Displaying 20 results from an estimated 69 matches for "chkrootkit".
2004 May 01
3
chkrootkit and 4.10-prerelease issues?
Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or
later report chfn, chsh, and date as infected?
I built world yesterday, and my nightly chkrootkit reports this on run.
I've replaced the binaries with their 4.9 equivalents, and things don't
report as infected. I upgrade the 4.9 machine to 4.10, and ch...
2003 Aug 24
2
[solution] chkrootkit reports infected files
Hey all,
I've submitted a fix for chkrootkit port, to solve the
false positives on FreeBSD 5 and higher:
http://www.freebsd.org/cgi/query-pr.cgi?pr=55919
The topic, btw, should be "Teach security/chkrootkit
about FreeBSD 5", but it's not my first typo today.
Maintainer, please approve.
Authors, please see if you can include the...
2004 Aug 18
4
chfn, date, chsh INFECTED according to chkrootkit
I ran chkrootkit ( v. chkrootkit-0.43 ) earlier and
noticed that chfn, date, and chsh showed as being
infected. I remember reading post from the past that
right now chkrootkit is giving alot of false
positives, so I suspected that these 3 binaries are
not bad.
However, to be on the safe side, I deleted the 3
binar...
2003 Aug 14
2
chkrootkit reports INFECTED :(
Hi!
Running chkrootkit on newly installed FreeBSD 5.0 got:
-cut-
Checking `basename'... not infected
Checking `biff'... not infected
Checking `chfn'... INFECTED
Checking `chsh'... INFECTED
Checking `cron'... not infected
Checking `date'... INFECTED
-cut-
Checking `ls'... INFECTED
-cut-
Checki...
2003 Oct 01
3
chkrootkit 0.42 & 4.7-REL... "[: -ne: argument expected".... huh?
Good morning all;
Whils't running chkrootkit 0.42 on one of my 4.7-REL boxen it reported :
<snip>
Checking 'biff'...not infected
]: not found
[: -ne: argument expected
Checking 'chfn'...not infected
]: not found
[: -ne: argument expected
<snip>
I've been unable to locate any information ref. the &quo...
2004 May 21
12
Hacked or not ?
Hi,
I have a 4.9-STABLE FreeBSD box apparently hacked!
Yesterday I ran chkrootkit-0.41 and I don't like some of the outputs.
Those are:
chfn ... INFECTED
chsh ... INFECTED
date ... INFECTED
ls ... INFECTED
ps ... INFECTED
But all the rest is NOT PROMISC, NOT INFECTED, NOTHING FOUND, NOTHING DELETED, or NOTHING DETECTED.
I know by the FreeBSD-Secur...
2007 Nov 20
2
chkrootkit V. 0.47
Running freeBSD 6.1
After changing chkrootkit to the latest version V. 0.47 and compiling it then
running it I get the following:
==================<SNIPPIT>================
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... INFECTED (PORTS: 6667)
Checking `lk...
2005 Oct 28
0
chkrootkit 0.46 reboots FreeBSD 5.4-RELEASE-p8
Hello,
Please, don't use chkrootkit 0.46 on production machines.
The "chkproc" process sends a SIGXFSZ (25) signal to init,
that interprets this signal as a "disaster" and reboots
after a 30s sleep.
I'm contacting the chkrootkit maintainer to fix this
problem.
Sorry,
Cordeiro
2003 Nov 12
1
really clean install?
Good evening, I was finish the FreeBSD4.9 installation from CD, and only do some edit with the /etc/rc.firewall, /etc/rc.conf, /boot/defaults/loader.conf, and recompiling the kernel to support my ext2 backup harddisk, with sndcard support too.
This's a old laptop (ibm380z), i have chkrootkit warning after all finished, i attached my uname -a, dmesg, pkg_info and chkrootkit result, please guide me whether my machine have problem? or it's a bug?
Sorry I just play with HandBook for a month, I'm totally newbie who afraid is hacked, please help!
Thanks in advance!
--
____________...
2006 Dec 22
1
chkrootkit reporting possible LKM trojan
How can I be sure if it is LKM or not?
