what does that mean (chkrootkit)?

sycamorex · 08-06-2009, 01:54 PM

I've just installed chkrootkit on my laptop and run it. Part of the output looks as follows:

Code:

...
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/java/.systemPrefs /usr/lib/java/.systemPrefs/.systemRootModFile /usr/lib/java/.systemPrefs/.system.lock /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Image/Magick/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/OBEXFTP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DBD/mysql/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Git/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Bundle/NetSNMP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/TextUI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/UI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/Irc/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DCOP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/XML/Simple/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/PDA/Pilot/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/SGMLS/.packlist /usr/lib/perl5/5.10.0/i486-linux-thread-multi/.packlist /usr/lib/firefox-3.0.13/.autoreg /usr/lib/php/.depdblock /usr/lib/php/.lock /usr/lib/php/.channels /usr/lib/php/.channels/.alias /usr/lib/php/.filemap /usr/lib/php/.registry /usr/lib/php/.registry/.channel.doc.php.net /usr/lib/php/.registry/.channel.pecl.php.net /usr/lib/php/.registry/.channel.__uri /usr/lib/php/.depdb /lib/modules/fglrx/build_mod/2.6.x/.kcl_str.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_pci.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_debug.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.libfglrx_ip.a.GCC4.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_ioctl.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions /lib/modules/fglrx/build_mod/2.6.x/.firegl_public.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_wait.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_acpi.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.mod.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_io.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_agp.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.ko.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.o.cmd
/usr/lib/java/.systemPrefs /usr/lib/php/.channels /usr/lib/php/.channels/.alias /usr/lib/php/.registry /usr/lib/php/.registry/.channel.doc.php.net /usr/lib/php/.registry/.channel.pecl.php.net /usr/lib/php/.registry/.channel.__uri /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
...

Does it mean that chkrootkit identified the above files/directories as suspicious?

EricTRA · 08-06-2009, 02:10 PM

Hello,

Definition of a rootkit http://en.wikipedia.org/wiki/Rootkit.

And basically what the chkrootkit is telling you that no rootkits are found on your system in the directories it checked.

Think of it as a sort of virus scanner, but for rootkits

If it finds nothing then it's a OK.

Also check their website

Kind regards,

Eric

sycamorex · 08-06-2009, 02:27 PM

Thanks for your reply. I understand the concept of rootkits. I was asking more about what this particular part of the output is telling me:

Code:

Searching for suspicious files and dirs, it may take a while...
/usr/lib/java/.systemPrefs /usr/lib/java/.systemPrefs/.systemRootModFile /usr/lib/java/.systemPrefs/.system.lock /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Image/Magick/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/OBEXFTP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DBD/mysql/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Git/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Bundle/NetSNMP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/TextUI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/UI/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/Irc/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/Irssi/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/DCOP/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/XML/Simple/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/PDA/Pilot/.packlist /usr/lib/perl5/vendor_perl/5.10.0/i486-linux-thread-multi/auto/SGMLS/.packlist /usr/lib/perl5/5.10.0/i486-linux-thread-multi/.packlist /usr/lib/firefox-3.0.13/.autoreg /usr/lib/php/.depdblock /usr/lib/php/.lock /usr/lib/php/.channels /usr/lib/php/.channels/.alias /usr/lib/php/.filemap /usr/lib/php/.registry /usr/lib/php/.registry/.channel.doc.php.net /usr/lib/php/.registry/.channel.pecl.php.net /usr/lib/php/.registry/.channel.__uri /usr/lib/php/.depdb /lib/modules/fglrx/build_mod/2.6.x/.kcl_str.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_pci.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_debug.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.libfglrx_ip.a.GCC4.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_ioctl.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions /lib/modules/fglrx/build_mod/2.6.x/.firegl_public.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_wait.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_acpi.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.mod.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_io.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.kcl_agp.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.ko.cmd /lib/modules/fglrx/build_mod/2.6.x/.fglrx.o.cmd
/usr/lib/java/.systemPrefs /usr/lib/php/.channels /usr/lib/php/.channels/.alias /usr/lib/php/.registry /usr/lib/php/.registry/.channel.doc.php.net /usr/lib/php/.registry/.channel.pecl.php.net /usr/lib/php/.registry/.channel.__uri /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
Searching for LPD Worm files and dirs... nothing found

EricTRA · 08-06-2009, 02:33 PM

Sorry for the misunderstanding sycamorex. Those results are what chkrootkit detects as 'suspicious' although I've had 'false' alarms in the past with quite a few files also. You might want to check the contents of some of those files to see for 'strange' content.
Lock files like /usr/lib/java/.systemPrefs/.system.lock are for sure false alarms.

Kind regards,

Eric

sycamorex · 08-07-2009, 04:34 AM

Thanks, that's what I thought. I checked some of those files and it did not look suspicious to me (not that I'd know what to look for, LOL)