Thema: (Gelöst) Seltsame Ausgabe von chkrootkit

Hallo,

ich habe auf meinem Rechner Suse 9.3 und habe einmal chkrootkit drüberlaufen lassen. Dabei kamen einige seltsame Ausgaben. Nun würde ich gerne wissen, ob das nur ein "false postitive" war oder tatsächlich ein Angriff auf meinen Rechner. Nachfolgend die Ausgabe von chkrootkit. Vielen Dank im Voraus. Ich hoffe, jemand kann mir helfen.

linux:/home/rainer # chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not tested
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not tested
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-su
n-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2
.11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.6/i586-linux-thread-multi/.
packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot
/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Par
ser/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/
.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.pa
cklist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packl
ist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist
/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist
/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.pac
klist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLin
e/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Co
nfig/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/
auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-mul
ti/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread
-multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-
thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i586-linux
-thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.6/i
586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/
5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... Checking `rexedcs'... not found
Checking `sniffer'... not tested: can't exec ./ifpromisc
Checking `w55808'... not infected
Checking `wted'... not tested: can't exec ./chkwtmp
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... not tested: can't exec ./chklastlog

Zitat von rwkraemer

Hallo,

ich habe auf meinem Rechner Suse 9.3 und habe einmal chkrootkit drüberlaufen lassen. Dabei kamen einige seltsame Ausgaben. Nun würde ich gerne wissen, ob das nur ein "false postitive" war oder tatsächlich ein Angriff auf meinen Rechner. Nachfolgend die Ausgabe von chkrootkit. Vielen Dank im Voraus. Ich hoffe, jemand kann mir helfen.

.... (aus Platzgründen weggelassen)

Wo genau bitte liegt Dein Problem/Deine Sorge?

Die Dateien, die oben untersucht werden sind PERL-Module und JAVA-Files.

Verschiedene Dinge kann er nicht testen, ist es das, was Dir Sorgen macht?

Mal davon abgesehen, daß ein Rootkit-Check im laufenden System wenig Sinn machen sollte, aber da bin ich kein Experte.

Über Rootkits weiß ich nur, daß wenn sie GUT gemacht sind, man sie im laufenden System nicht FINDET (Stealth Mode).


Greetz,

RM

Nachtrag: Was macht man nicht alles für seine "Foren"-Schäfchen (AMEN *g*)

Hab mir eben auch chkrootkit installiert und über meine Kiste (SuSE 10.0) laufen lassen:

So sieht das bei mir aus:

Code:

ROOTDIR is `/'
Checking `amd'... not found
(gekürzt, ist mit Deinen Ausgaben identisch)

Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /usr/lib/perl5/5.8.7/i586-linux-thread-multi/.packlist /usr/lib/perl5/site_perl/5.8.7/i586-linux-thread-multi/auto/Video/DVDRip/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBD/SQLite/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/DBI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bit/Vector/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/Pixbuf/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/Gdk/ImlibImage/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/base/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/XmHTML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk/GladeXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/IP/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/DNS/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Net/Daemon/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RPC/PlServer/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SaX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/URI/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/SAX/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/Common/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/LibXML/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XML/NamespaceSupport/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/ycp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Carp/Clan/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Date/Calc/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Parser/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Tagset/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/HTML/Template/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/File/Find/Rule/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gaim/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Glib/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gtk2/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Mail/SpamAssassin/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/PLog/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDp/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/RRDs/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/X500/DN/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Text/Glob/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Config/Crontab/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/MD4/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/HMAC/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Alien/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Gnome/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/SDL_perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/XFree/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Locale/gettext/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Number/Compare/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libintl-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/libwww-perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/TimeDate/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Xmms-Perl/.packlist /usr/lib/perl5/vendor_perl/5.8.7/i586-linux-thread-multi/auto/Bootloader/.packlist /usr/lib/firefox/.autoreg /lib/modules/fglrx/build_mod/2.6.x/.agp3.o.cmd /lib/modules/fglrx/build_mod/2.6.x/.nvidia-agp.o.d /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /lib/modules/fglrx/build_mod/2.6.x/.tmp_versions
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... chkproc: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... eth1: PF_PACKET(/usr/sbin/wpa_supplicant)
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
Checking `chkutmp'...  The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! root         5248 tty7   /usr/X11R6/bin/X -br -nolisten tcp :0 vt7 -auth /var/lib/xdm/authdir/authfiles/A:0-g7dm1E
chkutmp: nothing deleted

