Questions about rootkits. What are signs that you got one? How to confirm or disprove the suspicion. Tools for the detection of rootkits.

learn more… | top users | synonyms

0
votes
0answers
15 views

Tiger Warns and Alerts

I am using Plesk 11 and have installed Fail2Ban, RKHaunter and Tiger. Tiger and Fail2Ban sends me emails, but Tiger shows a lot of warnings and alerts. # Checking for known intrusion signs... # ...
0
votes
1answer
42 views

ubuntu folder permission changed to drwsrwsrwt and nautilus shows files and terminal doesn't

I am having wierd situation. I am using ubuntu 14.10. I can open all directories in nautilus but when I try to list files in terminal, only one directory get listed. I can traverse through the ...
0
votes
0answers
27 views

what do these chkutmp results mean? chkrootkit utmp tty anomalies

Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! joe 1765 pts/2 ...
0
votes
1answer
14 views

APT_AUTOGEN setting just affecting the package being installed or all?

I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
1
vote
1answer
42 views

rkhunter psswd and group file changes warning

Today I did a scan of my machine with rkhunter: sudo rkhunter --checkall And these were the warnings that I got: Checking for passwd file changes [ Warning ] Checking for ...
4
votes
1answer
155 views

chkrootkit scanner detected possible KLM Trojan

Today I scanned my machine with the chkrootkit tool by running: sudo chkrootkit And this was some of the output: Checking `lkm'... You have 2 process ...
1
vote
1answer
30 views

Checksum of system binaries changed

This morning I received several OSSEC notifications about changed integrity checksums. Affected files are /bin/mv, /bin/dir, /bin/pwd, /bin/chrgrp and about 50 similar binaries from /bin and /usr/bin. ...
9
votes
4answers
2k views

Got a virus on Windows and Ubuntu [closed]

TLTR: I've encountered a virus what affects both Windows 8.1 and Ubuntu 14.04. This virus was proven to be impossible to be detected/removed by 50+ most popular antivirus programs/rootkits. What to ...
7
votes
6answers
2k views

Popup ad virus on both chrome and firefox

A pop-up ad box appears whatever site I am opening. Tried resetting settings, disabling extensions, removing all users on chrome. It seems it is not about chrome since same thing happens on Firefox ...
2
votes
2answers
108 views

Rootkit scanner with graphical feedback or GUI

There are some rootkitscanners for linux, for example: chkrootkit rkhunter But How would I get notified on a desktop? Is it possible to get an alert, if the scanner found something?
0
votes
0answers
52 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
244 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
3
votes
1answer
104 views

Root kit advice on ubuntu

I've been a Windows user for many years but recently Avast was bringing up 100's of Rootkit infected files. So I decided to make the switch to Ubuntu to wipe everything, and I’m quite enjoying the ...
0
votes
1answer
613 views

how to verify that sbin/init isn't infected?

for sometime chkrootkit has been showing sbin/init as being infected with SuckIt rootkit. early this year when the warning first appeared a quick google search indicated that it was most likely a ...
1
vote
0answers
471 views

Scanning Windows for Rootkits using Linux

I know of ClamAV for viruses, but is there an option for scanning AND getting rid of "rootkits" from Windows from inside Linux i.e. Live boot USB? Also spyware and malware scanning would be nice too. ...
1
vote
1answer
1k views

Rkhunter 122 suspect files; do I have a problem?

I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 ...
1
vote
2answers
108 views

myterious a.out file appeared in Downloads folder

Yesterday a file that should not exist appeared in my Downloads folder. Virustotal knows the file since 2012 and reports it as clean - but it seems other people have had it appear. Does anyone ...
5
votes
1answer
214 views

Rootkit on port 60001 !? Tiger says so - how do I verify? [closed]

My system is an up-to-date Ubuntu 13.10 I've installed Tiger and I'm getting this # Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... OLD: --ALERT-- [rootkit005a] Chkrootkit has ...
0
votes
1answer
1k views

Infected by rootkit. How do I remove it?

Today, I launched tiger, which did report a root kit alert. Chkrootkit did agree. How can I remove this root kit ? How can I find how it was installed, so I can take care of the weakness in my Ubuntu ...
1
vote
1answer
2k views

eth0: PACKET SNIFFER(/sbin/dhclient [duplicate]

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
1
vote
0answers
263 views

/etc/thnuclnt/.thnumod - what is that file for?

~ > sudo find / -user root -perm -4000 -ls 710826 44 -rwsr-xr-- 1 root messagebus 42500 Окт 3 22:31 /lib/dbus-1.0/dbus-daemon-launch-helper 658951 464 -rwsr-xr-x 1 root root ...
5
votes
1answer
3k views

Rootkits: Should I be concerned?

I was reading some texts about rootkits and the tools used to remove them. I have Ubuntu 12.04.1 and rkhunter reported various warnings. I'm wondering what those are. BTW I install only original ...
1
vote
1answer
591 views

Chkrootkit findings - what to do?

after my ubuntu runs slower and slower and google regularly asks me for prooving to be human, i had Chkrootkit running. here's what it found: wlan0: PACKET SNIFFER (/sbin/wpa_supplicant [870], ...
1
vote
2answers
461 views

Networking security issue with suspicious traffic. How to track it down?

I have specific problem a bit advanced for me. On my router log I have seen following lines: Internal Prot. External NAT Time-out 192.168.0.167:56396 TCP ...
3
votes
0answers
227 views

Are Virus/rootkits via ubuntu updates possible? [duplicate]

Possible Duplicate: How is the system kept secure? What security policies exist in place for packages and scripts? I fear that just like on Windows there might be ways to catch a ...
2
votes
2answers
1k views

How do I remove rootkits?

To my understanding, rootkits on linux infect the kernel to get root privileges and there are many scanners (I use rkhunter) to scan for rootkits in the kernel, but I have yet to find a program that ...
3
votes
3answers
3k views

Packet Sniffer found, what next?

After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer eth0: PACKET SNIFFER(/sbin/dhclient[3966]) How can I remove this?
0
votes
1answer
378 views

Can Chromium Browser's Permissions Facilitate a Root Kit Exploit?

I'm just learning about permissions and excuse me if I may have gone astray. But, I've noticed that Chromium Browser has a sandbox executable that is owned by root and has it's user id set to launch ...
0
votes
1answer
281 views

Many process named “su-to-root” appeared on my system monitor, is my computer owned?

Two process named gksu and two process named su-to-root appeared on my system monitor, is my computer owned? How can I be sure, and if this true, how can I rip out the intruder without full system ...
16
votes
2answers
15k views

chkrootkit says /sbin/init is infected, what does that mean?

I recently ran chkrootkit and got the following line: Searching for Suckit rootkit... Warning: /sbin/init INFECTED What does this mean exactly? I heard this was a false positive, ...
5
votes
2answers
2k views

Best rootkit removal tool for a server?

and what schedule/sysadmin routine is recommended?