# rkhunter suspicious file types found

## kernelOfTruth

Hi guys,

haven't used rkhunter for a very long time on my system (this install is basically ported over [stage4] from my old Core i7 computer -> now a Xeon Haswell) and the following really caught my eye:

 *Quote:*   

> rkhunter -c --report-warnings-only
> 
> Warning: The command '/bin/egrep' has been replaced by a script: /bin/egrep: POSIX shell script, ASCII text executable
> 
> Warning: The command '/bin/fgrep' has been replaced by a script: /bin/fgrep: POSIX shell script, ASCII text executable
> ...

 

what does pulseaudio do with a .dbf file ?

I don't even have dev-db/xbase installed   :Confused: 

edit:

this also seems to occur on Manjaro,

that's the only other occurence I found on the web so far:

http://pastebin.com/3u25YTyZ

edit2:

I'm using tomboy notes again since switching to app-misc/gnote was awfully slow with the number of notes I'm working with

is tomboy notes or mono known to use these type of databases ?

if yes - why is it interfering or sharing this with pulseaudio ?

----------

## eccerr0r

Quite possibly it's just luck of the draw that pulseaudo /dev/shm shared memory files look like a corrupt dbase file, mine looks like that as well, using the sys-apps/file's magic.

----------

## kernelOfTruth

Thanks, eccerr0r !

It only seems to appear occasionally - been running with/without tomboy several times and it didn't show

maybe it only is there when music is playing (plus/minus flash) - will further observe this ...

edit:

didn't appear this time with chromium & adobe-flash (chrome-binary-plugins)

----------

