Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : chkrootkit

[Luciano]

hi,

I run "chkrootkit" on one of my servers, because this machine seems to be hacked, and the result report is not too clear.

Does someone know another software to found possible root kits or infected binary files?

Thank you very much;

[runesolutions]

You could try rkhunter.

[mainarea]

Originally posted by Luciano
hi,

I run "chkrootkit" on one of my servers, because this machine seems to be hacked, and the result report is not too clear.

Does someone know another software to found possible root kits or infected binary files?

Thank you very much;

What is the output of chkrootkit?

- Matt

[pmabraham]

Greeings:

INFECTED, not infected, what's not too clear?

Though of note, cpanel will report port 465 infected when it is not.

http://www.rootkit.nl/ will probably have similar, technical, output.

Thank you.

[rsferreira]

Originally posted by dynamicnet
INFECTED, not infected, what's not too clear?

LOL. Pretty clear to me

[GideonX]

Paste the output if you are unsure what it says.

[eth00]

When in doubt you can also almost always google what is infected and find information If you post it here we can help as well.

[bidhata]

Some of script of cpanel and some perl modules give genarates error msg in chkrootkit. rkhunter is more better than that. Try to use that.

[Luciano]

After run "./chkrookit -p binarypath report"

It detect:

XX hidden process on Ps command
XX hidden process showdir (ls)
XX possible lkm installed

the problem is that this alerts disappears after rebooting the server. I was studying about that, and I noticed (http://www.chkrootkit.org) that this because "proc" activity, I'm running ENSIM pro over RedHat Enterprise, and like you know, there are to many "short" processes be written on this directory.

Thats why I want to run another software, to avoid false possitives.

Do you know another one?


<<Signature to be setup in your profile>>

[eth00]

Originally posted by disoft
You could try rkhunter.

As posted above rkhunter is what most people use with/instead of chkrootkit.

[linux-tech]

ditto for rkhunter, it's 100x better than chkrootkit, it checks binaries against md5, it checks various other stuff, crap that chkrootkit just forgets about.

As far as the output, how hard is it (really) to comprehend INFECTED/NOT INFECTED ? Admittedly 465 on a cpanel server (or most servers) will always show up as "infected", but the rest shouldn't at all.

If you get "INFECTED", then google it, it's your best bet.