Sample Header Ad - 728x90

Chkrootkit found a lot of suspicious files and directories, and /sbin/init INFECTED

2 votes
1 answer
3928 views
I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system? Here are the suspect files and directories: Searching for suspicious files and dirs, it may take a while... /usr/lib/.libgcrypt.so.11.hmac /usr/lib/python2.7/site-packages/martian /testswithbogusmodules/.bogussubpackage /usr/lib/python2.7/site-packages/fail2ban /tests/files/config/apache-auth/digest_time/.htaccess /usr/lib/python2.7/site- packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd /usr/lib /python2.7/site-packages/fail2ban/tests/files/config/apache-auth/noentry /.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache- auth/basic/file/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files /config/apache-auth/basic/file/.htpasswd /usr/lib/python2.7/site-packages/fail2ban /tests/files/config/apache-auth/basic/authz_owner/.htaccess /usr/lib/python2.7 /site-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner /.htpasswd /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache- auth/digest_anon/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files /config/apache-auth/digest_anon/.htpasswd /usr/lib/python2.7/site-packages /fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess /usr/lib /python2.7/site-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm /.htpasswd /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache- auth/digest/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files/config /apache-auth/digest/.htpasswd /usr/lib/python2.7/site-packages/pylons/docs/en /.gitignore /usr/lib/python2.7/site-packages/pylons/templates/default_project /+package+/templates/.distutils_placeholder /usr/lib/python2.7/site-packages /pylons/templates/minimal_project/+package+/templates/.distutils_placeholder /usr/lib/.libssl.so.1.0.1e.hmac /usr/lib/.libcrypto.so.1.0.1e.hmac /usr/lib /.libssl.so.10.hmac /usr/lib/debug/.build-id /usr/lib/debug/usr/.dwz /usr/lib /debug/.dwz /usr/lib/mono/xbuild-frameworks/.NETFramework /usr/lib /.libcrypto.so.10.hmac /usr/lib/python2.7/site-packages/martian/tests/withbogusmodules /.bogussubpackage /usr/lib/debug/.build-id /usr/lib/debug/.dwz /usr/lib /mono/xbuild-frameworks/.NETFramework ------------ And then there was this: Searching for Suckit rootkit... Warning: /sbin/init INFECTED ------------ Finally: Checking `chkutmp'... The tty of the following user process(es) were not found in /var/run/utmp ! ! RUID PID TTY CMD ! root 1631 tty1 /usr/bin/X :0 vt1 -background none -nolisten tcp -seat seat0 -auth /var/run/kdm/A:0-EiPPra chkutmp: nothing deleted Checking `OSX_RSPLUG'... not infected
Asked by somethingSomething (6209 rep)
Sep 3, 2014, 12:21 PM
Last activity: May 3, 2018, 10:33 AM