0

Problem: Rootkit checks... Rootkits checked : 498 Possible rootkits: 5

/usr/bin/bsd-mailx                                       [ Warning ]

reinstalled, message keeps but now new: /usr/bin/lwp-request :: warning Here:: Checking `lkm'... OooPS, not expected 329818 value chkproc: Warning: Possible LKM Trojan installed

doesn't detect any rootkit: rkhunter (but still says possible 5) I don't like if a zero day is on my computer; Also this here appears:

Checking for suspicious (large) shared memory segments [ Warning ]

What's that???

I think that is all from the rootkit scanners...

clamav scanning now... new: just 3 possible rootkits?? Is rkhunter a good software???!!! This found by clamav (I tried to build a halium-boot for ubuntu touch) /home/france1/.fairphone3/halium/external/curl/lib/mk-ca-bundle.vbs: Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL FOUND

8
  • What is your Ubuntu version? Is it personal machine or high-load server in the net?
    – N0rbert
    May 21, 2021 at 17:34
  • Now my 20.10 (currently running) reports something (first scan), oh and this version is 21.04 @N0rbert
    – france1
    May 21, 2021 at 17:40
  • Apple Laptop (20.10) reports this: Searching for Linux.Xor.DDoS ... INFECTED: Possible Malicious Linux.Xor.DDoS installed.. rkhunter says command mail: warning
    – france1
    May 21, 2021 at 17:43
  • I've ubuntu desktop .. appple laptop also says these: /usr/bin/lwp-request [ Warning ] /usr/bin/bsd-mailx [ Warning ]
    – france1
    May 21, 2021 at 17:46
  • @france1 if you have additional information, please use the edit button to add it to your question, rather than posting it via comments May 21, 2021 at 17:51

1 Answer 1

0

rkhunter is good software, but you have to know how to use it.

rkhunter looks for indicators of compromise (IOCs). An IOC is not proof that you have been compromised but, as the name says, just an indicator that it may be so. Consequently, if rkhunter emits a warning you should investigate that and, if it turns out that what it found is in in fact legitimate on your system, update your rkhunter policy so that it knows not to complain about that again.

As an example, rkhunter looks for certain types of shared memory segments that are known to be used by malware to hide itself. But there are also legitimate uses of that type of shared memory segments, for example in database software. So if you run rkhunter on a database server for the first time it will warn about those shared memory segments. You investigate and find that they are legitimately used by your database, you add a statement to that effect to your rkhunter policy, and rkhunter will not warn about them anymore.

2
  • I understand .. But why else shows it first 5 possible and then 3 possible?? System didn't restart at all
    – france1
    May 29, 2021 at 6:09
  • 1
    The number alone is meaningless. IOCs may change over the system lifetime. Shared memory segments may be created or deleted, ports may be opened or closed, both legitimately or maliciously. The only sensible approach is to investigate the warnings individually and, if they turn out to be false positives, whitelist them in rkhunter.conf.
    – Tilman
    May 29, 2021 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .