ethtool trojan detected by NAI

Thu Jan 15 17:11:16 UTC 2004

Hello David,

> I have ethtool-1.6-2 from RedHat's Fedora repository, and it scans clean 
> with f-prot.  Without going to fedora.us repository to compare, I would 
> say it must be different, as this rpm goes into /usr/sbin/ethtool, not 
> /sbin/ethtool.

Curious. My Fedora Core 1 contains ethtool-1.8-2.1 and the binary is
located at /sbin/ethtool.

Jason, the md5sum of my binary is:

$ md5sum /sbin/ethtool
5bd89f94417a5daae91538b418d442d6  /sbin/ethtool

Bye,
Leonard.