I recently ran
chkrootkit and got the following line:
Searching for Suckit rootkit... Warning: /sbin/init INFECTED
What does this mean exactly? I heard this was a false positive, what is exactly happening.
Please and thank you.
It's likely this is a false positive since there's a bug in chkrootkit (supposedly fixed in a later version 0.50-3ubuntu1). Apparently chkrootkit doesn't perform a rigorous enough check.
Additionally you could try rkhunter which is similar to chkrootkit.
Some more information: Fortunately, running file `which chkrootkit` shows us that chkrootkit is just a shell script so we can inspect it directly.
The key line is:
Since recent versions of Ubuntu, running that command does produce some output (need to run as root or sudo) :
However, this is not an infection by a rootkit. I have also looked at the rkhunter code, and the checks are far more rigorous (testing for all sorts of additional files installed by the rootkit).
I have changed lines 1003,1004 in chkrootkit file not to check perform the check of /proc/1/maps (remember to take a copy first)
On Kubuntu 13.04 as of 2013-07-31
Produces NO output.
Note: Removing the period produces output (changing "init." to "init")
So it appears to me that the part checking HOME is the problem.
If one can make the assumption that rkhunter has a valid check, then perhaps the easy route is just to remove this section from chkrootkit and run both rkhunter and chkrootkit?