Questions about rootkits. What are signs that you got one? How to confirm or disprove the suspicion. Tools for the detection of rootkits.

learn more… | top users | synonyms

0
votes
0answers
13 views

How to set rkhunter to auto update in ubuntu

I need to know how to configure rkhunter to install the latest verisons and definitions and also a documentations.
0
votes
0answers
16 views

How to remove Operation Windigo installetd [duplicate]

i runned an chkrootkit and that found Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd how i can remove that rootkit?
0
votes
1answer
189 views

How to install rkhunter in ubuntu?

Ok I know the question sounds strange but I need help installing rkhunter the accurate way and do I need to follow all the steps in this article https://help.ubuntu.com/community/RKhunter?
0
votes
0answers
43 views

Is there any conflicts between running rkhunter and chkrootkit on one system?

Can I run rkhunter and chkrootkit at the same time on my Ubuntu Linux laptop without having to worry about conflicts?
0
votes
0answers
49 views

How to test rkhunter to make sure its functioning well?

I have a Ubuntu 15.10 Linux laptop PC with rkhunter installed now all I need to do is to confirm it working well like if there is an antivirus on your pc you will go to the eicar site and download the ...
3
votes
1answer
323 views

If I have clamav do I need to install rootkit hunter

So I have clamav the antivirus but is that a protection against rootkits or do I need to install rootkit hunter as well with clamav?
0
votes
1answer
160 views

ps does not work after upgrading to 14.04 (/usr/bin/dpkgd/ps: error while loading shared libraries)

I recently upgraded from Ubuntu 12.04 to 14.04, now on starting my terminal and running ps throws the following error : /usr/bin/dpkgd/ps: error while loading shared libraries: libproc-3.2.8.so: ...
4
votes
1answer
1k views

Chkrootkit says “Searching for Linux/Ebury - Operation Windigo ssh… Possible Linux/Ebury - Operation Windigo installetd”, should I be worried?

I recently ran sudo chkrootkit and this was one of the results: Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd In my research on ...
0
votes
1answer
109 views

Is my computer secure?

I was using Rkhunter and this was displayed. [ Rootkit Hunter version 1.4.2 ] File updated: searched for 175 files, found 141 baymax@vostro:~$ sudo rkhunter -c --enable all --disable none --rwo ...
1
vote
2answers
116 views

Detecting rootkit without another computer

If a rootkit has been installed without my knowledge to remotely control the computer then I guess the Update manager should be affected too right, then the kernel updates etc... could be infected ...
0
votes
0answers
41 views

Are there block-level root kit scanners?

Let's assume I have a drive image of a machine that may or may not have been compromised. I'd like to scan this drive image from another machine that is trusted. The "most obvious" way to do this ...
-2
votes
1answer
84 views

I broke my Ubuntu 14.04 [closed]

For a college Security project, I had to write a rootkit module from my Ubuntu 14.04. The rootkit was not supposed to harm the kernel, just hide processes and ports. However after running the module ...
0
votes
1answer
90 views

Completely…I mean COMPLETELY wiping my hardrive

I am new to linux, a total noob to be exact. I am using ubuntu 14.04.2 I am having a problem with people at school who have somehow hacked my computer. I have formatted my hard drive 3 or 4 times ...
0
votes
1answer
196 views

ubuntu folder permission changed to drwsrwsrwt and nautilus shows files and terminal doesn't

I am having wierd situation. I am using ubuntu 14.10. I can open all directories in nautilus but when I try to list files in terminal, only one directory get listed. I can traverse through the ...
0
votes
1answer
32 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
1k views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
5
votes
1answer
2k views

chkrootkit scanner detected possible KLM Trojan

Today I scanned my machine with the chkrootkit tool by running: sudo chkrootkit And this was some of the output: Checking `lkm'... You have 2 process ...
1
vote
1answer
91 views

Checksum of system binaries changed

This morning I received several OSSEC notifications about changed integrity checksums. Affected files are /bin/mv, /bin/dir, /bin/pwd, /bin/chrgrp and about 50 similar binaries from /bin and /usr/bin. ...
9
votes
4answers
2k views

Got a virus on Windows and Ubuntu [closed]

TLTR: I've encountered a virus what affects both Windows 8.1 and Ubuntu 14.04. This virus was proven to be impossible to be detected/removed by 50+ most popular antivirus programs/rootkits. What to do?...
7
votes
6answers
9k views

Popup ad virus on both chrome and firefox

A pop-up ad box appears whatever site I am opening. Tried resetting settings, disabling extensions, removing all users on chrome. It seems it is not about chrome since same thing happens on Firefox ...
2
votes
2answers
406 views

