Chkrootkit LKM Trojan installed warning - What now?

More turbo geekiness: This be an article explaining how to properly react to chkrootkit scanner warning messages about malware infections by understanding how the system works, correlating results, testing with different kernels, examining services, startup scripts and the shell login, and more.

http://www.dedoimedo.com/computers/chkrootkit-lkm-warning.html


Cheers,
Mrk

 

"Your coffee mug resting by the keyboard is a greater threat to the longevity of your data than any evil virus."

 

Thanks for the info on these tools.

 

Good, useful article! Thank you, Mrk

 

Nice read, Mrk.

Thanks.

Later...

 

Yes, nice write up; Nietzsche would be pleased

Soon after having switched from Windows I thought it a good defensive measure to install rkhunter. Ran it and received several warnings, hidden files etc.

After some google research I soon found that they were all false positives and so whitelisted them in the rkhunter.conf file

There are usually none or very few database updates, but every new version throws up one or two new warnings - I make a point of googling them, and yes, false positives. I now only run it about once every other month - more for the thrill of seeing everything green/OK after whitelisting.

 

great job mrk keep writing )))


soon we see your name for Nobel Prize and IMPAC Dublin Award, Pulitzer Prize, for linux tweaks and turbo geekiness