Questions related to the rootkit-detection system `rkhunter`

learn more… | top users | synonyms

1
vote
0answers
13 views

Rkhunter warnings and explanation

I'm new to ubuntu 14.04 and still learning via some books. Meanwhile I installed rkhunter from sourceforge link and ran an update and it showed multiple warnings. I did rkhunter update and propupdate ...
0
votes
0answers
13 views

How to set rkhunter to auto update in ubuntu

I need to know how to configure rkhunter to install the latest verisons and definitions and also a documentations.
0
votes
1answer
81 views

How to install rkhunter in ubuntu?

Ok I know the question sounds strange but I need help installing rkhunter the accurate way and do I need to follow all the steps in this article https://help.ubuntu.com/community/RKhunter?
0
votes
1answer
24 views

rkhunter warning /dev files

I recently installed rkhunter and it gave me two warnings for /dev files is there any way to find a list of normal files in /dev?. I only ask because I ran wireshark and found several ip address ...
0
votes
0answers
38 views

Is there any conflicts between running rkhunter and chkrootkit on one system?

Can I run rkhunter and chkrootkit at the same time on my Ubuntu Linux laptop without having to worry about conflicts?
0
votes
0answers
43 views

How to test rkhunter to make sure its functioning well?

I have a Ubuntu 15.10 Linux laptop PC with rkhunter installed now all I need to do is to confirm it working well like if there is an antivirus on your pc you will go to the eicar site and download the ...
3
votes
1answer
232 views

If I have clamav do I need to install rootkit hunter

So I have clamav the antivirus but is that a protection against rootkits or do I need to install rootkit hunter as well with clamav?
0
votes
1answer
77 views

Is my computer secure?

I was using Rkhunter and this was displayed. [ Rootkit Hunter version 1.4.2 ] File updated: searched for 175 files, found 141 baymax@vostro:~$ sudo rkhunter -c --enable all --disable none --rwo ...
1
vote
0answers
15 views

How to upgrade rkhunter from source files? [duplicate]

Due to the fact that the maintainers of rkhunter don't want to backport important security updates in for some reason, I will need to upgrade it myself. So I need to upgrade it to this version, but as ...
2
votes
1answer
127 views

“[: Binary: unexpected operator” message when updating rkhunter definitions on 15.10

After upgrading to Ubuntu GNOME 15.10 from 15.04 I have noticed that upon running the command: sudo rkhunter --update That I get this output: [ Rootkit Hunter version 1.4.2 ] Checking rkhunter ...
1
vote
1answer
246 views

rkhunter scan results

Im new to Ubuntu and im looking for some help. I've scanned my Ubuntu with rkhunter and I have some concerning results: Warning: The following processes are using deleted files: Process: /sbin/init ...
0
votes
0answers
32 views

rkhunter and apt-get

Every time I run an apt-get command, it ends with the following two lines: [ Rootkit Hunter version 1.4.2 ] File updated: searched for 173 files, found 140 I don't see anything in the rkhunter ...
0
votes
1answer
733 views

RKhunter and Chkrootkit

Running rkhunter showed the following error message-"Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request". A quick search showed that I could get away with it by ...
3
votes
1answer
1k views

Unable to update rkhunter

Today when I ran the command (which I run every day and all is well): sudo rkhunter --update In order to check for updates to database files I got this error every time: [ Rootkit Hunter version ...
1
vote
1answer
250 views

Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.

Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor. I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
2
votes
1answer
164 views

How to enable unhide in rkhunter

I have installed rkhunter with: sudo apt-get install rkhunter And even though I have enabled all test, when I run: sudo rkhunter --check --sk If I check in the log file, I see this about the ...
2
votes
1answer
127 views

Why rkhunter skips empty and missing log file scans?

I have noticed that when scanning my machine with: sudo rkhunter --checkall --sk That part of the output in the log file is: [21:50:51] Checking for missing log files [ Skipped ...
0
votes
2answers
300 views

How to get rkhunter to skip “[Press <ENTER> to continue]”

Every time that I scan my machine with rkhunter using the following command: sudo rkhunter --checkall After it has finished with a certain type of check it asks me: [Press <ENTER> to ...
1
vote
1answer
37 views

Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?

I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?: ...
0
votes
1answer
29 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
1k views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
1
vote
0answers
65 views

How to manually update RKHUNTER with newly found rootkits?

How to manually update RKHUNTER with newly found rootkits? For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit. How to manually update it's database. Simple rkhunter ...
2
votes
1answer
1k views

rkhunter checking for hidden ports skipped

I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command: sudo rkhunter --checkall I get this output about half way through: Performing ...
3
votes
1answer
3k views

How to upgrade rkhunter

When running the command: sudo rkhunter --versioncheck I get the following output: [ Rootkit Hunter version 1.4.0 ] Checking rkhunter version... This version : 1.4.0 Latest version: 1.4.2 ...
0
votes
1answer
284 views

Rootkit detector: rkhunter auto database update options

In the rkhunter config file here /etc/default/rkhunter it says: # Defaults for rkhunter automatic tasks # sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter # # This is a POSIX shell ...
2
votes
1answer
681 views

Help, I May Have a Rootkit

It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a ...
0
votes
3answers
576 views

Run rkhunter regularely on a desktop system

I want to get a warning on my desktop when rkhunter finds something odd on my system. I whitelisted some files and dirs that seem ok in /etc/rkhunter.conf so I get no warnings anymore. Now I want to ...
1
vote
1answer
187 views

Should I be worried about these scan results form rkhunter?

Should I be worried about these scan results form rkhunter? [22:09:40] Info: Starting test name 'passwd_changes' [22:09:40] Checking for passwd file changes [ Warning ] [22:09:40] ...
3
votes
1answer
1k views

Found a hidden port . . . what now?

I ran rkhunter and found an open hidden port. How do I close a port that is not listed with the netstat or fuser command? It is hidden from these which is why it was flagged. Aside from blocking the ...
0
votes
2answers
254 views

rkhunter sends no email

rkhunter sends no email I installed rkhunter on a Ubuntu 12.04.3 server sudo apt-get install rkhunter it installed the 1.3.8 version of rkhunter sudo apt-show-versions rkhunter rkhunter/precise ...
8
votes
5answers
17k views

cron.daily jobs not running

I created 3 daily cron jobs to run. Below are the three that are placed in etc/cron.daily rkhunter.sh #!/bin/sh ( rkhunter --versioncheck rkhunter --update rkhunter --cronjob --report-warnings-only ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
8
votes
2answers
4k views

rkhunter: right way to handle warnings further?

I googled some and checked out two first links it found: http://www.skullbox.net/rkhunter.php http://www.techerator.com/2011/07/how-to-detect-rootkits-in-linux-with-rkhunter/ They don't mention ...
1
vote
2answers
203 views

.passw hidden files in /etc

Rkhunter reported me that it found hidden files in /etc: Warning: Hidden file found: /etc/.group.48239632746: ASCII text Warning: Hidden file found: /etc/.passwd.13046384800: ASCII text Warning: ...
5
votes
1answer
1k views

Whitelisting ports for detection in rkhunter

I'm trying to figure out in the rkhunter config how I can whitelist the detection of certain ports, such as ports used for IRCds, and other ports which I have for services which run on non-standard ...
11
votes
1answer
12k views

rkhunter warning about /etc/.java /etc/.udev /etc/.initramfs

I am running Ubuntu 10.04.1 LTS . I am running rkhunter to check for rootkits. rkhunter is complaining about the following hidden files and directories. I think these files are not a real problem on ...