Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just cleaned up my hacked CentOS server (due to not updating since versino 5.3). But still, "chkrootkit" says this:

Possible t0rn v8 \(or variation\) rootkit installed

/usr/lib/.libfipscheck.so.1.1.0.hmac 
/usr/lib/.libgcrypt.so.11.hmac 
/usr/lib/.libfipscheck.so.1.hmac 
/lib/.libcrypto.so.0.9.8e.hmac 
/lib/.libssl.so.0.9.8e.hmac 
/lib/.libssl.so.6.hmac 
/lib/.libcrypto.so.6.hmac

/usr/lib/perl5/site_perl/5.8.8/i386-linux-thread-multi/auto/Text/Iconv/.packlist 
/usr/lib/perl5/5.8.8/i386-linux-thread-multi/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/HTML-Tree/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/Font/AFM/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/MLDBM/Sync/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/MLDBM/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/FreezeThaw/.packlist
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/Apache/ASP/.packlist 
/usr/lib/perl5/vendor_perl/5.8.8/i386-linux-thread-multi/auto/HTML-Format/.packlist 

/usr/lib/gtk-2.0/immodules/.relocation-tag 
/usr/lib/python2.4/plat-linux2/.relocation-tag 
/usr/lib/python2.4/distutils/.relocation-tag 
/usr/lib/python2.4/config/.relocation-tag 

Could it be that "chkrootkit" just doesn't like .hmac, .packlist, and .relocation-tag files?

Are these realy still infected?

share|improve this question
    
Where did they come from? Who put them there? How do you know? If you can't answer that, since your system was compromised, it's best to wipe the whole thing and start over from scratch. –  Michael Hampton Oct 8 '12 at 17:40
    
For example, I've just reinstalled perl - however, "chkrootkit" still reports those files. –  Danijel Oct 8 '12 at 17:51
1  
Nuke it from orbit. It's the only way to be sure. –  Michael Hampton Oct 8 '12 at 21:53
    
Nuke it? Of course not. I've fixed nearly all problems. Along with an OS upgrade - good enough for me. –  Danijel Oct 8 '12 at 21:56

2 Answers 2

I don't believe at all in "cleaning up" a compromised server and consider the "nuke from orbit" option the only remedy.

Anyway, the only way to decide if these files are legitimate is to compare these files' checksums to those of known good files on a clean installation, but I think the fact that these library filenames are prepended by a . to hide them in a normal ls is more than enough reason to worry.

share|improve this answer
up vote 0 down vote accepted

From www.chkrootkit.org:

"Q: chkrootkit is reporting some files and dirs as suspicious: .packlist, .cvsignore, etc. These are clearly false positives. Can't you ignore these?

A: Ignoring some files and dirs could impair chkrootkit's accuracy. An attacker might use this, since he knows that chkrootkit will ignore certain files and dirs."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.