Questions tagged [rkhunter]
Questions related to the rootkit-detection system `rkhunter`
60
questions
0
votes
0
answers
77
views
rkhunter and wpa_supplicant
I suspect my laptop being hacked.
Here's one of the rkhunter log lines I do not like:
[11:01:45] Info: Starting test name 'packet_cap_apps'
[11:01:46] Checking for packet capturing applications ...
- 13
0
votes
0
answers
887
views
rkhunter warnings
Hi I just ran rkhunters and got a lot of warnings which are not the first ones I found the first time a I ran it.
I'll drop here the results to see if someone can help me and tell tell me if they are ...
- 9
6
votes
0
answers
407
views
Rkhunter still relevant in 2022?
I tried using the RKHunter 1.4.6 (http://downloads.sourceforge.net/project/rkhunter/rkhunter/1.4.6/rkhunter-1.4.6.tar.gz) in Ubuntu20.04 , it is around 4 years old , running it did not find any ...
- 61
0
votes
1
answer
679
views
Possible that 2,3 week old os is infected? rkhunter, chkrootkit
Problem:
Rootkit checks...
Rootkits checked : 498
Possible rootkits: 5
/usr/bin/bsd-mailx [ Warning ]
reinstalled, message keeps but now new: /usr/bin/lwp-...
- 174
0
votes
1
answer
2k
views
RKhunter Does Not Perform All Checks
Can someone tell me how to config / force rkhunter to check everything on my system? The checks are skipped, even if I run rkhunter --checkall
Performing malware checks
Checking running ...
- 569
1
vote
1
answer
473
views
Is rkhunter still required and appropriate? Nothing seems to have been written on it since 2015. Thanks
I want to use my Ubuntu 20.10 Groovy Gorilla desktop for internet banking and making purchases. Good digital hygiene is of course the first defence but i'd like to make sure that rootkits are ...
- 77
0
votes
1
answer
258
views
rkhunter suspicious file type ecryptfs-user-Private text
Should I be concerned about this warning?
Warning: Suspicious file types found in /dev:
[18:17:04] /dev/shm/ecryptfs-user-Private: ASCII text
I deleted the file, but when I rebooted it was recreated....
- 3
1
vote
0
answers
96
views
I get a "Warning" after adding the line APT_AUTOGEN="yes" to /etc/default/rkhunter with gedit [duplicate]
The warning is the following: "(gedit:38572): Tepl-WARNING **: 09:45:20.468: GVfs metadata is not supported. Fallback to TeplMetadataManager. Either GVfs is not correctly installed or GVfs metadata ...
1
vote
0
answers
61
views
How to verify system file change warnings in rkhunter
When running rkhunter I try to use
rkhunter --propupd
when it is finished, but once in a while I forget, and the next time it is run I get the inevitable file changed warning for a few files.
...
1
vote
1
answer
3k
views
Rkhunter shows 5 possible rootkits
Rkhunter shows 5 rootkits
System checks summary
File properties checks...
Files checked: 149
Suspect files: 0
Rootkit checks...
Rootkits checked : 480
Possible rootkits: 5
Applications checks...
...
- 61
0
votes
0
answers
465
views
RKHunter gave me heaps of warnings
I ran a rkhunter search and i got these...
[09:59:13] System checks summary
[09:59:13] =====================
[09:59:13]
[09:59:13] File properties checks...
[09:59:13] Files checked: 149
[09:59:13] ...
- 273
2
votes
1
answer
1k
views
Baffling menu when installing RKHunter
Someone advised me to install a program called rkhunter for security. I've tried to do so, just using the apt command at the terminal, but am presented with a weird message about e-mail servers.
I ...
- 121
0
votes
1
answer
736
views
RKhunter possible false positive
Is /usr/bin/size being infected a false positive? However after I scanned the second time, it was no longer infected. I used the same command to scan using RKhunter sudo rkhunter -c twice and found it ...
- 27
2
votes
1
answer
4k
views
rkhunter found 6 possible rootkits & how to remove them
hello i install rkhunter for first time and when i run rkhunter -c in result it came with 6 possible rootkit i wonder if these rootkits have are dangerous and if are how to remove them. ps: my pc has ...
- 21
2
votes
1
answer
1k
views
rkhunter shows a possible rootkit or a false possitive?
When I do an rkhunter --check it shows me that I have possible rootkits:
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/firefox: unexpected operator
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/...
- 722
1
vote
0
answers
427
views
Rkhunter show me "warning"
Why rkhunter shows me a "warning" in /usr/bin/lwp-request? At the end of the dialog shows: Files properties checks...
Files checked: 149
Suspect Files: 1
With ClamAV it ...
