Questions tagged [chkrootkit]
The chkrootkit tag has no usage guidance.
25
questions
0
votes
1
answer
124
views
Searching for rootkits with chkrootkit return unexpected results
I ran the rootkit program after his suggestion and noticed something on 1 line that said
Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed /tmp/...
0
votes
0
answers
51
views
libkeyutils.so.1.8.1
I have noticed something I dont understand.
I have many servers hosted as VPS with Racknerd.
All my servers is installed with ubuntu 20.04.05 or 20.04.06.
All the servers installed before summer, have ...
0
votes
1
answer
67
views
Help in interpreting chkrootkit analysis for MS Teams package
I run from time to time a chkrootkit to make sure my install does not get infected. Today I ran it while MS team was on (I need to use it for my classes).
Here is what I found:
Checking `chkutmp'...
...
1
vote
2
answers
1k
views
chkrootkit reports possible malicious Linux.Xor.DDoS installed - how do I verify?
The files of concern it reports are below.
I'm not worried about the ones in /tmp/yarn* as I believe that's the package manager for NodeJS but the ones in tmp/_MEI* are concerning.
The other issue it ...
1
vote
1
answer
561
views
CentOS 7 Malware? - User "impress+" executes a command ("cron") with a high CPU consumption
One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption.
I worry because I ...
15
votes
3
answers
23k
views
Invalid WEB_CMD configuration option: Relative pathname: "/bin/false"
I am on Ubuntu, I am trying to install rkhunter.
I've tried
apt-get install rkhunter
success
But then, I did
rkhunter --update
I kept getting
Invalid WEB_CMD configuration option: ...
1
vote
0
answers
160
views
What process is accessing this laptops webcam? Is it a rootkit?
Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install.
Sure ...
-1
votes
1
answer
228
views
Mint 19 tcpd INFECTED sha1sum
When I use rkhunter it always shows two warnings and possible 4 rootkit information:
Checking for suspicious (large) shared memory segments [ Warning ]
Checking for hidden files and directories ...
1
vote
0
answers
1k
views
What is "invalid argument" by a rootkit check?
I thought I should run a rootkit in connection to the recent Debian apt vulnerability, which I think I have fixed though. I used chkrootkit and get these two lines, which I'm not sure what to do with:
...
1
vote
1
answer
2k
views
How to treat supposed chkrootkit false positive
I installed chkrootkit with apt-install in a freshly installed Ubuntu server 16.04.3.
chkrootkit found suspicious files and directories after first run:
Searching for suspicious files and dirs, it ...
0
votes
2
answers
526
views
Better latest version or the package for rkhunter and chkrootkit?
The rkhunter version of the ubuntu package is currently 1.4.0, while the installer is version 1.4.4
The repo version of chkrootkit is 0.49, while its installer is 0.52
Since security is a major ...
0
votes
3
answers
3k
views
Can I remove "Linux/Ebury Operation Windigo" without wiping the entire drive?
I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...
0
votes
6
answers
4k
views
Linux Mint: I'm infected with a rootkit
I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
0
votes
1
answer
449
views
chkrootkit unable to execute by shell
I installed chkrootkit with yum (CentOS 6.5) server with plesk 12.5
but I'm unable to execute it.
[root@~]# chkrootkit
-bash: chkrootkit: command not found
[root@~]#
I cannot locate the application, ...
4
votes
0
answers
5k
views
The "chkproc: Warning: Possible LKM Trojan installed" appears and disappears
I have chkrootkit version 0.49 installed on Debian 6.5.
When I run sudo chkrootkit, I keep getting variable warnings about the LKM trojan, when I run the command repeatedly.
First run
Checking `lkm'...
1
vote
1
answer
555
views
chkrootkit checking sniffer's log takes ages
On my server chkrootkit hangs on
Searching for sniffer's logs, it may take a while...
After half an hour, I stopped this, so how can I find out what chkrootkit is trying to achieve in this step?
...
2
votes
1
answer
4k
views
Chkrootkit found a lot of suspicious files and directories, and /sbin/init INFECTED
I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives?
Do I have a compromised system?
Here are the suspect files and ...
3
votes
2
answers
4k
views
rkhunter /usr/bin/ssh && /usr/sbin/sshd [Warning]
My last rkhunter scan reported a couple of warnings that deserve to be checked. Main reason for my suspect is that I wasn't on the machine at (03-Apr-2014 01:12:12) ->AM
I googled for understand what'...
2
votes
1
answer
750
views
Verifying Debian/Ubuntu packages integrity when booting from a read-only DVD?
Is there an easy way to boot a Debian-based Linux system from a read-only medium (say a Live Linux read-only DVD) and then use Debian's .deb checksums / signatures (?) to verify that the files ...
1
vote
1
answer
2k
views
I need find 1 simple rootkit to test chkrootkit in centos?
I want to find 1 simple rootkit to test chkrootkit (a tool used to detect rootkit). Please recommend to me 1 rootkit and show me how to set it up or install it.
16
votes
2
answers
13k
views
rkhunter warns me about root.rules
I run :
:~$ sudo rkhunter --checkall --report-warnings-only
One of the warnings I've got :
Warning: Suspicious file types found in /dev:
/dev/.udev/rules.d/root.rules: ASCII text
and ...
0
votes
3
answers
847
views
chkrootkit throws Signal 13 when searching through /var/tmp
On my debian squeeze server in the chkrootkit log I get loads of these errors:
/usr/bin/find: Prozeß "head" wurde durch das Signal 13 abgebrochen.
/usr/bin/find: Prozeß "head" wurde durch das Signal ...
3
votes
2
answers
1k
views
Chkrootkit warning about infected port 600
I run the Tiger Automatic Auditor on my Debian Linux system, and recently got emailed the following:
# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
OLD: --ALERT-- [...
1
vote
1
answer
2k
views
How to install a shared library in Linux
As part of my research work I have to study a rootkit. So I downloaded ncom rootkit and tried installing. It didn't have any installation files.
3
votes
2
answers
1k
views
Cannot understand chkrootkit's result
I couldn't understand the output of chkrootkit command:
$ chkrootkit -q -r /
/usr/lib/.libssl.so.10.hmac
/usr/lib/.libfipscheck.so.1.hmac
/usr/lib/firefox-3.6/.autoreg
/usr/lib/.libfipscheck.so.1.1.0....