[Users] rkhunter with claws

[Paul]

On Fri, 15 Mar 2019 18:38:18 +0100
cavelier <jean-jacques.cavelier2 at wanadoo.fr> wrote: 

> Watch what rkhunter said to me about claws.
> Network TCP port 60922 is being used by /usr/local/bin/claws-mail.
> Possible rootkit: zaRwT.KiT
> True???

Not normal, true or not. Where did you get your version of claws-mail? Did you
build it yourself? Is your /usr/local/bin/claws-mail actually some other
programme, masquerading as claws-mail?

Here rhunter reports:

zaRwT.KiT Rootkit          [ Not found ]


with regards

Paul