rkhunter found adore rootkit, or did it?

Ben9250 · 2011-05-03 23:56:26

Hi, I had just installed rkhunter on my box and run the command to first establish the file database, (but did not use any pkgmgr option, as far as I'm aware pacman doesn't fall into either of the categories of package management), and then ran the check, it flagged a few files / directories as suspicious and told me the adore rootkit was detected. I was wondering if anyone else had this problem before or if I need to do anything else with rkhunter before I wipe my drive and reinstall - which was my initial gut feeling.

Cheers,
Ben.

Allan · 2011-05-03 23:58:56

My guess is that it detected a file in the heimdal package? rkhunter is just saying that is the adore rootkit based on its file name - nothing else...

Ben9250 · 2011-05-04 00:10:56

It could be, I'm looking at it now, as I hadn't heard of heimdal until now. I'm also going to double check with chkrootkit shortly. I must say I was suprised, not that someone smarter than myself at computers had taken a peek at my machine, but that they might bother installing anything like a rootkit to gain easier access in the future, it's got nothing of value on it at all. At least if it is heimdal I will know in future for when I convert an old tower of mine into a minecraft server for me and my friends - don't want to be responsible for any harm to their machines, or any undue panic either.

karol · 2011-05-04 09:53:29

https://bbs.archlinux.org/viewtopic.php … 25#p672725
https://bbs.archlinux.org/viewtopic.php … 30#p696130

Arch Linux

#1 2011-05-03 23:56:26

rkhunter found adore rootkit, or did it?

#2 2011-05-03 23:58:56

Re: rkhunter found adore rootkit, or did it?

#3 2011-05-04 00:10:56

Re: rkhunter found adore rootkit, or did it?

#4 2011-05-04 09:53:29

Re: rkhunter found adore rootkit, or did it?

Board footer