(Gelöst) Seltsame Ausgabe von chkrootkit

SuSE - Allgemeines SuSE Sicherheit
1

Hallo,

ich habe auf meinem Rechner Suse 9.3 und habe einmal chkrootkit drüberlaufen lassen. Dabei kamen einige seltsame Ausgaben. Nun würde ich gerne wissen, ob das nur ein „false postitive“ war oder tatsächlich ein Angriff auf meinen Rechner. Nachfolgend die Ausgabe von chkrootkit. Vielen Dank im Voraus. Ich hoffe, jemand kann mir helfen.

linux:/home/rainer # chkrootkit
ROOTDIR is /' Checking amd’… not found
Checking basename'... not infected Checking biff’… not found
Checking chfn'... not infected Checking chsh’… not infected
Checking cron'... not infected Checking date’… not infected
Checking du'... not infected Checking dirname’… not infected
Checking echo'... not infected Checking egrep’… not infected
Checking env'... not infected Checking find’… not infected
Checking fingerd'... not found Checking gpm’… not infected
Checking grep'... not infected Checking hdparm’… not infected
Checking su'... not infected Checking ifconfig’… not infected
Checking inetd'... not tested Checking inetdconf’… not found
Checking identd'... not found Checking init’… not infected
Checking killall'... not infected Checking ldsopreload’… not infected
Checking login'... not infected Checking ls’… not infected
Checking lsof'... not infected Checking mail’… not infected
Checking mingetty'... not infected Checking netstat’… not infected
Checking named'... not found Checking passwd’… not infected
Checking pidof'... not infected Checking pop2’… not found
Checking pop3'... not found Checking ps’… not infected
Checking pstree'... not infected Checking rpcinfo’… not infected
Checking rlogind'... not found Checking rshd’… not found
Checking slogin'... not infected Checking sendmail’… not infected
Checking sshd'... not infected Checking syslogd’… not tested
Checking tar'... not infected Checking tcpd’… not infected
Checking tcpdump'... not infected Checking top’… not infected
Checking telnetd'... not found Checking timed’… not found
Checking traceroute'... not infected Checking vdir’… not infected
Checking w'... not infected Checking write’… not infected
Checking aliens'... no suspect files Searching for sniffer's logs, it may take a while... nothing found Searching for HiDrootkit's default dir... nothing found Searching for t0rn's default files and dirs... nothing found Searching for t0rn's v8 defaults... nothing found Searching for Lion Worm default files and dirs... nothing found Searching for RSHA's default files and dir... nothing found Searching for RH-Sharpe's default files... nothing found Searching for Ambient's rootkit (ark) default files and dirs... nothing found Searching for suspicious files and dirs, it may take a while... /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-su n-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2 .11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.6/i586-linux-thread-multi/. packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot /.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Par ser/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/ .packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.pa cklist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packl ist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.pac klist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLin e/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Co nfig/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/ auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-mul ti/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread -multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux- thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux -thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i 586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/ 5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs Searching for LPD Worm files and dirs... nothing found Searching for Ramen Worm files and dirs... nothing found Searching for Maniac files and dirs... nothing found Searching for RK17 files and dirs... nothing found Searching for Ducoci rootkit... nothing found Searching for Adore Worm... nothing found Searching for ShitC Worm... nothing found Searching for Omega Worm... nothing found Searching for Sadmind/IIS Worm... nothing found Searching for MonKit... nothing found Searching for Showtee... nothing found Searching for OpticKit... nothing found Searching for T.R.K... nothing found Searching for Mithra... nothing found Searching for OBSD rk v1... nothing found Searching for LOC rootkit... nothing found Searching for Romanian rootkit... nothing found Searching for Suckit rootkit... nothing found Searching for Volc rootkit... nothing found Searching for Gold2 rootkit... nothing found Searching for TC2 Worm default files and dirs... nothing found Searching for Anonoying rootkit default files and dirs... nothing found Searching for ZK rootkit default files and dirs... nothing found Searching for ShKit rootkit default files and dirs... nothing found Searching for AjaKit rootkit default files and dirs... nothing found Searching for zaRwT rootkit default files and dirs... nothing found Searching for Madalin rootkit default files... nothing found Searching for anomalies in shell history files... nothing found Checking asp’… not infected
Checking bindshell'... not infected Checking lkm’… Checking rexedcs'... not found Checking sniffer’… not tested: can’t exec ./ifpromisc
Checking w55808'... not infected Checking wted’… not tested: can’t exec ./chkwtmp
Checking scalper'... not infected Checking slapper’… not infected
Checking `z2’… not tested: can’t exec ./chklastlog

2

AW: Seltsame Ausgabe von chkrootkit

Wo genau bitte liegt Dein Problem/Deine Sorge?

