You are not logged in.

#1 2015-06-06 16:48:16

adoksl
Member
Registered: 2015-06-06
Posts: 7

DNS malware and dhcpcd

Hello there!

Lately, my Arch installation began to show a suspicious behavior. While browsing the internet, I was encountering Russian ads and was being randomly redirected to spam pages and pop-ups. The symptoms are just like these ones, but I obviously couldn't follow their fixing instructions for Windows.

I did some investigation myself into this problem and found out my /etc/resolv.conf was defined as the following one:

# Generated by dhcpcd from wlp3s0.dhcp
# /etc/resolv.conf.head can replace this line
nameserver 89.248.166.149
nameserver 8.8.8.8
# /etc/resolv.conf.tail can replace this line

Note that the first nameserver belongs to a DNS blacklist and that the guy from the link above also had this DNS server in his configuration.

If I try to delete this unwanted nameserver from the file, it wouldn't fix the problem, as the file resets to the malicious one as soon as the DHCP is reset, e.g. with a systemctl restart dhcpcd. The problem happens solely in my Linux installation, as the Windows in dual-boot does not behave this way. The router settings are also intact. It seems, then, my OS is infected with a kind of malware capable of editing my own settings.

Any suggestions? I've got no idea of how to deal with this situation.

Thank you in advance!

Offline

#2 2015-06-06 16:56:32

ewaller
Administrator
From: Pasadena, CA
Registered: 2009-07-13
Posts: 17,345

Re: DNS malware and dhcpcd

Wow.
Do you have a file called /etc/resolv.conf.head ? What are its contents?
Take a look at  /usr/lib/dhcpcd/dhcpcd-hooks/20-resolv.conf   Has it been modified?  You might read through it and see if it is doing anything evil.  It writes the /etc/resolv.conf file.

You might also install and run a tool that checks for rootkits.


Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

Offline

#3 2015-06-06 17:34:20

Vain
Member
Registered: 2008-10-19
Posts: 179
Website

Re: DNS malware and dhcpcd

Hmm... suppose your DHCP server got hijacked and it now just pushes that nameserver to your box. Wouldn't that explain your problem? Maybe you're not using DHCP on Windows?

To get more information, you could run this and post the output:

sudo dhcpcd -T wlp3s0

Last edited by Vain (2015-06-06 17:37:49)

Offline

#4 2015-06-06 17:35:48

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

Hey, thank you for answering!

ewaller wrote:

Do you have a file called /etc/resolv.conf.head ? What are its contents?

No, I don't have this file. I also don't have a /etc/resolv.conf.tail.

ewaller wrote:

Take a look at  /usr/lib/dhcpcd/dhcpcd-hooks/20-resolv.conf   Has it been modified?  You might read through it and see if it is doing anything evil.  It writes the /etc/resolv.conf file.

This file hasn't been modified since the last month, which leads us to conclude it hasn't been affected by the malware. It seems to be doing its job properly, as I haven't found anything abnormal from what I saw.

ewaller wrote:

You might also install and run a tool that checks for rootkits.

Hmm, unfortunately the complete report of a rkhunter scan doesn't identify any rootkit in my system:

