Questions tagged [rootkit]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
293 views

chkrootkit awk not found

I am using chkrootkit 0.53 on my ubuntu dekstop 18.04 When I was doing scan with ` ./chkrootkit -p /folder it give me error chkrootkit: can't find 'awk' . Could anyone help? Thank you
rosada's user avatar
  • 16
0 votes
1 answer
206 views

Unknown device: detected open ports on server that should not exist?

While running a network scan I found open tcp ports reported for a linux machine (port 22-Openssh debian; ports 5124/5127/7582/8282 - Tunnel is OpenSSL) but we only have one linux box and this was not ...
user1840734's user avatar
1 vote
3 answers
170 views

Recognize rootkit-taken server

First, I'm not looking for software for detection of rootkits planted into server, as this may and may not work, especially on live system. I'm curious to find out what would be the signs of rootkit ...
Miloš Đakonović's user avatar
-1 votes
2 answers
160 views

How trustworthy are Arch's official repositories? [closed]

I have a server with Arch Linux installed and for some reason, it gets infected after a period of inactivity. I reinstall, remain inactive for some time and it gets infected again. Every time I ...
Albêr's user avatar
  • 1
1 vote
1 answer
2k views

Are rkhunter and chrootkit still effective linux rootkit scanners?

AFAICT neither have had much activity since the first half of 2014. Are there any other open source linux root scanners out there or reasonable commercial alternatives?
steveinatorx's user avatar
3 votes
1 answer
2k views

How to detect Bios Rootkits on a server mainboard?

I recently read about a talk by Corey Kallenberg and Xeno Kovah given at the CanSecWest-conference which describes how the firmware of a server mainboard can be reprogrammed to include malicious ...
pefu's user avatar
  • 689
1 vote
1 answer
630 views

Find a script which writes in /var/tmp [duplicate]

I discover that one of my partition was full. rootfs 20G 1,8G 17G 10% / /dev/root 20G 1,8G 17G 10% / devtmpfs 7,8G 184K 7,8G 1% /dev none ...
Raphaël's user avatar
  • 143
0 votes
0 answers
525 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
D.Mill's user avatar
  • 379
2 votes
1 answer
3k views

What to do if rkhunter finds a possible rootkit?

ran rkhunter tonight, and I got this for the results: [04:17:34] System checks summary [04:17:34] ===================== [04:17:34] [04:17:34] File properties checks... [04:17:34] Files checked: 133 [...
Alex Douglas's user avatar
0 votes
1 answer
145 views

Strange ports on default install of W7

I have a base new install of windows 7, and when I went to look for something else I saw the attached netstat output. What concerns me is that this is Windows + Truecrypt + drivers, nothing else ...
Sabre's user avatar
  • 445
2 votes
1 answer
2k views

Check all debian binaries against the checksum of the original

I would like to check all binaries on my server against dpkg -e <path_to_deb_package> <destination> (for example rkhunter could do this check against the originals when doing probupdate)...
rubo77's user avatar
  • 2,519
2 votes
1 answer
3k views

Suspicious file types found in /dev ASCII text

rkhunter complains about this: Warning: Suspicious file types found in /dev: /dev/.udev/queue.bin: data /dev/.udev/data/c13:66: ASCII text /dev/.udev/data/c13:64: ASCII ...
rubo77's user avatar
  • 2,519
2 votes
1 answer
428 views

RKHunter reports change in file properties, but different hash length

RKHunter reports change in file properties, but the strange thing is that the hash length is different in the current hash an in the stored hash. [11:47:13] Warning: The file properties have changed: ...
Zhen's user avatar
  • 2,159
0 votes
1 answer
1k views

How can I remove SHV4 / SHV5 rootkits? [duplicate]

I've seen that my system has a two kind of rootkits: SHV4 / SHV5. (I'm going to add a log here) I tried to remove it but I could not. Can anybody recommend me any way to do it? [ Rootkit Hunter ...
jask's user avatar
  • 341
8 votes
2 answers
6k views

Rootkit Revealer is failing to run, why? [duplicate]

On a user's laptop (Windows 7 x64), terrible performance led me to suspect a rootkit after ruling almost everything else out. I checked boot entries with Autoruns and ran a full scan with Malwarebytes,...
Bigbio2002's user avatar
  • 2,833
1 vote
1 answer
5k views

Rkhunter triggered last night warning for a possible infection. What next?

