Arch Linux

jon.wulf

Member

Registered: 2009-07-03

Posts: 40

Chkrootkit and suspicious dirs in Mono

Hello all,

I habitually run chkrootkit each morning when I power on my PC just for paranoias sake. This morning it flagged up /usr/lib/mono/xbuild-frameworks/.NETFramework as a "suspicious directory".  I've run rkhunter and it found nothing abnormal and since I haven't installed anything lately that wasn't from the repos I'm not too worried. Just wondered if anyone else has had this occur and why it's cropped up now.

Regards,

Jon

jac

Member

From: /home/jac

Registered: 2009-05-19

Posts: 431

Website

Re: Chkrootkit and suspicious dirs in Mono

I would think it would be more likely that you didn't get a rootkit from installing something, but rather through some security breach. I haven't had it happen. Do you use mono? Can you see what is in that directory, to see if there are any executables you don't recognize, and which aren't owned by any package "pacman -Qo /usr/lib/.../blah"?

Edit: Misread O.P., I would still look into the directory to see what is in there, thought you said rkhunter did mark something. Something is being flagged by chkrootkit, anyway

Last edited by jac (2011-04-28 10:56:16)

jon.wulf

Member

Registered: 2009-07-03

Posts: 40

Re: Chkrootkit and suspicious dirs in Mono

I tried doing a pacman -Qo and it couldn't determine ownership. The directory itself contains folders:
v4.0  v3.5  v3.0  v2.0

If I issue tree:
[jon@Set .NETFramework]$ sudo tree
.
├── v2.0
│   └── RedistList
│       └── FrameworkList.xml
├── v3.0
│   └── RedistList
│       └── FrameworkList.xml
├── v3.5
│   └── RedistList
│       └── FrameworkList.xml
└── v4.0
    └── RedistList
        └── FrameworkList.xml

8 directories, 4 files

Edit:

It's just a desktop PC nothing like ssh or apache or such is installed. Mono was installed as a dependency of something since I have no memory of needing it.

Last edited by jon.wulf (2011-04-28 11:02:44)

jac

Member

From: /home/jac

Registered: 2009-05-19

Posts: 431

Website

Re: Chkrootkit and suspicious dirs in Mono

tree does not show hidden files (ones that start with a period). You may want to use "ls -AR" instead. None of those files look suspicious to me, but I'm not expert You can use "pacman -Qi" to see if anything depends on mono, and if not just remove it.

Also, if you have output from commands, you can use [code ] tags if it is long to save space.

jon.wulf

Member

Registered: 2009-07-03

Posts: 40

Re: Chkrootkit and suspicious dirs in Mono

It turns out that mono was required by software I used to use on Gnome 2 or no longer use at all. I uninstalled mono and deleted the folder that chkrootkit was flagging and everything seems fine now.
What it was actually picking up I still don't know. Thank you for the help jac.

ise

Developer

From: Karlsruhe / Germany

Registered: 2005-10-06

Posts: 404

Website

Re: Chkrootkit and suspicious dirs in Mono

They are included in mono 2.10.2-1 and are not suspicious in any direction.

$ pacman -Ql mono
...
mono /usr/lib/mono/xbuild-frameworks/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v2.0/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v2.0/RedistList/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v2.0/RedistList/FrameworkList.xml
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/RedistList/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/RedistList/FrameworkList.xml
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/RedistList/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/RedistList/FrameworkList.xml
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v4.0/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v4.0/RedistList/
mono /usr/lib/mono/xbuild-frameworks/.NETFramework/v4.0/RedistList/FrameworkList.xml
...

The only reason why chkrootkit maybe think that they are suspicious can be that the directory starts with a ".". But you must read it like "dotNet", the name of the framework "Microsoft .NET".

This is definitly a false alert.

Daniel

---

23 page
My blog

jon.wulf

Member

Registered: 2009-07-03

Posts: 40

Re: Chkrootkit and suspicious dirs in Mono

Ahhh, I see thanks for putting my mind at ease Daniel.