just ran chkrootkit on a recently installed 14.04 lubuntu and it came up with:
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:
/lib/modules/3.16.0-30-generic/vdso/.build-id /lib/modules/3.16.0-31-generic/vdso/.build-id
/lib/modules/3.16.0-30-generic/vdso/.build-id /lib/modules/3.16.0-31-generic/vdso/.build-id
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... Warning: /sbin/init INFECTED
Checking `chkutmp'... The tty of the following user process(es) were not found
in /var/run/utmp !
! RUID PID TTY CMD
! root 1204 tty7 /usr/bin/X -core :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
chkutmp: nothing deleted
Checking `OSX_RSPLUG'... not infected
As you can see there's some anomalies; what are those suspicious files and dirs? sickit in /sbin/init? chkutmp? I don't get any results like that on my other machine... So I tried rkhunter aswell, I'd post the whole log file but it's too many characters fand the post is limited to 30000
[12:14:00] /usr/bin/unhide.rb [ Warning ]
[12:14:00] Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb: Ruby script, ASCII text
[12:15:19] System checks summary
[12:15:19] =====================
[12:15:19]
[12:15:19] File properties checks...
[12:15:19] Files checked: 134
[12:15:19] Suspect files: 1
[12:15:19]
[12:15:19] Rootkit checks...
[12:15:19] Rootkits checked : 291
[12:15:19] Possible rootkits: 0
[12:15:19]
[12:15:19] Applications checks...
[12:15:19] All checks skipped
[12:15:19]
[12:15:19] The system checks took: 1 minute and 38 seconds
[12:15:19]
[12:15:19] Info: End date is Mon Mar 16 12:15:19 GMT 2015
rkhunter doesn't seem to indicate suckit, so is that a false positive from chkrootkit? or a false negative from rkhunter? what about those other warnings, can anyone give me any insight as to what they mean? I googled a few of those anomalous results but couldn't find anything.... which is usually a bad sign.
so, do I have a rootkit and if so, how do I remove it and repair any damage done?