# (Gelöst) Seltsame Ausgabe von chkrootkit

**URL:** <https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475>\
**Category:** SuSE Sicherheit\
**Created:** [10. April 2006 um 17:48 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475 "2006-04-10T17:48:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rwkraemer](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/r/dbc845/32.png) [@rwkraemer](https://discourse.suseforum.de/u/rwkraemer)\
**Post date:** [10. April 2006 um 17:48 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/1 "2006-04-10T17:48:14Z")

</div>

Hallo,

ich habe auf meinem Rechner Suse 9.3 und habe einmal chkrootkit drüberlaufen lassen. Dabei kamen einige seltsame Ausgaben. Nun würde ich gerne wissen, ob das nur ein „false postitive“ war oder tatsächlich ein Angriff auf meinen Rechner. Nachfolgend die Ausgabe von chkrootkit. Vielen Dank im Voraus. Ich hoffe, jemand kann mir helfen.

linux:/home/rainer # chkrootkit  
ROOTDIR is `/' Checking `amd’… not found  
Checking `basename'... not infected Checking `biff’… not found  
Checking `chfn'... not infected Checking `chsh’… not infected  
Checking `cron'... not infected Checking `date’… not infected  
Checking `du'... not infected Checking `dirname’… not infected  
Checking `echo'... not infected Checking `egrep’… not infected  
Checking `env'... not infected Checking `find’… not infected  
Checking `fingerd'... not found Checking `gpm’… not infected  
Checking `grep'... not infected Checking `hdparm’… not infected  
Checking `su'... not infected Checking `ifconfig’… not infected  
Checking `inetd'... not tested Checking `inetdconf’… not found  
Checking `identd'... not found Checking `init’… not infected  
Checking `killall'... not infected Checking `ldsopreload’… not infected  
Checking `login'... not infected Checking `ls’… not infected  
Checking `lsof'... not infected Checking `mail’… not infected  
Checking `mingetty'... not infected Checking `netstat’… not infected  
Checking `named'... not found Checking `passwd’… not infected  
Checking `pidof'... not infected Checking `pop2’… not found  
Checking `pop3'... not found Checking `ps’… not infected  
Checking `pstree'... not infected Checking `rpcinfo’… not infected  
Checking `rlogind'... not found Checking `rshd’… not found  
Checking `slogin'... not infected Checking `sendmail’… not infected  
Checking `sshd'... not infected Checking `syslogd’… not tested  
Checking `tar'... not infected Checking `tcpd’… not infected  
Checking `tcpdump'... not infected Checking `top’… not infected  
Checking `telnetd'... not found Checking `timed’… not found  
Checking `traceroute'... not infected Checking `vdir’… not infected  
Checking `w'... not infected Checking `write’… not infected  
Checking `aliens'... no suspect files Searching for sniffer's logs, it may take a while... nothing found Searching for HiDrootkit's default dir... nothing found Searching for t0rn's default files and dirs... nothing found Searching for t0rn's v8 defaults... nothing found Searching for Lion Worm default files and dirs... nothing found Searching for RSHA's default files and dir... nothing found Searching for RH-Sharpe's default files... nothing found Searching for Ambient's rootkit (ark) default files and dirs... nothing found Searching for suspicious files and dirs, it may take a while... /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-su n-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2 .11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.6/i586-linux-thread-multi/. packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot /.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Par ser/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/ .packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.pa cklist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packl ist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.pac klist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLin e/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Co nfig/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/ auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-mul ti/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread -multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux- thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux -thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i 586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/ 5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs Searching for LPD Worm files and dirs... nothing found Searching for Ramen Worm files and dirs... nothing found Searching for Maniac files and dirs... nothing found Searching for RK17 files and dirs... nothing found Searching for Ducoci rootkit... nothing found Searching for Adore Worm... nothing found Searching for ShitC Worm... nothing found Searching for Omega Worm... nothing found Searching for Sadmind/IIS Worm... nothing found Searching for MonKit... nothing found Searching for Showtee... nothing found Searching for OpticKit... nothing found Searching for T.R.K... nothing found Searching for Mithra... nothing found Searching for OBSD rk v1... nothing found Searching for LOC rootkit... nothing found Searching for Romanian rootkit... nothing found Searching for Suckit rootkit... nothing found Searching for Volc rootkit... nothing found Searching for Gold2 rootkit... nothing found Searching for TC2 Worm default files and dirs... nothing found Searching for Anonoying rootkit default files and dirs... nothing found Searching for ZK rootkit default files and dirs... nothing found Searching for ShKit rootkit default files and dirs... nothing found Searching for AjaKit rootkit default files and dirs... nothing found Searching for zaRwT rootkit default files and dirs... nothing found Searching for Madalin rootkit default files... nothing found Searching for anomalies in shell history files... nothing found Checking `asp’… not infected  
Checking `bindshell'... not infected Checking `lkm’… Checking `rexedcs'... not found Checking `sniffer’… not tested: can’t exec ./ifpromisc  
Checking `w55808'... not infected Checking `wted’… not tested: can’t exec ./chkwtmp  
Checking `scalper'... not infected Checking `slapper’… not infected  
Checking `z2’… not tested: can’t exec ./chklastlog

