chkrootkit found login & netcat to be infected!!!

SliTaz Forum » English Support » Packages

chkrootkit found login & netcat to be infected!!!

(6 posts) (3 voices)

Started 12 years ago by trufighter
Latest reply from trufighter
This topic is resolved

Tags:

No tags yet.

trufighter

offline
Member

wgetpaste source = http://paste.pocoo.org/show/494461/
-----------------------------------------------
After running chkrootkit from the package manager,
I found "login" & "netcat" to be infected. Strange
part of this is that the two programs still report
to be infected even with a fresh install. Could it
be that stable 3.0 comes with the files already
infected, or is this a false positive.
-----------------------------------------------

---------------
INFECTED FILES:
---------------

line 28
-Checking `login'... INFECTED

line 33
-Checking `netstat'... INFECTED

-------------
ROOTKIT ALERT
-------------

line 86:
Searching for Suckit rootkit... Warning: /sbin/init INFECTED

-----------------------------------------------------
rkhunter shown no rootkits, but chkrootkit did.......
-----------------------------------------------------

SucKIT: did some reasearch, chkroot is known for
false positives, I aslo used "rkhunter" which returned
no rootkits installed.

check this out...

Searching for anomalies in shell history files...
Warning: `//root/.bash_history' file size is zero

This is enough to make anyone weary, so what gives???
Any intelligent advice & wisdom would greatly be
appreciated at this time of questionable
activity.......

-[tru_fighter]-

Posted 12 years ago #
Claudinei Pereira

offline
Administrator

Hi,

A full string search on google for "Searching for Suckit rootkit... Warning: /sbin/init INFECTED" returns about 3.000 pages reporting this as a false positive. See:

https://bugzilla.redhat.com/show_bug.cgi?id=636231

Posted 12 years ago #
Trixar_za

offline
Key Master

Yeah... It's be in trouble if it was. The problem is that it tries to detect them being symlinked to another application (rootkit) that pretends to be the applications that are called this way. Since this is how BusyBox works, the scanner will gives this false positives with regards to it. It's ultimately down a bad detection technique used by the checker.

Posted 12 years ago #
trufighter

offline
Member

Thanks guys, you mentioned that SucKIT was a false positive.
But what about "login" and "netstat", would these also fall
along lines of a false positive?

tru_fight3r

Posted 12 years ago #
Claudinei Pereira

offline
Administrator

The warnings about login and netstat are false positives. Chkrootkit doesn't like busybox, as @Trixar_za pointed, that's why it is patched when packaged:

http://mirror.slitaz.org/hg/hgwebdir.py/wok/raw-file/8f3891f72b54/chkrootkit/stuff/chkrootkit.u

I GUESS the real issue is that the patch isn't avoiding the warnings about netstat and init.

Posted 12 years ago #
trufighter

offline
Member

Thanx guys, chkrootkit can worry someone esle from now on........RESOLVED!!!

Posted 12 years ago #

RSS feed for this topic

Reply

You must log in to post.