1

Rkhunter shows 5 rootkits

System checks summary


File properties checks...
Files checked: 149
Suspect files: 0

Rootkit checks...
Rootkits checked : 480
Possible rootkits: 5

Applications checks...
All checks skipped


 Info: Starting test name 'ipc_shared_mem'
 [11:13:02] Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)
 [11:13:02]   Checking for suspicious (large) shared memory segments [ Warning ]
 [11:13:02] Warning: The following suspicious (large) shared memory segments have been found:
 [11:13:02]          Process: /usr/bin/mousepad    PID: 1533    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1    PID: 1159    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/bin/xfce4-terminal    PID: 30209         Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)

False positive or not?

1
  • Looks maybe like a rootkit/virus But I also have 5 possible, now reduced to three??? and system files infected??? at 21.04 Nobody can say with that information if it is false positive, but if clamtk/av says 4 virusses found you prob. should scan with a LIVE medium. Scan your home folder, your snap folders and your system folders so you have better information
    – france1
    May 21, 2021 at 18:10

1 Answer 1

0

Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)

and

configured size allowed: 1,0MB

are arbitrary. Who decided that 1Mb is allowed? Seems to me they are guessing here.

Large memory segments can be white listed in /etc/rkhunter.conf so you can suppress this message if you want; what to me also indicates they know about it being a false positive. Why the need to white list it? That is admitting they can not proof there is a rootkit.

Both firefox and xfce4-terminal I would assume to need more than 1Mb. The other 2... no idea if 4Mb is what they need. 4Mb is not a lot so maybe.

I would consider anything rkhunter tells you to be a false positive unless you can stave it with proof from another source. Always use TWO detectors and match their results. If both claim the same issue I'd start to worry.

3
  • Result from chkrootkit: You have 1 process hidden for readdir command You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed wlp4s0: PACKET SNIFFER(/sbin/dhclient[1500], /sbin/wpa_supplicant[834], /sbin/wpa_supplicant[834]) user abigael deleted or never logged from lastlog! The tty of the following user process(es) were not found in /var/run/utmp !
    – Abigael
    Nov 27, 2019 at 17:20
  • Result from ClamTK: 4 virus PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/.mozilla/firefox/9pzgmg9q.default-release/extensions/https-everywhere@eff.org.xpi PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/.config/libreoffice/4/user/basic/Standard/Module1.xba PUA.Doc.Tool.LibreOfficeMacro-2
    – Abigael
    Nov 27, 2019 at 17:25
  • home/abigael/.local/share/Trash/files/tor-browser_fr/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff@eff.org.xpi PhishTank.Phishing.5435002.UNOFFICIAL /home/abigael/Documents/tor-browser_fr/Browser/TorBrowser/Data/Browser/profile.default/extensions/https-everywhere-eff@eff.org.xpi
    – Abigael
    Nov 27, 2019 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.