On Thursday, May 29, 2008 10:42 am Gustavo De Nardin (spuk) wrote:
> IIRC maybe (I think I've seen something similar in the past) it is a 'mail'
> issue. Can you check the difference between this last report and previous,
> and/or if there are new non-ascii chars in it?

That looks like it. chkrootkit picked up a suspicious php file full of
non-ASCII characters. It's gone now and both chkrootkit nor rkhunter report
no problems.

Thanks,
Arn