Die Dateien, die oben untersucht werden sind PERL-Module und JAVA-Files.

Verschiedene Dinge kann er nicht testen, ist es das, was Dir Sorgen macht?

Mal davon abgesehen, daß ein Rootkit-Check im laufenden System wenig Sinn machen sollte, aber da bin ich kein Experte.

Über Rootkits weiß ich nur, daß wenn sie GUT gemacht sind, man sie im laufenden System nicht FINDET (Stealth Mode).

Greetz,

RM

Nachtrag: Was macht man nicht alles für seine „Foren“-Schäfchen (AMEN g)

Hab mir eben auch chkrootkit installiert und über meine Kiste (SuSE 10.0) laufen lassen:

So sieht das bei mir aus:

ROOTDIR is `/'
Checking `amd'... not found
(gekürzt, ist mit Deinen Ausgaben identisch)

Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.7/i586-linux-thread-multi/.packlist /usr/lib/perl5/site_perl/5.8.7/i586-linux-thread-multi/auto/Video/DVDRip/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBD/SQLite/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bit/Vector/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/Pixbuf/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/ImlibImage/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/base/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/XmHTML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/GladeXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/IP/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/DNS/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/Daemon/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RPC/PlServer/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SaX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/SAX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/Common/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/NamespaceSupport/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/ycp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Carp/Clan/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Date/Calc/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Tagset/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Template/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/File/Find/Rule/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gaim/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Glib/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk2/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Mail/SpamAssassin/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PLog/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/X500/DN/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Text/Glob/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Config/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/HMAC/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Alien/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gnome/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XFree/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Number/Compare/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libintl-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libwww-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/TimeDate/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Xmms-Perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bootloader/.packlist /usr/lib/firefox/.autoreg /lib/modules/fglrx/build_mod/2.6.x/.agp3.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.nvidia-agp.o.d /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth1: PF_PACKET(/usr/sbin/wpa_supplicant)
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Checking `chkutmp'...  The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! root         5248 tty7   /usr/X11R6/bin/X -br -nolisten tcp :0 vt7 -auth /var/lib/xdm/authdir/authfiles/A:0-g7dm1E
chkutmp: nothing deleted

Der nichtgefundene Prozess sieht mehr nach X-Server als nach Rootkit aus, das ist wohl schon OK so.

Da ich keine Serverdienste auf meinem Laptop anbiete, ist die Wahrscheinlichkeit, daß meine Kiste Rootkit-verseucht ist praktisch null. Vielleicht helfen Dir diese Daten weiter, wie zuverlässig allerdings so ein Check wirklich ist, kann ich nicht beurteilen aber ich zweifle die Effektivität doch an (siehe oben). Zumindest ein "neuartiges Rootkit kann das Programm wohl eher nicht erkennen, oder? Wenn ich die Suchroutine richtig verstehe (oder besser die Ausgaben von chkrootkit), dann sucht er nach bekannten Schadprogrammen.

3

AW: Seltsame Ausgabe von chkrootkit

Hallo,

vielen Dank für die schnelle Antwort. Tatsächlich hat mich abgesehen von den versteckten Dateien etwas beunruhigt, dass chkrootkit manches nicht testen konnte. Wahrscheinlich war es wirklich nur falscher Alarm.

4

AW: Seltsame Ausgabe von chkrootkit

Hallo,

es tut mir leid dass ich nochmal nerven muss, aber ich habe mal chkrootkit von einer knoppix live-cd aus laufen lassen. Dabei kam die Meldung find infected und top infected. Nachfolgend die ganye Ausgabe