---

<div class="post-metadata">

**Author:** ![Rain\_Maker](https://discourse.suseforum.de/user_avatar/discourse.suseforum.de/rain_maker/32/7_2.png) [@Rain\_Maker](https://discourse.suseforum.de/u/Rain_Maker)\
**Post date:** [10. April 2006 um 20:35 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/2 "2006-04-10T20:35:57Z")

</div>

AW: Seltsame Ausgabe von chkrootkit

> [@rwkraemer](#):
>
> Hallo,
> 
> ich habe auf meinem Rechner Suse 9.3 und habe einmal chkrootkit drüberlaufen lassen. Dabei kamen einige seltsame Ausgaben. Nun würde ich gerne wissen, ob das nur ein „false postitive“ war oder tatsächlich ein Angriff auf meinen Rechner. Nachfolgend die Ausgabe von chkrootkit. Vielen Dank im Voraus. Ich hoffe, jemand kann mir helfen.
> 
> … (aus Platzgründen weggelassen)

Wo genau bitte liegt Dein Problem/Deine Sorge?

Die Dateien, die oben untersucht werden sind PERL-Module und JAVA-Files.

Verschiedene Dinge kann er nicht testen, ist es das, was Dir Sorgen macht?

Mal davon abgesehen, daß ein Rootkit-Check im laufenden System wenig Sinn machen sollte, aber da bin ich kein Experte.

Über Rootkits weiß ich nur, daß wenn sie GUT gemacht sind, man sie im laufenden System nicht FINDET (Stealth Mode).

Greetz,

RM

Nachtrag: Was macht man nicht alles für seine „Foren“-Schäfchen (AMEN _g_)

Hab mir eben auch chkrootkit installiert und über meine Kiste (SuSE 10.0) laufen lassen:

So sieht das bei mir aus:

```auto
ROOTDIR is `/'
Checking `amd'... not found
(gekürzt, ist mit Deinen Ausgaben identisch)

Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.7/i586-linux-thread-multi/.packlist /usr/lib/perl5/site_perl/5.8.7/i586-linux-thread-multi/auto/Video/DVDRip/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBD/SQLite/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bit/Vector/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/Pixbuf/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/ImlibImage/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/base/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/XmHTML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/GladeXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/IP/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/DNS/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/Daemon/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RPC/PlServer/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SaX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/SAX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/Common/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/NamespaceSupport/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/ycp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Carp/Clan/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Date/Calc/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Tagset/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Template/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/File/Find/Rule/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gaim/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Glib/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk2/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Mail/SpamAssassin/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PLog/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/X500/DN/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Text/Glob/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Config/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/HMAC/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Alien/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gnome/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XFree/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Number/Compare/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libintl-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libwww-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/TimeDate/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Xmms-Perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bootloader/.packlist /usr/lib/firefox/.autoreg /lib/modules/fglrx/build_mod/2.6.x/.agp3.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.nvidia-agp.o.d /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth1: PF_PACKET(/usr/sbin/wpa_supplicant)
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Checking `chkutmp'... The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID PID TTY CMD
! root 5248 tty7 /usr/X11R6/bin/X -br -nolisten tcp :0 vt7 -auth /var/lib/xdm/authdir/authfiles/A:0-g7dm1E
chkutmp: nothing deleted
```

Der nichtgefundene Prozess sieht mehr nach X-Server als nach Rootkit aus, das ist wohl schon OK so.

