Solved rkhunter

[fernandel]

I did run Rkhunter and I got:
/usr/local/sbin/pkg Warning
Suspect files: 1

pkg version is 2.6.2 and I dod no a problem with it.

Than run chkrootkit and I got:
Syslogk LKM rootkit... INFECTED: Possible Malicious Syslogk LKM rootkit installed
Checking `sniffer'... re0 is not promisc
re1 is not promisc
After running chkrootkit I have in /proc syslogk

What should I do, please. TY

 

[SirDice]

Thread 'Questions regarding chkrootkit and Syslogk LKM rootkit'

Jan 16, 2024

Hi

Did a random scan today with chkrootkit and rkhunter, chkrootkit gave me a warning:

"Searching for Syslogk LKM rootkit... INFECTED: Possible Malicious Syslogk LKM rootkit installed"

Anyone know anything about if this is normal error and can be ignored or if it can be something else?
I find just an empty file in /proc which says syslogk , haven't noticed anything earlier on incoming/outgoing traffic either but
haven't ran chkrootkit for a long while, have just run rkhunter.

Read a .pdf paper on it somewhere that it's difficult to discover since it hides very well etc.

• Lars Skogstad
• lkm security syslogk
• Replies: 28
• Forum: General

 

[fernandel]

Now I need to find what is wrong with rkhunter and pkg 2.6.2 which works normal as before.

 

[jbo@]

The security/rkhunter port has been removed from the ports tree a few week ago.
Upstream has been abandoned since 2009.

 

[T-Aoki]

The security/rkhunter port has been removed from the ports tree a few week ago.
Upstream has been abandoned since 2009.

security/rkhunter is removed last December.

 

[fernandel]

Than run chkrootkit and I got:
Syslogk LKM rootkit... INFECTED: Possible Malicious Syslogk LKM rootkit installed
Checking `sniffer'... re0 is not promisc
re1 is not promisc
After running chkrootkit I have in /proc syslogk

What should I do, please. TY

The problem is not mounted proc.
After mounted proc chkrootkit didn't find anything.

 

[Alain De Vos]

Note , there is ,

security/aide
security/lynis
security/vuls

 

[fernandel]

Note , there is ,

security/aide
security/lynis
security/vuls

I am using
security/lynis and mtree.