[14:20:14] Running Rootkit Hunter version 1.4.2 on hal
[14:20:14]
[14:20:14] Info: Start date is Sat Jun  6 14:20:14 BRT 2015
[14:20:14]
[14:20:14] Checking configuration file and command-line options...
[14:20:14] Info: Detected operating system is 'Linux'
[14:20:14] Info: Uname output is 'Linux hal 4.0.4-2-ARCH #1 SMP PREEMPT Fri May 22 03:05:23 UTC 2015 x86_64 GNU/Linux'
[14:20:14] Info: Command line is /usr/bin/rkhunter -c
[14:20:14] Info: Environment shell is /bin/bash; rkhunter is using bash
[14:20:14] Info: Using configuration file '/etc/rkhunter.conf'
[14:20:14] Info: Installation directory is '/usr'
[14:20:14] Info: Using language 'en'
[14:20:14] Info: Using '/var/lib/rkhunter/db' as the database directory
[14:20:14] Info: Using '/usr/lib/rkhunter/scripts' as the support script directory
[14:20:14] Info: Using '/usr/local/sbin /usr/local/bin /usr/bin /usr/lib/jvm/default/bin /usr/bin/site_perl /usr/bin/vendor_perl /usr/bin/core_perl /bin /sbin /usr/sbin' as the command directories
[14:20:14] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
[14:20:14] Info: No mail-on-warning address configured
[14:20:14] Info: X will be automatically detected
[14:20:14] Info: Using second color set
[14:20:14] Info: Found the 'basename' command: /usr/bin/basename
[14:20:14] Info: Found the 'diff' command: /usr/bin/diff
[14:20:15] Info: Found the 'dirname' command: /usr/bin/dirname
[14:20:15] Info: Found the 'file' command: /usr/bin/file
[14:20:15] Info: Found the 'find' command: /usr/bin/find
[14:20:15] Info: Found the 'ifconfig' command: /usr/bin/ifconfig
[14:20:15] Info: Found the 'ip' command: /usr/bin/ip
[14:20:15] Info: Found the 'ipcs' command: /usr/bin/ipcs
[14:20:15] Info: Found the 'ldd' command: /usr/bin/ldd
[14:20:15] Info: Found the 'lsattr' command: /usr/bin/lsattr
[14:20:15] Info: Found the 'lsmod' command: /usr/bin/lsmod
[14:20:15] Info: Found the 'lsof' command: /usr/bin/lsof
[14:20:15] Info: Found the 'mktemp' command: /usr/bin/mktemp
[14:20:15] Info: Found the 'netstat' command: /usr/bin/netstat
[14:20:15] Info: Found the 'perl' command: /usr/bin/perl
[14:20:15] Info: Found the 'pgrep' command: /usr/bin/pgrep
[14:20:15] Info: Found the 'ps' command: /usr/bin/ps
[14:20:15] Info: Found the 'pwd' command: /usr/bin/pwd
[14:20:15] Info: Found the 'readlink' command: /usr/bin/readlink
[14:20:15] Info: Found the 'stat' command: /usr/bin/stat
[14:20:15] Info: Found the 'strings' command: /usr/bin/strings
[14:20:15] Info: System is not using prelinking
[14:20:15] Info: Using the '/usr/bin/sha1sum' command for the file hash checks
[14:20:15] Info: The hash function field index is set to 1
[14:20:15] Info: No package manager specified: using hash function '/usr/bin/sha1sum'
[14:20:15] Info: Previous file attributes were stored
[14:20:15] Info: Enabled tests are: all
[14:20:15] Info: Disabled tests are: suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
[14:20:15] Info: Including user files for file properties check:
[14:20:15]       /etc/rkhunter.conf
[14:20:15] Info: Found ksym file '/proc/kallsyms'
[14:20:15] Info: Using 'date' to process epoch second times
[14:20:15] Info: Locking is not being used
[14:20:15]
[14:20:15] Starting system checks...
[14:20:15]
[14:20:15] Info: Starting test name 'system_commands'
[14:20:15] Checking system commands...
[14:20:15]
[14:20:15] Info: Starting test name 'strings'
[14:20:15] Performing 'strings' command checks
[14:20:15]   Scanning for string /usr/sbin/ntpsx             [ OK ]
[14:20:15]   Scanning for string /usr/sbin/.../bkit-ava      [ OK ]
[14:20:15]   Scanning for string /usr/sbin/.../bkit-d        [ OK ]
[14:20:15]   Scanning for string /usr/sbin/.../bkit-shd      [ OK ]
[14:20:15]   Scanning for string /usr/sbin/.../bkit-f        [ OK ]
[14:20:15]   Scanning for string /usr/include/.../proc.h     [ OK ]
[14:20:15]   Scanning for string /usr/include/.../.bash_history [ OK ]
[14:20:15]   Scanning for string /usr/include/.../bkit-get   [ OK ]
[14:20:15]   Scanning for string /usr/include/.../bkit-dl    [ OK ]
[14:20:16]   Scanning for string /usr/include/.../bkit-screen [ OK ]
[14:20:16]   Scanning for string /usr/include/.../bkit-sleep [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-adore.o   [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../ls             [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../netstat        [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../lsof           [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shdcfg [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shhk [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh/bkit-pw [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh/bkit-shrs [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh/bkit-mots [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../uconf.inv      [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../psr            [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../find           [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../pstree         [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../slocate        [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../du             [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../top            [ OK ]
[14:20:16]   Scanning for string /usr/sbin/...               [ OK ]
[14:20:16]   Scanning for string /usr/include/...            [ OK ]
[14:20:16]   Scanning for string /usr/include/.../.tmp       [ OK ]
[14:20:16]   Scanning for string /usr/lib/...                [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../.ssh           [ OK ]
[14:20:16]   Scanning for string /usr/lib/.../bkit-ssh       [ OK ]
[14:20:16]   Scanning for string /usr/lib/.bkit-             [ OK ]