Da ich keine Serverdienste auf meinem Laptop anbiete, ist die Wahrscheinlichkeit, daß meine Kiste Rootkit-verseucht ist praktisch null. Vielleicht helfen Dir diese Daten weiter, wie zuverlässig allerdings so ein Check wirklich ist, kann ich nicht beurteilen aber ich zweifle die Effektivität doch an (siehe oben). Zumindest ein "neuartiges Rootkit kann das Programm wohl eher nicht erkennen, oder? Wenn ich die Suchroutine richtig verstehe (oder besser die Ausgaben von chkrootkit), dann sucht er nach bekannten Schadprogrammen.

---

<div class="post-metadata">

**Author:** ![rwkraemer](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/r/dbc845/32.png) [@rwkraemer](https://discourse.suseforum.de/u/rwkraemer)\
**Post date:** [11. April 2006 um 20:45 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/3 "2006-04-11T20:45:57Z")

</div>

AW: Seltsame Ausgabe von chkrootkit

Hallo,

vielen Dank für die schnelle Antwort. Tatsächlich hat mich abgesehen von den versteckten Dateien etwas beunruhigt, dass chkrootkit manches nicht testen konnte. Wahrscheinlich war es wirklich nur falscher Alarm.

---

<div class="post-metadata">

**Author:** ![rwkraemer](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/r/dbc845/32.png) [@rwkraemer](https://discourse.suseforum.de/u/rwkraemer)\
**Post date:** [11. April 2006 um 21:42 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/4 "2006-04-11T21:42:21Z")

</div>

AW: Seltsame Ausgabe von chkrootkit

Hallo,

es tut mir leid dass ich nochmal nerven muss, aber ich habe mal chkrootkit von einer knoppix live-cd aus laufen lassen. Dabei kam die Meldung find infected und top infected. Nachfolgend die ganye Ausgabe