Der nichtgefundene Prozess sieht mehr nach X-Server als nach Rootkit aus, das ist wohl schon OK so.

Da ich keine Serverdienste auf meinem Laptop anbiete, ist die Wahrscheinlichkeit, daß meine Kiste Rootkit-verseucht ist praktisch null. Vielleicht helfen Dir diese Daten weiter, wie zuverlässig allerdings so ein Check wirklich ist, kann ich nicht beurteilen aber ich zweifle die Effektivität doch an (siehe oben). Zumindest ein "neuartiges Rootkit kann das Programm wohl eher nicht erkennen, oder? Wenn ich die Suchroutine richtig verstehe (oder besser die Ausgaben von chkrootkit), dann sucht er nach bekannten Schadprogrammen.

Hallo,

vielen Dank für die schnelle Antwort. Tatsächlich hat mich abgesehen von den versteckten Dateien etwas beunruhigt, dass chkrootkit manches nicht testen konnte. Wahrscheinlich war es wirklich nur falscher Alarm.

Hallo,

es tut mir leid dass ich nochmal nerven muss, aber ich habe mal chkrootkit von einer knoppix live-cd aus laufen lassen. Dabei kam die Meldung find infected und top infected. Nachfolgend die ganye Ausgabe

root@ttyp0[hda2]# chkrootkit -r /mnt/hda2
ROOTDIR is `/mnt/hda2/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... INFECTED
Checking `fingerd'... not found
Checking `gpm'... not infected
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not found
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not infected
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not infected
Checking `syslogd'... not tested
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... INFECTED
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not infected
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while...
/mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.systemRootModFile /mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs/.system.lock /mnt/hda2/usr/lib/perl5/5.8.6/i586-linux-thread-multi/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/PDA/Pilot/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/XML/Parser/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/ycp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Gaim/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDp/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/RRDs/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/X500/DN/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadKey/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Term/ReadLine/Gnu/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Config/Crontab/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/MD4/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Digest/SHA1/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Crypt/SmbHash/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/SDL_perl/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Parse/RecDescent/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Locale/gettext/.packlist /mnt/hda2/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/auto/Bootloader/.packlist
/mnt/hda2/usr/lib/jvm/java-1.4.2-sun-1.4.2.11/jre/.systemPrefs
Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... nothing found
Searching for LOC rootkit ... nothing found
Searching for Romanian rootkit ... nothing found
Searching for Suckit rootkit ... nothing found
Searching for Volc rootkit ... nothing found
Searching for Gold2 rootkit ... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not tested
Checking `lkm'... not tested
Checking `rexedcs'... not found
Checking `sniffer'... not tested
Checking `w55808'... not infected
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... nothing deleted
root@ttyp0[hda2]#

Hallo,

ich wollte nur sagen, dass ich das Problem gelöst habe. Bei dem zweiten Durchgang von chkrootkit mit einer Live-CD hatte ich eine ältere Knoppix-CD erwischt, wo eine ältere Version von chkrootkit mit einem Bug draufgewesen ist. Ein bischen googeln hat ergeben, dass diese Version bei "top" und "find" "infected" anzeigen kann, obwohl nichts infiziert ist. Ich habe bei mir noch eine neue "Kantonix"-CD entdeckt und bei einem Durchgang von chkrootkit lief alles fehlerfrei. Auf jeden Fall wollte ich mich nochmal für die Hilfe bedanken.

Und zu ...