--- chkrootkit~ 2010-03-18 16:56:19.000000000 -0500 +++ chkrootkit 2010-03-18 16:57:56.887321601 -0500 @@ -1126,25 +1126,6 @@ fi ### - ### Suspect PHP files - ### - if [ "${QUIET}" != "t" ]; then - printn "Searching for suspect PHP files... "; fi - files="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -name '*.php' 2> /dev/null`" -if [ `echo abc | head -n 1` = "abc" ]; then - fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -n 1 {} \; | $egrep '#!.*php' 2> /dev/null`" -else - fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -1 {} \; | grep '#!.*php' 2> /dev/null`" -fi - if [ "${files}" = "" -a "${fileshead}" = "" ]; then - if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi - else - echo - echo "${files}" - echo "${fileshead}" - fi - - ### ### shell history anomalies ### if [ "${QUIET}" != "t" ]; then \