[14:20:16]   Scanning for string /tmp/.bkp                   [ OK ]
[14:20:16]   Scanning for string /tmp/.cinik                 [ OK ]
[14:20:16]   Scanning for string /tmp/.font-unix/.cinik      [ OK ]
[14:20:16]   Scanning for string /lib/.sso                   [ OK ]
[14:20:16]   Scanning for string /lib/.so                    [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/clean      [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/dxr        [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/read       [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/write      [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/lf         [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/xl         [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/xdr        [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/psg        [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/secure     [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/rdx        [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/va         [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/cl.sh      [ OK ]
[14:20:17]   Scanning for string /var/run/...dica/last.log   [ OK ]
[14:20:17]   Scanning for string /usr/bin/.etc               [ OK ]
[14:20:17]   Scanning for string /etc/sshd_config            [ OK ]
[14:20:17]   Scanning for string /etc/ssh_host_key           [ OK ]
[14:20:17]   Scanning for string /etc/ssh_random_seed        [ OK ]
[14:20:17]   Scanning for string /dev/ptyp                   [ OK ]
[14:20:17]   Scanning for string /dev/ptyq                   [ OK ]
[14:20:17]   Scanning for string /dev/ptyr                   [ OK ]
[14:20:17]   Scanning for string /dev/ptys                   [ OK ]
[14:20:17]   Scanning for string /dev/ptyt                   [ OK ]
[14:20:17]   Scanning for string /dev/fd/.88/freshb-bsd      [ OK ]
[14:20:17]   Scanning for string /dev/fd/.88/fresht          [ OK ]
[14:20:17]   Scanning for string /dev/fd/.88/zxsniff         [ OK ]
[14:20:17]   Scanning for string /dev/fd/.88/zxsniff.log     [ OK ]
[14:20:17]   Scanning for string /dev/fd/.99/.ttyf00         [ OK ]
[14:20:17]   Scanning for string /dev/fd/.99/.ttyp00         [ OK ]
[14:20:17]   Scanning for string /dev/fd/.99/.ttyq00         [ OK ]
[14:20:17]   Scanning for string /dev/fd/.99/.ttys00         [ OK ]
[14:20:18]   Scanning for string /dev/fd/.99/.pwsx00         [ OK ]
[14:20:18]   Scanning for string /etc/.acid                  [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/sched_host.2   [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/random_d.2     [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/set_pid.2      [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/setrgrp.2      [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/TOHIDE         [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/cons.saver     [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/adore/ava/ava  [ OK ]
[14:20:18]   Scanning for string /usr/lib/.fx/adore/adore/adore.ko [ OK ]
[14:20:18]   Scanning for string /bin/sysback                [ OK ]
[14:20:18]   Scanning for string /usr/local/bin/sysback      [ OK ]
[14:20:18]   Scanning for string /usr/lib/.tbd               [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/t0rns     [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/du        [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/ls        [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/t0rnsb    [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/ps        [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/t0rnp     [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/find      [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/ifconfig  [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/pg        [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/ssh.tgz   [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/top       [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/sz        [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/login     [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/in.fingerd [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/1i0n.sh   [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/pstree    [ OK ]
[14:20:18]   Scanning for string /dev/.lib/lib/lib/in.telnetd [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/mjy       [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/sush      [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/tfn       [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/name      [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/getip.sh  [ OK ]
[14:20:19]   Scanning for string /usr/info/.torn/sh*         [ OK ]
[14:20:19]   Scanning for string /usr/src/.puta/.1addr       [ OK ]
[14:20:19]   Scanning for string /usr/src/.puta/.1file       [ OK ]
[14:20:19]   Scanning for string /usr/src/.puta/.1proc       [ OK ]
[14:20:19]   Scanning for string /usr/src/.puta/.1logz       [ OK ]
[14:20:19]   Scanning for string /usr/info/.t0rn             [ OK ]
[14:20:19]   Scanning for string /dev/.lib                   [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib               [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib           [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/lib/dev       [ OK ]
[14:20:19]   Scanning for string /dev/.lib/lib/scan          [ OK ]
[14:20:19]   Scanning for string /usr/src/.puta              [ OK ]
[14:20:19]   Scanning for string /usr/man/man1/man1          [ OK ]
[14:20:19]   Scanning for string /usr/man/man1/man1/lib      [ OK ]
[14:20:19]   Scanning for string /usr/man/man1/man1/lib/.lib [ OK ]
[14:20:19]   Scanning for string /usr/man/man1/man1/lib/.lib/.backup [ OK ]