- 722
6
votes
0
answers
6k
views
Checking if SSH protocol v1 is allowed [closed]
I ran rkhunter -c on a server an the warning that i got was the following:
Checking if SSH protocol v1 is allowed [ Warning ]
Warning: The SSH configuration option 'Protocol' has not been set.
...
0
votes
0
answers
250
views
rkhunter warnings on Ubuntu 17.10 [duplicate]
I am using Ubuntu 17.10 and have recently installed and run rkhunter 1.4.4. I got the following warnings about suspicious shared memory segments:
/usr/lib/nautilus-desktop PID 1867
Is this a problem?...
0
votes
1
answer
1k
views
Rkhunter doesn't update in Ubuntu 17.10
Everytime I give the command, on terminal, sudo rkhunter --update or sudo rkhunter --versioncheck comes out an error about the wrong directory /bin/false, and doesn't update ?!
- 51
1
vote
1
answer
1k
views
Rkhunter warning: file properties have changed
I am testing rkhunter on a Ubuntu server 16.04 in Virtualbox.
The 11th of October I received an email alert from rkhunter inviting me to "Please inspect this machine, because it may be infected".
So ...
- 1,527
0
votes
1
answer
2k
views
Help a newbie (rkhunter warnings)
Recently, I got very suspicious that somebody has ratted my system. I feel the tabs will sometimes change. For example I do something on chrome and suddenly it shows opera screen (even though they're ...
0
votes
0
answers
681
views
rkhunter results - /usr/bin/ldd modification date weirdness!? Is this a problem?
I ran rkhunter as usual and got this result;
Warning: The file properties have changed:
File: /usr/bin/ldd
Current hash: 7e193a7e34656a73e85b88e0b8e0e81d66b67878
Stored ...
- 29
1
vote
0
answers
1k
views
lsattr: command not found
When I first ran rkhunter on my Ubuntu 16.04 VPS, I noticed an error with lsattr when checking for prerequisites:
Warning: Checking for prerequisites [ Warning ]
Unable to find 'lsattr' ...
- 11
2
votes
2
answers
6k
views
Rkhunter warnings help
I installed Ubuntu 14.04 a few days ago. I've made a scan with a RkHunter and got a few warnings that I don't really know what to do with. I read about false positives a little bit but I didn't find ...
- 21
1
vote
1
answer
906
views
Run a script after unattended-upgrades runs (e.g. to update rkhunter)
Hi I'd like to be able to auto update rkhunter when upgrades happen automatically, but I can't seem to find a way to do this.
I'd not want this to happen after a manual install via apt-get though or ...
- 113
25
votes
1
answer
29k
views
What is the sandbox user '_apt' on my system
I ran rkhunter and found out a warning, that there is a new user called _apt on my Ubuntu 16.04
$ grep _apt /etc/passwd
_apt:x:124:65534::/nonexistent:/bin/false
All I found out is, that it seems ...
- 32k
0
votes
1
answer
2k
views
Rkhunter warnings : file exists on system but not in rkhunter.dat (and vice versa)
A brand new Ubuntu 14.04 server with rkhunter is warning about several files that exist on the system but not in rkhunter.dat
For instance : /use/bin/awk, /usr/bin/curl even /usr/bin/rkhunter! (and a ...
1
vote
1
answer
39
views
Have the rkhunter commands changed since the 12.04 version? [closed]
I have downloaded rkhunter and have instructions of how to use it on 12.04. But I now have 16.04, so are all the commands the same still on this version?
- 11
3
votes
1
answer
14k
views
How to install rkhunter in ubuntu?
Ok I know the question sounds strange but I need help installing rkhunter the accurate way and do I need to follow all the steps in this article https://help.ubuntu.com/community/RKhunter?
user491354
0
votes
1
answer
113
views
rkhunter warning /dev files
I recently installed rkhunter and it gave me two warnings for /dev files is there any way to find a list of normal files in /dev?. I only ask because I ran wireshark and found several ip address ...
- 1
1
vote
1
answer
296
views
Is there any conflicts between running rkhunter and chkrootkit on one system?
Can I run rkhunter and chkrootkit at the same time on my Ubuntu Linux laptop without having to worry about conflicts?
user496917
1
vote
0
answers
701
views
How to test rkhunter to make sure its functioning well?
I have a Ubuntu 15.10 Linux laptop PC with rkhunter installed now all I need to do is to confirm it working well like if there is an antivirus on your pc you will go to the eicar site and download the ...
user491354
11
votes
1
answer
7k
views
If I have clamav do I need to install rootkit hunter
So I have clamav the antivirus but is that a protection against rootkits or do I need to install rootkit hunter as well with clamav?
0
votes
1
answer
496
views
Is my computer secure?
I was using Rkhunter and this was displayed.
