ROOTKIT_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1720-1730	Link Here

    CMD=`loc egrep egrep $pth`

    CMD=`loc egrep egrep $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${EGREP_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${EGREP_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1737-1748	Link Here

    CMD=`loc grep grep $pth`

    CMD=`loc grep grep $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        expertmode_output "${ls} -l ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${GREP_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${GREP_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1764-1774	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${TOP_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1786-1795	Link Here

fi

fi

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${RLOGIN_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${RLOGIN_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1804-1813	Link Here

         return ${NOT_FOUND}

         return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${LSOF_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${LSOF_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1822-1831	Link Here

         return ${NOT_FOUND}

         return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${AMD_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${AMD_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1840-1849	Link Here

         return ${NOT_FOUND}

         return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${SLOGIN_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${SLOGIN_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1862-1871	Link Here

        return ${NOT_FOUND}

        return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${CRON_INFECTED_LABEL}" >/dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${CRON_INFECTED_LABEL}" >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

fi

fi

Lines 1877-1894	Link Here

    CMD="${ROOTDIR}sbin/ifconfig"

    CMD="${ROOTDIR}sbin/ifconfig"

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    IFCONFIG_NOT_INFECTED_LABEL="PROMISC"

    IFCONFIG_NOT_INFECTED_LABEL="PROMISC"

    IFCONFIG_INFECTED_LABEL="/dev/tux"

    IFCONFIG_INFECTED_LABEL="/dev/tux"

    if ${strings} -a ${CMD} | ${egrep} "${IFCONFIG_NOT_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${IFCONFIG_NOT_INFECTED_LABEL}" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${NOT_INFECTED}

       STATUS=${NOT_INFECTED}

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${IFCONFIG_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${IFCONFIG_INFECTED_LABEL}" \

    >/dev/null 2>&1

    >/dev/null 2>&1

    then

    then

       STATUS=${INFECTED}

       STATUS=${INFECTED}

Lines 1908-1919	Link Here

       return ${NOT_FOUND}

       return ${NOT_FOUND}

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    RSHD_INFECTED_LABEL="HISTFILE"

    RSHD_INFECTED_LABEL="HISTFILE"

    if ${strings} -a ${CMD} | ${egrep} "${RSHD_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${RSHD_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

        if ${egrep} "^#.*rshd" ${ROOTDIR}etc/inetd.conf >/dev/null 2>&1 -o \

        if ${egrep} "^#.*rshd" ${ROOTDIR}etc/inetd.conf >/dev/null 2>&1 -o \

Lines 1949-1959	Link Here

    CMD=${ROOTDIR}${CMD}

    CMD=${ROOTDIR}${CMD}

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TCPD_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${TCPD_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 1970-1980	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${SSHD2_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${SSHD2_INFECTED_LABEL}" \

       > /dev/null 2>&1

       > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

Lines 1991-2001	Link Here

    CMD=`loc su su $pth`

    CMD=`loc su su $pth`

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${SU_INFECTED_LABEL}" > /dev/null 2>&1

    if ${STRINGS} -a ${CMD} | ${egrep} "${SU_INFECTED_LABEL}" > /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

fi

fi

Lines 2015-2025	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${FINGER_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${FINGER_INFECTED_LABEL}" \

> /dev/null 2>&1

> /dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

Lines 2067-2077	Link Here

fi

fi

    if [ "${EXPERT}" = "t" ]; then

    if [ "${EXPERT}" = "t" ]; then

        expertmode_output "${strings} -a ${CMD}"

        expertmode_output "${STRINGS} -a ${CMD}"

        return 5

        return 5

fi

fi

    if ${strings} -a ${CMD} | ${egrep} "${TELNETD_INFECTED_LABEL}" \

    if ${STRINGS} -a ${CMD} | ${egrep} "${TELNETD_INFECTED_LABEL}" \

       >/dev/null 2>&1

       >/dev/null 2>&1

    then

    then

        STATUS=${INFECTED}

        STATUS=${INFECTED}

Attachment #8302: new patch file for bug #15743