Last night rkhunter triggered with the following warnings: [04:10:23] Warning: Network TCP port 32982 is being used by /usr/lib/apache2/mpm-prefork/apache2. Possible rootkit: Solaris Wanuk ...
Luuk D. Jansen's user avatar
2 votes
1 answer
4k views

remove shared library from sshd [duplicate]

mv /lib64/libkeyutils.so.1.9 /root service sshd restart Stopping sshd: [ OK ] Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
Tiffany Walker's user avatar
1 vote
2 answers
680 views

Squid showed up on port 8080. Possible Rootkit?

I recently attempted to connect to my EC2 server on 8080 and had some strange issues that weren't occurring earlier. NGinx (though setup for :81) captures any requests on port 8080. If I stop ...
GuyNoir's user avatar
  • 153
2 votes
2 answers
144 views

How to keep track of the serverconfiguration: keep entire "/etc" in git

I want to keep my whole /etc folder in a git repository to track unauthorised changes by intruders and find out mistakes I could have done myself. What would be the right way to achieve this?
rubo77's user avatar
  • 2,519
0 votes
2 answers
752 views

Could it be that "chkrootkit" just doesn't like .hmac, .packlist, and .relocation-tag files?

I just cleaned up my hacked CentOS server (due to not updating since versino 5.3). But still, "chkrootkit" says this: Possible t0rn v8 \(or variation\) rootkit installed /usr/lib/.libfipscheck.so.1....
Danijel's user avatar
  • 256
-1 votes
3 answers
755 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something like: #...
Danijel's user avatar
  • 256
0 votes
2 answers
501 views

How to replace infected `/lib/libsh.so` and `/etc/sh.conf` files? [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY Which package does the file /lib/libsh.so belong to? I need to replace it since it was infected. Same for /etc/sh.conf. For now I have ...
Danijel's user avatar
  • 256
0 votes
1 answer
3k views

Hacked CentOS 5 server - possible rootkit installed? [duplicate]

Possible Duplicate: How do I know if my Linux server has been hacked? My server's been hacked EMERGENCY I am running CentOS 5.3 and here is the result of "chkrootkit": Possible t0rn v8 \(...
Danijel's user avatar
  • 256
-3 votes
2 answers
997 views

Rootkit scanning

Are there any good services or ways to scan for rootkits and backdoors? I know there are rkhunter and chkrootkit but are they even ideal anymore? They never seem updated and look more like they were ...
Tiffany Walker's user avatar
-3 votes
1 answer
240 views

How do I remove a rootkit without an anti-rootkit program? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Windows 2000 Server. I believe I have a rootkit. But, nothing will remove it. I've tried everything. Even tools that are merely for ...
johnny's user avatar
  • 2,348
1 vote
2 answers
5k views

running a high CPU consuming process, but top/htop show ALL process cpu 0%?

all. I have these weird servers can not explained as follow: htop 1 [||||||||||||||| 28.5%] Tasks: 53 total, 1 running 2 [|||||||||||||||| ...
kiiwii's user avatar
  • 131
0 votes
1 answer
395 views

Scripted install of Debian backdoor/rootkit [closed]

We have a number of servers (100+) that we need to increase a certain type of security on. (sortof internal, sorry NDA). We have thought about using a rootkit of some sort that would be able to keep ...
Joshua D'Alton's user avatar
1 vote
1 answer
1k views

What is "ndptsp.tsp"?

