<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 11/20/2012 04:53 PM, Scott Plante
wrote:<br>
</div>
<blockquote
cite="mid:1186731569.2866.1353448423195.JavaMail.root@insightsys.com"
type="cite">
<style type="text/css">p { margin: 0; }</style>
<div style="font-family: arial,helvetica,sans-serif; font-size:
12pt; color: #000000">Well, for one thing, it adds a line to
/etc/rc.local. So you could take a look at that and see if
there's anything out of place.<br>
Scott<br>
<hr id="zwchr">
<div
style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;">Jay
Lozier asked:<br>
<br>
<div class="moz-cite-prefix"><span style="font-size: 12pt; ">Quick
question - how does determine if the rootkit is running? </span></div>
</div>
</div>
<br>
</blockquote>
Looking at /etc/rc.local the only executable line is exit 0 and the
comments state the by default it does nothing.<br>
<pre class="moz-signature" cols="72">--
Jay Lozier
<a class="moz-txt-link-abbreviated" href="mailto:jslozier@gmail.com">jslozier@gmail.com</a></pre>
</body>
</html>