Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

0
votes
0answers
5 views

How to manually update RKHUNTER with newly found rootkits?

How to manually update RKHUNTER with newly found rootkits? For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit. How to manually update it's database. Simple rkhunter ...
2
votes
1answer
32 views

rkhunter checking for hidden ports skipped

I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command: sudo rkhunter --checkall I get this output about half way through: Performing ...
2
votes
1answer
23 views

How to upgrade rkhunter

When running the command: sudo rkhunter --versioncheck I get the following output: [ Rootkit Hunter version 1.4.0 ] Checking rkhunter version... This version : 1.4.0 Latest version: 1.4.2 ...
0
votes
1answer
38 views

Rootkit detector: rkhunter auto database update options

In the rkhunter config file here /etc/default/rkhunter it says: # Defaults for rkhunter automatic tasks # sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter # # This is a POSIX shell ...
2
votes
1answer
111 views

Help, I May Have a Rootkit

It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a ...
0
votes
3answers
188 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
0
votes
0answers
40 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
201 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
1
vote
1answer
69 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
488 views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
154 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
5
votes
5answers
9k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
2k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
188 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
4
votes
1answer
801 views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
8
votes
1answer
10k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...