Questions about rootkits. What are signs that you got one? How to confirm or disprove the suspicion. Tools for the detection of rootkits.

learn more… | top users | synonyms

8
votes
4answers
2k views

Got a virus on Windows and Ubuntu [closed]

TLTR: I've encountered a virus what affects both Windows 8.1 and Ubuntu 14.04. This virus was proven to be impossible to be detected/removed by 50+ most popular antivirus programs/rootkits. What to ...
7
votes
6answers
1k views

Popup ad virus on both chrome and firefox

A pop-up ad box appears whatever site I am opening. Tried resetting settings, disabling extensions, removing all users on chrome. It seems it is not about chrome since same thing happens on Firefox ...
2
votes
2answers
66 views

Rootkit scanner with graphical feedback or GUI

There are some rootkitscanners for linux, for example: chkrootkit rkhunter But How would I get notified on a desktop? Is it possible to get an alert, if the scanner found something?
0
votes
0answers
26 views

rootkit hunter found suspect files

I recently run rkhunter and found 9 suspect files detected, why curl ,dpkg show warnings as shown in the image below what should i do to remove those warnings?
0
votes
0answers
125 views

rkhunter root kit warnings

After installing and running rkhunter I received a number of warnings. I followed the instructions here (as much as was relevant): ...
3
votes
1answer
80 views

Root kit advice on ubuntu

I've been a Windows user for many years but recently Avast was bringing up 100's of Rootkit infected files. So I decided to make the switch to Ubuntu to wipe everything, and I’m quite enjoying the ...
0
votes
1answer
224 views

how to verify that sbin/init isn't infected?

for sometime chkrootkit has been showing sbin/init as being infected with SuckIt rootkit. early this year when the warning first appeared a quick google search indicated that it was most likely a ...
0
votes
0answers
240 views

Scanning Windows for Rootkits using Linux

I know of ClamAV for viruses, but is there an option for scanning AND getting rid of "rootkits" from Windows from inside Linux i.e. Live boot USB? Also spyware and malware scanning would be nice too. ...
1
vote
1answer
770 views

Rkhunter 122 suspect files; do I have a problem?

I am new to ubuntu. I am using Xfce Ubuntu 14.04 LTS. I have ran rkhunter a few weeks age and only got a few warnings. The forum said that they were normal. But, this time rkhunter reported 122 ...
1
vote
2answers
83 views

myterious a.out file appeared in Downloads folder

Yesterday a file that should not exist appeared in my Downloads folder. Virustotal knows the file since 2012 and reports it as clean - but it seems other people have had it appear. Does anyone ...
5
votes
1answer
173 views

Rootkit on port 60001 !? Tiger says so - how do I verify? [closed]

My system is an up-to-date Ubuntu 13.10 I've installed Tiger and I'm getting this # Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks... OLD: --ALERT-- [rootkit005a] Chkrootkit has ...
0
votes
1answer
875 views

Infected by rootkit. How do I remove it?

Today, I launched tiger, which did report a root kit alert. Chkrootkit did agree. How can I remove this root kit ? How can I find how it was installed, so I can take care of the weakness in my Ubuntu ...
1
vote
1answer
1k views

eth0: PACKET SNIFFER(/sbin/dhclient

Im new to Ubuntu and would like help please, I ran ProShield and got this error - eth0: PACKET SNIFFER(/sbin/dhclient I ran the following programs below and nothing came up as far as I can see. ...
1
vote
0answers
230 views

/etc/thnuclnt/.thnumod - what is that file for?

~ > sudo find / -user root -perm -4000 -ls 710826 44 -rwsr-xr-- 1 root messagebus 42500 Окт 3 22:31 /lib/dbus-1.0/dbus-daemon-launch-helper 658951 464 -rwsr-xr-x 1 root root ...
5
votes
1answer
2k views

Rootkits: Should I be concerned?

I was reading some texts about rootkits and the tools used to remove them. I have Ubuntu 12.04.1 and rkhunter reported various warnings. I'm wondering what those are. BTW I install only original ...
1
vote
1answer
510 views

Chkrootkit findings - what to do?

after my ubuntu runs slower and slower and google regularly asks me for prooving to be human, i had Chkrootkit running. here's what it found: wlan0: PACKET SNIFFER (/sbin/wpa_supplicant [870], ...
1
vote
2answers
397 views

Networking security issue with suspicious traffic. How to track it down?

I have specific problem a bit advanced for me. On my router log I have seen following lines: Internal Prot. External NAT Time-out 192.168.0.167:56396 TCP ...
3
votes
0answers
199 views

Are Virus/rootkits via ubuntu updates possible? [duplicate]

Possible Duplicate: How is the system kept secure? What security policies exist in place for packages and scripts? I fear that just like on Windows there might be ways to catch a ...
2
votes
2answers
1k views

How do I remove rootkits?

To my understanding, rootkits on linux infect the kernel to get root privileges and there are many scanners (I use rkhunter) to scan for rootkits in the kernel, but I have yet to find a program that ...
0
votes
1answer
371 views

Can Chromium Browser's Permissions Facilitate a Root Kit Exploit?

I'm just learning about permissions and excuse me if I may have gone astray. But, I've noticed that Chromium Browser has a sandbox executable that is owned by root and has it's user id set to launch ...
0
votes
1answer
280 views

Many process named “su-to-root” appeared on my system monitor, is my computer owned?

Two process named gksu and two process named su-to-root appeared on my system monitor, is my computer owned? How can I be sure, and if this true, how can I rip out the intruder without full system ...
13
votes
2answers
12k views

chkrootkit says /sbin/init is infected, what does that mean?

I recently ran chkrootkit and got the following line: Searching for Suckit rootkit... Warning: /sbin/init INFECTED What does this mean exactly? I heard this was a false positive, ...
5
votes
2answers
2k views

Best rootkit removal tool for a server?

and what schedule/sysadmin routine is recommended?