root@ttyp0[hda2]# chkrootkit -r /mnt/hda2
ROOTDIR is /mnt/hda2/' Checking amd’… not found
Checking basename'... not infected Checking biff’… not found
Checking chfn'... not infected Checking chsh’… not infected
Checking cron'... not infected Checking date’… not infected
Checking du'... not infected Checking dirname’… not infected
Checking echo'... not infected Checking egrep’… not infected
Checking env'... not infected Checking find’… INFECTED
Checking fingerd'... not found Checking gpm’… not infected
Checking grep'... not infected Checking hdparm’… not infected
Checking su'... not infected Checking ifconfig’… not infected
Checking inetd'... not infected Checking inetdconf’… not found
Checking identd'... not found Checking init’… not infected
Checking killall'... not infected Checking ldsopreload’… not infected
Checking login'... not infected Checking ls’… not infected
Checking lsof'... not infected Checking mail’… not infected
Checking mingetty'... not infected Checking netstat’… not infected
Checking named'... not found Checking passwd’… not infected
Checking pidof'... not infected Checking pop2’… not found
Checking pop3'... not found Checking ps’… not infected
Checking pstree'... not infected Checking rpcinfo’… not infected
Checking rlogind'... not found Checking rshd’… not found
Checking slogin'... not infected Checking sendmail’… not infected
Checking sshd'... not infected Checking syslogd’… not tested
Checking tar'... not infected Checking tcpd’… not infected
Checking tcpdump'... not infected Checking top’… INFECTED
Checking telnetd'... not found Checking timed’… not found
Checking traceroute'... not infected Checking vdir’… not infected
Checking w'... not infected Checking write’… not infected
Checking aliens'... no suspect files Searching for sniffer's logs, it may take a while... nothing found Searching for HiDrootkit's default dir... nothing found Searching for t0rn's default files and dirs... nothing found Searching for t0rn's v8 defaults... nothing found Searching for Lion Worm default files and dirs... nothing found Searching for RSHA's default files and dir... nothing found Searching for RH-Sharpe's default files... nothing found Searching for Ambient's rootkit (ark) default files and dirs... nothing found Searching for suspicious files and dirs, it may take a while... /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /mnt/hda2/usr/lib/perl5/5.8.6/i586-linux-thread-multi/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Parser/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Config/Crontab/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/MD4/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/SDL_perl/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Locale/gettext/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs Searching for LPD Worm files and dirs... nothing found Searching for Ramen Worm files and dirs... nothing found Searching for Maniac files and dirs... nothing found Searching for RK17 files and dirs... nothing found Searching for Ducoci rootkit... nothing found Searching for Adore Worm... nothing found Searching for ShitC Worm... nothing found Searching for Omega Worm... nothing found Searching for Sadmind/IIS Worm... nothing found Searching for MonKit... nothing found Searching for Showtee... nothing found Searching for OpticKit... nothing found Searching for T.R.K... nothing found Searching for Mithra... nothing found Searching for OBSD rk v1... nothing found Searching for LOC rootkit ... nothing found Searching for Romanian rootkit ... nothing found Searching for Suckit rootkit ... nothing found Searching for Volc rootkit ... nothing found Searching for Gold2 rootkit ... nothing found Searching for TC2 Worm default files and dirs... nothing found Searching for Anonoying rootkit default files and dirs... nothing found Searching for ZK rootkit default files and dirs... nothing found Searching for ShKit rootkit default files and dirs... nothing found Searching for AjaKit rootkit default files and dirs... nothing found Searching for zaRwT rootkit default files and dirs... nothing found Searching for anomalies in shell history files... nothing found Checking asp’… not infected
Checking bindshell'... not tested Checking lkm’… not tested
Checking rexedcs'... not found Checking sniffer’… not tested
Checking w55808'... not infected Checking wted’… nothing deleted
Checking scalper'... not infected Checking slapper’… not infected
Checking `z2’… nothing deleted
root@ttyp0[hda2]#

5

AW: Seltsame Ausgabe von chkrootkit

Hallo,

ich wollte nur sagen, dass ich das Problem gelöst habe. Bei dem zweiten Durchgang von chkrootkit mit einer Live-CD hatte ich eine ältere Knoppix-CD erwischt, wo eine ältere Version von chkrootkit mit einem Bug draufgewesen ist. Ein bischen googeln hat ergeben, dass diese Version bei „top“ und „find“ „infected“ anzeigen kann, obwohl nichts infiziert ist. Ich habe bei mir noch eine neue „Kantonix“-CD entdeckt und bei einem Durchgang von chkrootkit lief alles fehlerfrei. Auf jeden Fall wollte ich mich nochmal für die Hilfe bedanken.

6

AW: Seltsame Ausgabe von chkrootkit

Und zu …