(responding to sixpack13's first post)
netstat -taupen | grep 60922
-bash.1[~]: netstat -taupen | grep
where the "rootkit"
- connects to,
- what it does,
- if it survives a reboot,
- what google says about zaRwT.KiT,
I used 3 different search engines (including
google), a few different
searches, and waded through many pages of hits. No information about
the rootkit itself. Many hits (including this thread!) of people asking
about the rkhunter warning. Seems that maybe firefox just happened to
be launched at the same time rkhunter was checking port 60922,
suggesting a false alarm. No clue as to what zaRwT.KiT is, what is
does, or what it connects to. No hint of it after rebooting.
- what "rpm -Vv firefox" says
Too long to put here, but I saw nothing that looked suspicious.
- if it happens after an "sudo dnf reinstall firefox"
No warnings from rkhunter.