Rootkit scanner with graphical feedback or GUI

There are some rootkitscanners for linux, for example: chkrootkit rkhunter But How would I get notified on a desktop? Is it possible to get an alert, if the scanner found something?
3
votes
1answer
163 views

Root kit advice on ubuntu

I've been a Windows user for many years but recently Avast was bringing up 100's of Rootkit infected files. So I decided to make the switch to Ubuntu to wipe everything, and I’m quite enjoying the ...
0
votes
1answer
1k views

how to verify that sbin/init isn't infected?

for sometime chkrootkit has been showing sbin/init as being infected with SuckIt rootkit. early this year when the warning first appeared a quick google search indicated that it was most likely a ...
1
vote
0answers
919 views

Scanning Windows for Rootkits using Linux

I know of ClamAV for viruses, but is there an option for scanning AND getting rid of "rootkits" from Windows from inside Linux i.e. Live boot USB? Also spyware and malware scanning would be nice too. ...
1
vote
1answer
3k views

Rkhunter 122 suspect files; do I have a problem?

I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 ...
1
vote
3answers
189 views

myterious a.out file appeared in Downloads folder

Yesterday a file that should not exist appeared in my Downloads folder. Virustotal knows the file since 2012 and reports it as clean - but it seems other people have had it appear. Does anyone ...
5
votes
1answer
302 views

Rootkit on port 60001 !? Tiger says so - how do I verify? [closed]

My system is an up-to-date Ubuntu 13.10 I've installed Tiger and I'm getting this # Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... OLD: --ALERT-- [rootkit005a] Chkrootkit has ...
0
votes
1answer
2k views

Infected by rootkit. How do I remove it?

Today, I launched tiger, which did report a root kit alert. Chkrootkit did agree. How can I remove this root kit ? How can I find how it was installed, so I can take care of the weakness in my Ubuntu ...
1
vote
1answer
3k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
1
vote
0answers
441 views

/etc/thnuclnt/.thnumod - what is that file for?

~ > sudo find / -user root -perm -4000 -ls 710826 44 -rwsr-xr-- 1 root messagebus 42500 Окт 3 22:31 /lib/dbus-1.0/dbus-daemon-launch-helper 658951 464 -rwsr-xr-x 1 root root ...
6
votes
1answer
4k views

Rootkits: Should I be concerned?

I was reading some texts about rootkits and the tools used to remove them. I have Ubuntu 12.04.1 and rkhunter reported various warnings. I'm wondering what those are. BTW I install only original ...
1
vote
1answer
832 views

Chkrootkit findings - what to do?

after my ubuntu runs slower and slower and google regularly asks me for prooving to be human, i had Chkrootkit running. here's what it found: wlan0: PACKET SNIFFER (/sbin/wpa_supplicant [870], /...
1
vote
2answers
692 views

Networking security issue with suspicious traffic. How to track it down?

I have specific problem a bit advanced for me. On my router log I have seen following lines: Internal Prot. External NAT Time-out 192.168.0.167:56396 TCP 186....
4
votes
0answers
293 views

Are Virus/rootkits via ubuntu updates possible? [duplicate]

Possible Duplicate: How is the system kept secure? What security policies exist in place for packages and scripts? I fear that just like on Windows there might be ways to catch a malware/...
3
votes
2answers
2k views

How do I remove rootkits?

To my understanding, rootkits on linux infect the kernel to get root privileges and there are many scanners (I use rkhunter) to scan for rootkits in the kernel, but I have yet to find a program that ...
3
votes
3answers
4k views

Packet Sniffer found, what next?

After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer eth0: PACKET SNIFFER(/sbin/dhclient[3966]) How can I remove this?
0
votes
1answer
402 views

Can Chromium Browser's Permissions Facilitate a Root Kit Exploit?

I'm just learning about permissions and excuse me if I may have gone astray. But, I've noticed that Chromium Browser has a sandbox executable that is owned by root and has it's user id set to launch ...
0
votes
1answer
289 views

Many process named “su-to-root” appeared on my system monitor, is my computer owned?

Two process named gksu and two process named su-to-root appeared on my system monitor, is my computer owned? How can I be sure, and if this true, how can I rip out the intruder without full system ...
21
votes
2answers
26k views

chkrootkit says /sbin/init is infected, what does that mean?

I recently ran chkrootkit and got the following line: Searching for Suckit rootkit... Warning: /sbin/init INFECTED What does this mean exactly? I heard this was a false positive, ...
5
votes
2answers
3k views

Best rootkit removal tool for a server?

and what schedule/sysadmin routine is recommended?