root@ttyp0[hda2]# chkrootkit -r /mnt/hda2  
ROOTDIR is `/mnt/hda2/' Checking `amd’… not found  
Checking `basename'... not infected Checking `biff’… not found  
Checking `chfn'... not infected Checking `chsh’… not infected  
Checking `cron'... not infected Checking `date’… not infected  
Checking `du'... not infected Checking `dirname’… not infected  
Checking `echo'... not infected Checking `egrep’… not infected  
Checking `env'... not infected Checking `find’… INFECTED  
Checking `fingerd'... not found Checking `gpm’… not infected  
Checking `grep'... not infected Checking `hdparm’… not infected  
Checking `su'... not infected Checking `ifconfig’… not infected  
Checking `inetd'... not infected Checking `inetdconf’… not found  
Checking `identd'... not found Checking `init’… not infected  
Checking `killall'... not infected Checking `ldsopreload’… not infected  
Checking `login'... not infected Checking `ls’… not infected  
Checking `lsof'... not infected Checking `mail’… not infected  
Checking `mingetty'... not infected Checking `netstat’… not infected  
Checking `named'... not found Checking `passwd’… not infected  
Checking `pidof'... not infected Checking `pop2’… not found  
Checking `pop3'... not found Checking `ps’… not infected  
Checking `pstree'... not infected Checking `rpcinfo’… not infected  
Checking `rlogind'... not found Checking `rshd’… not found  
Checking `slogin'... not infected Checking `sendmail’… not infected  
Checking `sshd'... not infected Checking `syslogd’… not tested  
Checking `tar'... not infected Checking `tcpd’… not infected  
Checking `tcpdump'... not infected Checking `top’… INFECTED  
Checking `telnetd'... not found Checking `timed’… not found  
Checking `traceroute'... not infected Checking `vdir’… not infected  
Checking `w'... not infected Checking `write’… not infected  
Checking `aliens'... no suspect files Searching for sniffer's logs, it may take a while... nothing found Searching for HiDrootkit's default dir... nothing found Searching for t0rn's default files and dirs... nothing found Searching for t0rn's v8 defaults... nothing found Searching for Lion Worm default files and dirs... nothing found Searching for RSHA's default files and dir... nothing found Searching for RH-Sharpe's default files... nothing found Searching for Ambient's rootkit (ark) default files and dirs... nothing found Searching for suspicious files and dirs, it may take a while... /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /mnt/hda2/usr/lib/perl5/5.8.6/i586-linux-thread-multi/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Parser/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Config/Crontab/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/MD4/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/SDL_perl/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Locale/gettext/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs Searching for LPD Worm files and dirs... nothing found Searching for Ramen Worm files and dirs... nothing found Searching for Maniac files and dirs... nothing found Searching for RK17 files and dirs... nothing found Searching for Ducoci rootkit... nothing found Searching for Adore Worm... nothing found Searching for ShitC Worm... nothing found Searching for Omega Worm... nothing found Searching for Sadmind/IIS Worm... nothing found Searching for MonKit... nothing found Searching for Showtee... nothing found Searching for OpticKit... nothing found Searching for T.R.K... nothing found Searching for Mithra... nothing found Searching for OBSD rk v1... nothing found Searching for LOC rootkit ... nothing found Searching for Romanian rootkit ... nothing found Searching for Suckit rootkit ... nothing found Searching for Volc rootkit ... nothing found Searching for Gold2 rootkit ... nothing found Searching for TC2 Worm default files and dirs... nothing found Searching for Anonoying rootkit default files and dirs... nothing found Searching for ZK rootkit default files and dirs... nothing found Searching for ShKit rootkit default files and dirs... nothing found Searching for AjaKit rootkit default files and dirs... nothing found Searching for zaRwT rootkit default files and dirs... nothing found Searching for anomalies in shell history files... nothing found Checking `asp’… not infected  
Checking `bindshell'... not tested Checking `lkm’… not tested  
Checking `rexedcs'... not found Checking `sniffer’… not tested  
Checking `w55808'... not infected Checking `wted’… nothing deleted  
Checking `scalper'... not infected Checking `slapper’… not infected  
Checking `z2’… nothing deleted  
root@ttyp0[hda2]#

---

<div class="post-metadata">

**Author:** ![rwkraemer](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/r/dbc845/32.png) [@rwkraemer](https://discourse.suseforum.de/u/rwkraemer)\
**Post date:** [12. April 2006 um 03:18 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/5 "2006-04-12T03:18:43Z")

</div>

AW: Seltsame Ausgabe von chkrootkit

Hallo,

ich wollte nur sagen, dass ich das Problem gelöst habe. Bei dem zweiten Durchgang von chkrootkit mit einer Live-CD hatte ich eine ältere Knoppix-CD erwischt, wo eine ältere Version von chkrootkit mit einem Bug draufgewesen ist. Ein bischen googeln hat ergeben, dass diese Version bei „top“ und „find“ „infected“ anzeigen kann, obwohl nichts infiziert ist. Ich habe bei mir noch eine neue „Kantonix“-CD entdeckt und bei einem Durchgang von chkrootkit lief alles fehlerfrei. Auf jeden Fall wollte ich mich nochmal für die Hilfe bedanken.

---

<div class="post-metadata">

**Author:** ![spidy](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@spidy](https://discourse.suseforum.de/u/spidy)\
**Post date:** [12. April 2006 um 06:06 UTC](https://discourse.suseforum.de/t/geloest-seltsame-ausgabe-von-chkrootkit/475/6 "2006-04-12T06:06:07Z")

</div>

AW: Seltsame Ausgabe von chkrootkit

Und zu …