The chkrootkit tag has no usage guidance.
9
votes
2answers
3k views
chkrootkit shows “tcpd” as INFECTED. Is it a false positive?
Scan by chkrootkit shows "tcpd" as being INFECTED.
Although a scan by rkhunter shows ok,(except for regular false positives)
Shall I be worried?
(I'm on Ubuntu 16.10 with 4.8.0-37-generic)
0
votes
0answers
67 views
chkrootkit, known false positives or cause of concern?
So I was doing a virus and rootkit scan of my computer when I found chkrootkit to warn me about the following files:
The following suspicious files and directories were found:
/usr/lib/jvm/.java-1....
0
votes
1answer
149 views
How to treat supposed chkrootkit false positive
I installed chkrootkit with apt-install in a freshly installed Ubuntu server 16.04.3.
chkrootkit found suspicious files and directories after first run:
Searching for suspicious files and dirs, it ...
0
votes
0answers
105 views
Operation Windigo present after fresh install
I had been noticing strange behavior and logs on my ubuntu machine.
I recently installed Ubuntu from a USB. I set the installation to write over blank space, and used LVM/LUKS encryption. I setup ...
10
votes
3answers
15k views
Chkrootkit says “Searching for Linux/Ebury - Operation Windigo ssh… Possible Linux/Ebury - Operation Windigo installetd”, should I be worried?
I recently ran sudo chkrootkit and this was one of the results:
Searching for Linux/Ebury - Operation Windigo ssh... Possible Linux/Ebury - Operation Windigo installetd
In my research on this ...
0
votes
0answers
56 views
Better installer or package for rkhunter and chkrootkit?
The rkhunter version of the repository is currently 1.4.0, while the installer is version 1.4.4
The repo version of chkrootkit is 0.49, while its installer is 0.52
Since security is a major concern ...
3
votes
3answers
1k views
How can I remove LINUX/EBURY from Ubuntu 16.04?
I was alerted that I had a virus in my Ubuntu 16.04 which I installed a few weeks ago. I verified the system with chkrootkit to see if it found anything and it did indeed find "LINUX/EBURY".
I ...
2
votes
0answers
58 views
How did I get a rootkit? [duplicate]
I am running Ubuntu 14.04 32bit.
Recently, I decided to install ClamAV. It keeps warning me about this pua.win.trojan.xored-1. I read online that this means I have a rootkit.
I download and ran ...
2
votes
2answers
6k views
RKhunter and Chkrootkit
Running rkhunter showed the following error message-"Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request". A quick search showed that I could get away with it by "...
1
vote
0answers
175 views
what is the WTED file and what is it used for?
What is the WTED file and what is it used for?
We ran the chkrootkit command and this was the output:
Checking 'wted'... 1 deletion(s) between <start date> and <end date>
After a lot of ...
1
vote
0answers
153 views
chkrootkit reports tcpd to be infected, should I be worried? [duplicate]
I ran sudo chkrootkit today and was told this as a part of the output:
Checking `tcpd'... INFECTED
I am running Ubuntu GNOME 16.10 with GNOME 3.22, what does ...
4
votes
3answers
363 views
Why doesn't chkrootkit test syslogd?
When I scan my machine with chkrootkit I notice that it always says for one of them:
Checking `syslogd'... not tested
Why is this not tested for? Should this be ...
0
votes
1answer
522 views
What exactly is /lib/modules/4.4.0-XX-generic/vdso/.build-id
I did a rootkit search with chkrootkit and it came up with this strange set of files:
/usr/lib/debug/.build-id
/lib/modules/4.4.0-51-generic/vdso/.build-id
/lib/modules/4.4.0-47-generic/vdso/....
0
votes
1answer
112 views
Is there any conflicts between running rkhunter and chkrootkit on one system?
Can I run rkhunter and chkrootkit at the same time on my Ubuntu Linux laptop without having to worry about conflicts?
2
votes
1answer
327 views
Chkrootkit false-positive “whitelist”
I want to "white-list" some of the false-positives of chkrootkit, therefor i would like to use the /etc/chkrootkit.conf as a "white-list".
But this does not work:
RUN_DAILY_OPTS="-q -e '/sbin/init /...
1
vote
1answer
466 views
Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.
Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor.
I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
