Tag Info

Hot answers tagged

12

First of all, they are only warnings, not errors. Warning: The modules file '/proc/modules' is missing. rkhunter is trying to check the kernel modules, but it cannot because the file /proc/modules doesn't exist. You can disable the test by changing the below line: DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps" to: ...


3

From the timestamps it looks like you updated several programs built Dec-19th about 7:30. Modification timestamps should be the build timestamps. It depends on how they get moved into place. Some programs are linked to through /etc/alternatives, and the symbolic links will have the timestamp of the install.This could be an automatic security update. ...


3

I agree this isn't an intrusion, but a hardware error of some sort. I would also consider whether you have a failing RAM stick, and run a memtest86 on the host server - single-bit errors could also be non-ECC RAM errors. If you have ECC RAM, you can rule this out (every server should use ECC RAM of course, and preferably ZFS to detect RAM and disk ...


2

According to your log entry, its clear that your IP is not authorized to send emails from the server you are sending this email. Here are the details of the issue: http://support.google.com/mail/bin/answer.py?hl=en&answer=10336


2

Is it possible that you have used ''prelink'' at some point between now and 3rd September 2009. Prelink has a MD5 flag: --md5 This is similar to --verify option, except instead of outputing the content of the binary or library before prelinking to standard output MD5 digest is printed. See md5sum(1). Check those binaries with that, it should then ...


2

I am no rkhunter expert by anymeans, but their are some things I would want to know. Did you install rkhunter on a fresh install with known good packages? I believe you are supposed to install on a fresh system then run, rkhunter --propupd so it can build its database of known good files. Then when you run after that it knows what to compare it too. I ...


1

Those files /bin/GET /bin/wget /usr/local/bin/rkhunter are all files you should expect to be there (though GET is usually in /usr/bin). wget is a normal part of Linux and a useful program. Evidently some rootkits make use of it and, presumably, include it themselves sometimes. I installed wget on my Windows PCs and AVG often reports it as a suspicious ...


1

It turns out that ISPConfig has it's own scheduled task setup. In this file, /usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php, there is a _monitorRkHunter function that was set to run the rkhunter scan at 2300 UTC. Thanks for your help, guys!



Only top voted, non community-wiki answers of a minimum length are eligible