1

Rkhunter shows 5 rootkits

System checks summary


File properties checks...
Files checked: 149
Suspect files: 0

Rootkit checks...
Rootkits checked : 480
Possible rootkits: 5

Applications checks...
All checks skipped


 Info: Starting test name 'ipc_shared_mem'
 [11:13:02] Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)
 [11:13:02]   Checking for suspicious (large) shared memory segments [ Warning ]
 [11:13:02] Warning: The following suspicious (large) shared memory segments have been found:
 [11:13:02]          Process: /usr/bin/mousepad    PID: 1533    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1    PID: 1159    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/bin/xfce4-terminal    PID: 30209         Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)

False positive or not?

1
  • Looks maybe like a rootkit/virus But I also have 5 possible, now reduced to three??? and system files infected??? at 21.04 Nobody can say with that information if it is false positive, but if clamtk/av says 4 virusses found you prob. should scan with a LIVE medium. Scan your home folder, your snap folders and your system folders so you have better information
    – france1
    May 21, 2021 at 18:10

1 Answer 1

0

Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)

and

configured size allowed: 1,0MB

are arbitrary. Who decided that 1Mb is allowed? Seems to me they are guessing here.

Large memory segments can be white listed in /etc/rkhunter.conf so you can suppress this message if you want; what to me also indicates they know about it being a false positive. Why the need to white list it? That is admitting they can not proof there is a rootkit.

Both firefox and xfce4-terminal I would assume to need more than 1Mb. The other 2... no idea if 4Mb is what they need. 4Mb is not a lot so maybe.

I would consider anything rkhunter tells you to be a false positive unless you can stave it with proof from another source. Always use TWO detectors and match their results. If both claim the same issue I'd start to worry.

3
  • Result from chkrootkit: You have 1 process hidden for readdir command You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed wlp4s0: PACKET SNIFFER(/sbin/dhclient[1500], /sbin/wpa_supplicant[834], /sbin/wpa_supplicant[834]) user abigael deleted or never logged from lastlog! The tty of the following user process(es) were not found in /var/run/utmp !
    – Abigael
    Nov 27, 2019 at 17:20
  • Result from ClamTK: 4 virus PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/.mozilla/firefox/9pzgmg9q.default-release/extensions/[email protected] PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/.config/libreoffice/4/user/basic/Standard/Module1.xba PUA.Doc.Tool.LibreOfficeMacro-2
    – Abigael
    Nov 27, 2019 at 17:25
  • home/abigael/.local/share/Trash/files/tor-browser_fr/Browser/TorBrowser/Data/Browser/profile.default/extensions/[email protected] PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/Documents/tor-browser_fr/Browser/TorBrowser/Data/Browser/profile.default/extensions/[email protected]
    – Abigael
    Nov 27, 2019 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .