I recently ran chkrootkit and got the following line:

Searching for Suckit rootkit...                   Warning: /sbin/init INFECTED

What does this mean exactly? I heard this was a false positive, what is exactly happening.

Please and thank you.

2 Answers 2


It's likely this is a false positive since there's a bug in chkrootkit (supposedly fixed in a later version 0.50-3ubuntu1). Apparently chkrootkit doesn't perform a rigorous enough check.

See: https://bugs.launchpad.net/ubuntu/+source/chkrootkit/+bug/454566

Additionally you could try rkhunter which is similar to chkrootkit.

Some more information: Fortunately, running file `which chkrootkit` shows us that chkrootkit is just a shell script so we can inspect it directly.

Searching for Suckit in the file /usr/sbin/chkrootkit we find:
   ### Suckit
   if [ -f ${ROOTDIR}sbin/init ]; then
      if [ "${QUIET}" != "t" ];then printn "Searching for Suckit rootkit... "; fi
      if [ ${SYSTEM} != "HP-UX" ] && ( ${strings} ${ROOTDIR}sbin/init | ${egrep} HOME  || \
              cat ${ROOTDIR}/proc/1/maps | ${egrep} "init." ) >/dev/null 2>&1
        echo "Warning: ${ROOTDIR}sbin/init INFECTED"
         if [ -d ${ROOTDIR}/dev/.golf ]; then
            echo "Warning: Suspect directory ${ROOTDIR}dev/.golf"
            if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi

The key line is:

cat ${ROOTDIR}/proc/1/maps | ${egrep} "init."

Since recent versions of Ubuntu, running that command does produce some output (need to run as root or sudo) :

# sudo cat /proc/1/maps | egrep "init."
b78c2000-b78db000 r-xp 00000000 08:02 271571     /sbin/init (deleted)
b78db000-b78dc000 r--p 00019000 08:02 271571     /sbin/init (deleted)
b78dc000-b78dd000 rw-p 0001a000 08:02 271571     /sbin/init (deleted)

However, this is not an infection by a rootkit. I have also looked at the rkhunter code, and the checks are far more rigorous (testing for all sorts of additional files installed by the rootkit).

I have changed lines 1003,1004 in chkrootkit file not to check perform the check of /proc/1/maps (remember to take a copy first)

if [ ${SYSTEM} != "HP-UX" ] && ( ${strings} ${ROOTDIR}sbin/init | ${egrep} HOME  ) \
             >/dev/null 2>&1

On Kubuntu 13.04 as of 2013-07-31


cat /sbin/init | egrep HOME


Binary file (standard input) matches



cat /proc/1/maps | egrep "init."

Produces NO output.

Note: Removing the period produces output (changing "init." to "init")

b7768000-b779f000 r-xp 00000000 08:02 399192     /sbin/init
b779f000-b77a0000 r--p 00036000 08:02 399192     /sbin/init
b77a0000-b77a1000 rw-p 00037000 08:02 399192     /sbin/init

So it appears to me that the part checking HOME is the problem.

If one can make the assumption that rkhunter has a valid check, then perhaps the easy route is just to remove this section from chkrootkit and run both rkhunter and chkrootkit?

  • 1
    I have the same on Ubuntu 14.04 32 bit. If I try strings /sbin/init | grep HOME I get XDG_CACHE_HOME and XDG_CONFIG_HOME is that still a false positive? What is the purpose of searching for the string "HOME" in /sbin/init? Why should that be a positive?
    – rubo77
    Oct 13, 2014 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.