Sophos Anti-Rootkit tells me that on one of our web servers, there is an "unknown hidden file" ndptsp.tsp: Area: Local hard drives Description: Unknown hidden file Location: C:\Windows\...
Uwe Keim's user avatar
  • 2,440
21 votes
6 answers
5k views

Putting a whole linux server under source control (git)

I am thinking about putting my whole linux server under version control using git. The reason behind it being that that might be the easiest way to detect malicious modifications/rootkits. All I would ...
Tobias Hertkorn's user avatar
2 votes
4 answers
9k views

My computer is sending ICMP packets to arbitrary destinations

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is : Internet Control Message Protocol Type: 3 (Destination unreachable) ...
user58859's user avatar
  • 518
11 votes
10 answers
1k views

Pull network or power? (for contianing a rooted server)

When a server gets rooted (e.g. a situation like this), one of the first things that you may decide to do is containment. Some security specialists advise not to enter remediation immediately and to ...
5 votes
3 answers
1k views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
mr.b's user avatar
  • 583
8 votes
5 answers
4k views

Pain removing a perl rootkit

So, we host a geoservice webserver thing at the office. Someone apparently broke into this box (probably via ftp or ssh), and put some kind of irc-managed rootkit thing. Now I'm trying to clean the ...
paul.ago's user avatar
  • 201
1 vote
1 answer
204 views

HOw to view all Logs in OSSSEC system ubuntu

I have installed OSSEC It is working and sometime sending me alert email as well. But i want to see what can i type so that i can get view all the logs of what OSSEC has found in my system
user avatar
0 votes
1 answer
774 views

rootkit exploit on centos server

I have recenrly found a file in my folder called wunderbar_emporium its details is here What is that , how it came here and what should i check to make sure what arong has been done to system
user avatar
5 votes
2 answers
5k views

ifconfig showing wrong RX/TX byte count

ifconfig tells for eth0 some RX = 2,8GB, TX = 1,3GB value that cannot be real, since I recently transmitted many 10GB+ files over eth0. I would like to know if that's just some ordinary integer ...
user avatar
9 votes
8 answers
27k views

How to check if a Linux server is clean from rootkits/backdoors/botnets etc.?

In case a Linux server was exposed to the internet with extreme low security policy (r/w anonymous Samba folders, Firebird database server with default admin password, no firewall, etc.) for a week, ...
Ivan's user avatar
  • 3,398
6 votes
2 answers
17k views

RtKit on my ubuntu?

Hi I just updated my ubuntu karmic Koala to Lucid Lynx and found sth strange on my file /etc/passwd. rtkit:x:120:130:RealtimeKit,,,:/proc:/bin/false Can someone tell me what it is?
Dimitri's user avatar
  • 181
6 votes
6 answers
8k views

Check integrity of Debian system after possible rootkit?

I have a system that was possibly rootkited (the IRC bot was installed and +ai attributes were set on /usr/bin, /usr/sbin, /bin, /sbin). The IRC bots were deleted and system was upgraded to 5.0.4 from ...
artvolk's user avatar
  • 309
1 vote
1 answer
2k views

How to prevent wunderbar_emporium rootkit

I just learned about the wunderbar_emporium rootkit, and it sounds pretty nasty. I tested it on a few linux servers I have access to, and while it failed on two of them, it was successful on one with ...
Josh's user avatar
  • 9,208
5 votes
8 answers
916 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
Chris Burgess's user avatar
12 votes
5 answers
102k views

how to find out what created a file?

I have some virus files being randomly created on root of a c: disk of one of my servers. How can I find out what created it? Some 3rd party software maybe?
Boris Vezmar's user avatar
8 votes
8 answers
9k views

A list of Windows rootkit detection and removal tools

A list of rootkit detection and/or removal tools from publicly trusted sources: Name, Vendor, Latest release RootkitRevealer, Sysinternals, November 1 2006 Rootkit Unhooker, ep_x0ff (now working at ...
5 votes
6 answers
2k views

Anti-Rootkit programs

What program do you use for detecting Rootkits? How do you know what to trust?
Terry's user avatar
  • 1,073