[ Rootkit Hunter version 1.4.2 ]
File updated: searched for 175 files, found 141
baymax@vostro:~$ sudo rkhunter -c --enable all --disable none --rwo
...
- 3
0
votes
1
answer
374
views
"[: Binary: unexpected operator" message when updating rkhunter definitions on 15.10
After upgrading to Ubuntu GNOME 15.10 from 15.04 I have noticed that upon running the command:
sudo rkhunter --update
That I get this output:
[ Rootkit Hunter version 1.4.2 ]
Checking rkhunter ...
user364819
1
vote
1
answer
2k
views
rkhunter scan results
Im new to Ubuntu and im looking for some help.
I've scanned my Ubuntu with rkhunter and I have some concerning results:
Warning: The following processes are using deleted files:
Process: /sbin/init ...
- 11
3
votes
2
answers
8k
views
RKhunter and Chkrootkit
Running rkhunter showed the following error message-"Invalid SCRIPTWHITELIST configuration option: Non-existent pathname: /usr/bin/lwp-request". A quick search showed that I could get away with it by "...
- 173
3
votes
1
answer
7k
views
Unable to update rkhunter
Today when I ran the command (which I run every day and all is well):
sudo rkhunter --update
In order to check for updates to database files I got this error every time:
[ Rootkit Hunter version 1....
user364819
1
vote
1
answer
684
views
Backdoor.Linux.Gafgyt.A - How to detect an infection with this backdoor.
Yesterday I found out about the existence of the Backdoor.Linux.Gafgyt.A trojan backdoor.
I did run chkrootkit vs 0.49 and rkhunter 1.40. But surprisingly in the logs, I could not see these programs ...
- 61
2
votes
1
answer
2k
views
How to enable unhide in rkhunter
I have installed rkhunter with:
sudo apt-get install rkhunter
And even though I have enabled all test, when I run:
sudo rkhunter --check --sk
If I check in the log file, I see this about the ...
user364819
1
vote
1
answer
874
views
Why rkhunter skips empty and missing log file scans?
I have noticed that when scanning my machine with:
sudo rkhunter --checkall --sk
That part of the output in the log file is:
[21:50:51] Checking for missing log files [ Skipped ]
...
user364819
3
votes
3
answers
3k
views
How to get rkhunter to skip "[Press <ENTER> to continue]"
Every time that I scan my machine with rkhunter using the following command:
sudo rkhunter --checkall
After it has finished with a certain type of check it asks me:
[Press <ENTER> to continue]...
user364819
0
votes
1
answer
69
views
Should I uncomment out the code referring to unhide.rb (as I am using unhide.rb)?
I am using rkhunter 1.4.2, on Ubuntu 14.10, and I am also using the suggested package unhide.rb with it, so should I uncomment out this setting referring to it in the rkhunter.conf file?:
#...
user364819
0
votes
1
answer
238
views
APT_AUTOGEN setting just affecting the package being installed or all?
I have got rkhunter version 1.4.2, and I was just wondering about the APT_AUTOGEN option which I currently have enabled. Does this mean that when I install new software that it just adds that software ...
user364819
6
votes
1
answer
12k
views
rkhunter psswd and group file changes warning
Today I did a scan of my machine with rkhunter:
sudo rkhunter --checkall
And these were the warnings that I got:
Checking for passwd file changes [ Warning ]
Checking for ...
user364819
3
votes
0
answers
407
views
How to manually update RKHUNTER with newly found rootkits?
How to manually update RKHUNTER with newly found rootkits?
For example, the current latest version of rkhunter tool doesn't detect jynx2 rootkit.
How to manually update it's database. Simple rkhunter -...
- 131
2
votes
1
answer
6k
views
rkhunter checking for hidden ports skipped
I have got rkhunter version 1.4.2 installed on my Ubuntu 14.10 machine, and every time that I run the command:
sudo rkhunter --checkall
I get this output about half way through:
Performing checks ...
user364819
8
votes
1
answer
22k
views
How to upgrade rkhunter
When running the command:
sudo rkhunter --versioncheck
I get the following output:
[ Rootkit Hunter version 1.4.0 ]
Checking rkhunter version...
This version : 1.4.0
Latest version: 1.4.2
...
user364819
0
votes
1
answer
1k
views
Rootkit detector: rkhunter auto database update options
In the rkhunter config file here /etc/default/rkhunter it says:
# Defaults for rkhunter automatic tasks
# sourced by /etc/cron.*/rkhunter and /etc/apt/apt.conf.d/90rkhunter
#
# This is a POSIX shell ...
user364819
4
votes
1
answer
2k
views
Help, I May Have a Rootkit
It's been a while since I have been here. I have been very preoccupied with trying to sort out endless problems with my devices getting hacked. I have a bridge set up on my home network. It is a TP-...
- 1,656