When I use chkrootkit -q, I get:
/lib/modules/5.3.0-1035-aws/vdso/.build-id /lib/modules/5.4.0-1025-aws/vdso/.build-id /lib/modules/4.15.0-1044-aws/vdso/.build-id
/lib/modules/5.3.0-1035-aws/vdso/.build-id /lib/modules/5.4.0-1025-aws/vdso/.build-id /lib/modules/4.15.0-1044-aws/vdso/.build-id
not tested
ens5: PACKET SNIFFER(/lib/systemd/systemd-networkd[714])
not tested
Please, anyone knows what means these issues? and if they are false positives or not?
I try to install a rootkit to test chkrootkit, so I tried many rootkits from github and after I do make, I try insmod xxx.ko, but it dispalys this error: "insmod: ERROR: Could not insert module xxx.ko: Operation not permitted" Can someone please help me to resolve this problem?
I've just run chkrootkit on my laptop running Ubuntu 18.04 LTS, and everything is in the clear except the following:
Searching for suspicious files and dirs, it may take a while...
The following suspicious files and directories were found:
/usr/lib/jvm/.java-1.11.0-openjdk-amd64.jinfo /usr/lib/debug/.build-id
/usr/lib/rstudio/www/.gitignore
/usr/lib/rstudio/resources/templates/.gitignore
/lib/modules/5.0.0-27-generic/vdso/.build-id
/lib/modules/5.0.0-29-generic/vdso/.build-id
/usr/lib/debug/.build-id
/lib/modules/5.0.0-27-generic/vdso/.build-id
/lib/modules/5.0.0-29-generic/vdso/.build-id
Are any or all of these warnings false positives? I have done a fairly thorough search for each warning and come up empty. Any help would be much appreciated.
So I ran a chkrootkit. I have linux.xor.ddos showing as infected. I read other forums online and I have seen things mentioning false positives. What is linux.xor.ddos file and how can I check if they are fine?
When I do an rkhunter --check it shows me that I have possible rootkits:
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/firefox: unexpected operator
/usr/bin/rkhunter: 14795: [: /usr/lib/firefox/firefox: unexpected operator
/usr/bin/rkhunter: 14795: [: /usr/bin/konsole: unexpected operator
Checking for suspicious (large) shared memory segments [ Warning ]
/var/log/rkhunter.log show me this:
Warning: The following suspicious (large) shared memory segments have been found: [21:17:06] Process: /usr/lib/firefox/firefox (deleted) PID: 9750 Owner: louie Size: 4,0MB (configured size allowed: 1,0MB) [21:17:07] Process: /usr/lib/firefox/firefox (deleted) PID: 9750 Owner: louie Size: 4,0MB (configured size allowed: 1,0MB) [21:17:07] Process: /usr/bin/konsole (deleted) PID: 11415 Owner: louie Size: 1,7MB (configured size allowed: 1,0MB)
The alternative chkrootkit only shows me an infection: "tcpd" which I have read in several places is a false positive.
Can rkhunter also show false positives?