Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer

eth0: PACKET SNIFFER(/sbin/dhclient[3966])

How can I remove this?

share|improve this question
    
How did you check for rootkits? –  Mitch May 31 '12 at 10:13
1  
sudo chkrootkit –  Wes May 31 '12 at 10:15

2 Answers 2

up vote 3 down vote accepted

I think it might be a false positive. Try checking with rkhunter, because it gives fewer false positives. To download rkhunter, and for more detailed info on how to use it, See this site

If it come up clean, then you have reason for concern.

Try this as well:

  1. rkhunter --check

  2. update

  3. sudo rkhunter --propupd

  4. rkhunter --check

Source: The Rootkit Hunter project

share|improve this answer
    
Checked with the rkhunter -c command and had one warning: /usr/bin/unhide.rb [ Warning ] –  Wes May 31 '12 at 10:40
    
Checking for passwd file changes [ Warning ] Checking for group file changes [ Warning ] Checking for hidden files and directories [ Warning ] –  Wes May 31 '12 at 10:54
    
Mitch: Did all things listed above. Found one file that is replaced by a script and is not whitelisted Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb: Ruby script, ASCII Should I worry? Thanks for all you time, Wes –  Wes May 31 '12 at 11:46
    
rkhunter is informing you the unhide.rb executable located in /usr/bin/ is a ruby script. It is perfectly normal in that case and you can white-list it in rkhunter.conf –  Mitch May 31 '12 at 11:49
    
Well, the unide thing is different. - bugs.debian.org/cgi-bin/bugreport.cgi?bug=607224 –  jrg May 31 '12 at 11:57

Dhclient is the standard " Dynamic Host Configuration Protocol Client" for Ubuntu that is needed for when you have not a fixed IP but still want to be reachable from the Internet.

In case you are worried you should check your dhclient.conf for unwanted entries.

share|improve this answer
    
Checked the dhclient.conf file. Nothing is added. –  Wes May 31 '12 at 11:48
    
@Wes use apt-get download isc-dhcp-client to download a fresh deb, extract the package and replace your existing /sbin/dhclient with the newly downloaded one and it should fix the issue. see here askubuntu.com/questions/258658/… –  mchid Aug 9 at 20:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.