My system is an up-to-date Ubuntu 13.10
I've installed Tiger and I'm getting this
# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
OLD: --ALERT-- [rootkit005a] Chkrootkit has found a file which seems to be infected because of a rootkit
OLD: --ALERT-- [rootkit009a] A rootkit seems to be installed in the system
OLD: INFECTED (PORTS: 60001)
What?!
I've also tried rkhunter: doesn't really find anything directly, here's the assorted warnings
/usr/bin/unhide.rb [ Warning ]
Checking for passwd file changes [ Warning ]
Checking for group file changes [ Warning ]
Checking /dev for suspicious file types [ Warning ]
Checking for hidden files and directories [ Warning ]
There's also the suckit thing (described in another thread here http://ubuntuforums.org/showthread.php?t=1680428), but that's been ruled out as a bug.
Looking at
netstat -ltnp
There's nothing on this port there, well not now anyway.
How do I verify this? How do I go about it??