After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer
eth0: PACKET SNIFFER(/sbin/dhclient)
How can I remove this?
I think it might be a false positive. Try checking with rkhunter, because it gives fewer false positives. To download rkhunter, and for more detailed info on how to use it, See this site
If it come up clean, then you have reason for concern.
Try this as well:
Source: The Rootkit Hunter project
Dhclient is the standard " Dynamic Host Configuration Protocol Client" for Ubuntu that is needed for when you have not a fixed IP but still want to be reachable from the Internet.
In case you are worried you should check your dhclient.conf for unwanted entries.
However, the workaround for the false positive doesn't work. This is because on Debian, the binaries from these packages used to end with a version number, e.g.
To fix this issue, make a backup copy of
Be careful to leave the backslash at the end of the line.