Today I've run chkrootkit and it gave me:
Checking `lkm'... You have 179 process hidden for readdir command
You have 179 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
Checking `chkutmp'... The tty of the following user process(es) were not found
in /var/run/utmp !
! RUID...
2006 Feb 21
1
OT Proftpd Continued
...------------------ proftpd-messages End -------------------------
--------------------- Connections (secure-log) Begin ------------------------
**Unmatched Entries**
userhelper[25867]: pam_timestamp: updated timestamp file `/var/run/sudo/root/0'
userhelper[25868]: running '/usr/lib64/chkrootkit-0.46a/chkrootkit.sh' with root privileges on behalf of 'root'
userhelper[26875]: pam_timestamp: updated timestamp file `/var/run/sudo/root/0'
userhelper[26876]: running '/usr/lib64/chkrootkit-0.46a/chkrootkit.sh' with root privileges on behalf of 'root'
-----------...
2003 Apr 13
1
chfn, chsh, ls, ps - INFECTED
My machine got hacked a few days ago through the samba bug. I
reinstalled everything cvsuped src-all, and ran chkrootkit. No more LKM
but still...
Can anyone please advise ?
bash-2.05b# chkrootkit | grep INFECTED
Checking `chfn'... INFECTED
Checking `chsh'... INFECTED
Checking `date'... INFECTED
Checking `ls'... INFECTED
Checking `ps'... INFECTED
--
Jay
-------------- next part --------------...
2003 Aug 24
2
weird problem with chkrootkit and checksums
Hello,
last night, my chkrootkit crontab returned an alarm message :
> Checking `lkm'... You have 1 process hidden for readdir command
> You have 2 process hidden for ps command
> Warning: Possible LKM Trojan installed
Some research on google make me think it's probably a false positive. I
tried few thin...
2005 Jan 11
3
Think someone has got into my server...
I have just run chkrootkit on my server and have the following two
suspicious entries..
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/5.8.0/i386-linux-thread-multi/.packlist
and further down..
Checking `bindshell'... INFECTED (PORTS: 465)
Anyone have any advice for getting rid of it...
2005 May 12
1
Do I have an infected init file?
Hello;
I'm running a FreeBSD 4.10-release-p2 box and both chkrootkit 0.44 & 0.45 report that my /sbin/init file is infected.
It appears as though the egrep for "UPX" in the output of "strings" triggers the infected notice. When I copy the init file from an uninfected box to this one chkrootkit continues to report it as infected. Is chkrootk...
2009 Dec 18
3
Security advice, please
I run chkrootkit daily. For the first time I've got reports of a problem -
Checking `bindshell'... INFECTED (PORTS: 1008)
The page http://fatpenguinblog.com/scott-rippee/checking-bindshell-infected-
ports-1008/ suggests that this might be a false positive, so I ran 'netstat -
tanup' but unlike t...
2008 Jan 13
3
Anti-Rootkit app
Hi all,
I need to install an anti-rootkid in a lot of servers. I know that
there're several options: tripwire, aide, chkrootkit...
?What do you prefer?
Obviously, I have to define my needs:
- easy setup and configuration
- actively developed
--
Thanks,
Jordi Espasa Clofent
2017 Nov 06
2
How to detect botnet user on the server ?
Hello guys,
Whats is the best way to identify a possible user using a botnet with php
in the server? And if he is using GET commands for example in other server.
Does apache logs outbound conections ?
If it is using a file that is not malicious the clam av would not identify.
Thanks
2003 Sep 10
1
chkrotkit 4.1 and FreeBSD 4.5
Hello!
I've found that on two FreeBSD 4.5-RELEASE boxes chkrootkit finds:
Checking `chfn'... INFECTED
Checking `chsh'... INFECTED
Checking `date'... INFECTED
Checking `ls'... INFECTED
Checking `ps'... INFECTED
recompiling, say, ls from souces didn't help. False positive or source changed as well?
--
Alex.
2006 Feb 05
3
Relaying of spam
...Since the "pickoftheyear" account doesn't exist....
Is there any suggestions from the group? I'm a newb at running a mail
server, just trying to figure out what's going on. The site in question
did have a couple formmail scripts that I deleted.
I am interested in running chkrootkit but is there a specific package
required for CentOS/BQ? Or just download and compile?
Thanks.
M