Questions tagged [chkrootkit]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-2
votes
0answers
40 views

How to discover a virus or rootkit on Ubuntu machine [closed]

I have been connected to free/public xfinitywifi and my Ubuntu machine has slowed down a lot. I am not sure if it's an update or if I got a virus. Using top and htop, the processes look normal, ...
1
vote
1answer
83 views

CentOS 7 Malware? - User “impress+” executes a command (“cron”) with a high CPU consumption

One of my "CentOS 7" servers is showing very strange behavior. A user named "impress+" executes a command called "cron". This "cron" command is executed with a high CPU consumption. I worry because I ...
0
votes
1answer
228 views

nvalid WEB_CMD configuration option: Relative pathname: “/bin/false”

I am on Ubuntu, I am trying to install rkhunter. I've tried apt-get install rkhunter success But then, I did rkhunter --update I kept getting Invalid WEB_CMD configuration option: ...
1
vote
0answers
69 views

What process is accessing this laptops webcam? Is it a rootkit?

Old laptop, running minecraft for the kids. Noticed the webcam light blinking for half a second randomly. Assumed it was a minecraft mod, nuked everything off and did a fresh Ubuntu install. Sure ...
-1
votes
1answer
157 views

Mint 19 tcpd INFECTED sha1sum

When I use rkhunter it always shows two warnings and possible 4 rootkit information: Checking for suspicious (large) shared memory segments [ Warning ] Checking for hidden files and directories ...
0
votes
0answers
341 views

What is “invalid argument” by a rootkit check?

I thought I should run a rootkit in connection to the recent Debian apt vulnerability, which I think I have fixed though. I used chkrootkit and get these two lines, which I'm not sure what to do with: ...
0
votes
1answer
845 views

How to treat supposed chkrootkit false positive

I installed chkrootkit with apt-install in a freshly installed Ubuntu server 16.04.3. chkrootkit found suspicious files and directories after first run: Searching for suspicious files and dirs, it ...
0
votes
2answers
393 views

Better latest version or the package for rkhunter and chkrootkit?

The rkhunter version of the ubuntu package is currently 1.4.0, while the installer is version 1.4.4 The repo version of chkrootkit is 0.49, while its installer is 0.52 Since security is a major ...
0
votes
2answers
2k views

Can I remove “Linux/Ebury Operation Windigo” without wiping the entire drive?

I used chkrootkit, which told me that I had "Linux/Ebury Operation Windigo" installed, I doubled checked by running ssh -G which printed out usage, without "illegal option". I removed all ssh files ...
0
votes
6answers
3k views

Linux Mint: I'm infected with a rootkit

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit ...
0
votes
1answer
263 views

chkrootkit unable to execute by shell

I installed chkrootkit with yum (centos 6.5) sever with plesk 12.5 but I'm unable to execute it. [root@~]# chkrootkit -bash: chkrootkit: command not found [root@~]# I cannot locate the application ...
2
votes
0answers
3k views

The “chkproc: Warning: Possible LKM Trojan installed” appears and disappears

I have chkrootkit version 0.49 installed on Debian 6.5. When I run sudo chkrootkit, I keep getting variable warnings about the LKM trojan, when I run the command repeatedly. First run Checking `lkm'...
1
vote
1answer
365 views

chkrootkit checking sniffer's log takes ages

On my server chkrootkit hangs on Searching for sniffer's logs, it may take a while... After half an hour, I stopped this, so how can I find out what chkrootkit is trying to achieve in this step? ...
2
votes
1answer
2k views

Chkrootkit found a lot of suspicious files and directories, and /sbin/init INFECTED

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and ...
3
votes
2answers
2k views

rkhunter /usr/bin/ssh && /usr/sbin/sshd [Warning]

My last rkhunter scan reported a couple of warnings that deserve to be checked. Main reason for my suspect is that I wasn't on the machine at (03-Apr-2014 01:12:12) ->AM I googled for understand what'...
2
votes
1answer
605 views

Verifying Debian/Ubuntu packages integrity when booting from a read-only DVD?

Is there an easy way to boot a Debian-based Linux system from a read-only medium (say a Live Linux read-only DVD) and then use Debian's .deb checksums / signatures (?) to verify that the files ...
2
votes
1answer
2k views

I need find 1 simple rootkit to test chkrootkit in centos?

I want to find 1 simple rootkit to test chkrootkit (a tool used to detect rootkit). Please recommend to me 1 rootkit and show me how to set it up or install it.
15
votes
2answers
12k views

rkhunter warns me about root.rules

I run : :~$ sudo rkhunter --checkall --report-warnings-only One of the warnings I've got : Warning: Suspicious file types found in /dev: /dev/.udev/rules.d/root.rules: ASCII text and ...
0
votes
3answers
774 views

chkrootkit throws Signal 13 when searching through /var/tmp

On my debian squeeze server in the chkrootkit log I get loads of these errors: /usr/bin/find: Prozeß "head" wurde durch das Signal 13 abgebrochen. /usr/bin/find: Prozeß "head" wurde durch das Signal ...
4
votes
2answers
929 views

Chkrootkit warning about infected port 600

I run the Tiger Automatic Auditor on my Debian Linux system, and recently got emailed the following: # Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... OLD: --ALERT-- [...
2
votes
1answer
2k views

How to install a shared library in Linux

As part of my research work I have to study a rootkit. So I downloaded ncom rootkit and tried installing. It didn't have any installation files.
2
votes
2answers
925 views

Cannot understand chkrootkit's result

I couldn't understand the output of chkrootkit command: $ chkrootkit -q -r / /usr/lib/.libssl.so.10.hmac /usr/lib/.libfipscheck.so.1.hmac /usr/lib/firefox-3.6/.autoreg /usr/lib/.libfipscheck.so.1.1.0....