[14:20:19]
[14:20:19] Info: Starting test name 'shared_libs'
[14:20:19] Performing 'shared libraries' checks
[14:20:19]   Checking for preloading variables               [ None found ]
[14:20:19]   Checking for preloaded libraries                [ None found ]
[14:20:19]
[14:20:19] Info: Starting test name 'shared_libs_path'
[14:20:19]   Checking LD_LIBRARY_PATH variable               [ Not found ]
[14:20:19]
[14:20:19] Info: Starting test name 'properties'
[14:20:20] Performing file properties checks
[14:20:20] Warning: Checking for prerequisites               [ Warning ]
[14:20:20]          The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --propupd'.
[14:20:20] Info: The file properties check will still run as there are checks that can be performed without the 'rkhunter.dat' file.
[14:20:20]
[14:20:20] Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
           is used, all the files on their system are known to be genuine, and installed from a
           reliable source. The rkhunter '--check' option will compare the current file properties
           against previously stored values, and report if any values differ. However, rkhunter
           cannot determine what has caused the change, that is for the user to do.
[14:20:21]   /usr/bin/awk                                    [ OK ]
[14:20:21]   /usr/bin/basename                               [ OK ]
[14:20:21]   /usr/bin/bash                                   [ OK ]
[14:20:21]   /usr/bin/cat                                    [ OK ]
[14:20:22]   /usr/bin/chattr                                 [ OK ]
[14:20:22]   /usr/bin/chmod                                  [ OK ]
[14:20:22]   /usr/bin/chown                                  [ OK ]
[14:20:22]   /usr/bin/chroot                                 [ OK ]
[14:20:22]   /usr/bin/cp                                     [ OK ]
[14:20:22]   /usr/bin/curl                                   [ OK ]
[14:20:22]   /usr/bin/cut                                    [ OK ]
[14:20:22]   /usr/bin/date                                   [ OK ]
[14:20:22]   /usr/bin/depmod                                 [ OK ]
[14:20:22]   /usr/bin/df                                     [ OK ]
[14:20:22]   /usr/bin/diff                                   [ OK ]
[14:20:22]   /usr/bin/dirname                                [ OK ]
[14:20:22]   /usr/bin/dmesg                                  [ OK ]
[14:20:22]   /usr/bin/du                                     [ OK ]
[14:20:22]   /usr/bin/echo                                   [ OK ]
[14:20:23]   /usr/bin/egrep                                  [ Warning ]
[14:20:23] Warning: The command '/usr/bin/egrep' has been replaced by a script: /usr/bin/egrep: POSIX shell script, ASCII text executable
[14:20:23]   /usr/bin/env                                    [ OK ]
[14:20:23]   /usr/bin/fgrep                                  [ Warning ]
[14:20:23] Warning: The command '/usr/bin/fgrep' has been replaced by a script: /usr/bin/fgrep: POSIX shell script, ASCII text executable
[14:20:23]   /usr/bin/file                                   [ OK ]
[14:20:23]   /usr/bin/find                                   [ OK ]
[14:20:23]   /usr/bin/fsck                                   [ OK ]
[14:20:23]   /usr/bin/fuser                                  [ OK ]
[14:20:23]   /usr/bin/grep                                   [ OK ]
[14:20:23]   /usr/bin/groupadd                               [ OK ]
[14:20:23]   /usr/bin/groupdel                               [ OK ]
[14:20:23]   /usr/bin/groupmod                               [ OK ]
[14:20:23]   /usr/bin/groups                                 [ OK ]
[14:20:23]   /usr/bin/grpck                                  [ OK ]
[14:20:23]   /usr/bin/head                                   [ OK ]
[14:20:23]   /usr/bin/id                                     [ OK ]
[14:20:24]   /usr/bin/ifconfig                               [ OK ]
[14:20:24]   /usr/bin/init                                   [ OK ]
[14:20:24]   /usr/bin/insmod                                 [ OK ]
[14:20:24]   /usr/bin/ip                                     [ OK ]
[14:20:24]   /usr/bin/kill                                   [ OK ]
[14:20:24]   /usr/bin/killall                                [ OK ]
[14:20:24]   /usr/bin/last                                   [ OK ]
[14:20:24]   /usr/bin/lastlog                                [ OK ]
[14:20:24]   /usr/bin/ldd                                    [ Warning ]
[14:20:24] Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script, ASCII text executable
[14:20:24]   /usr/bin/less                                   [ OK ]
[14:20:24]   /usr/bin/logger                                 [ OK ]
[14:20:24]   /usr/bin/login                                  [ OK ]
[14:20:24]   /usr/bin/ls                                     [ OK ]
[14:20:24]   /usr/bin/lsattr                                 [ OK ]
[14:20:24]   /usr/bin/lsmod                                  [ OK ]
[14:20:25]   /usr/bin/lsof                                   [ OK ]
[14:20:25]   /usr/bin/mail                                   [ OK ]
[14:20:25]   /usr/bin/md5sum                                 [ OK ]
[14:20:25]   /usr/bin/mktemp                                 [ OK ]
[14:20:25]   /usr/bin/modinfo                                [ OK ]
[14:20:25]   /usr/bin/modprobe                               [ OK ]
[14:20:25]   /usr/bin/more                                   [ OK ]
[14:20:25]   /usr/bin/mount                                  [ OK ]
[14:20:25]   /usr/bin/mv                                     [ OK ]
[14:20:25]   /usr/bin/netstat                                [ OK ]
[14:20:25]   /usr/bin/newgrp                                 [ OK ]
[14:20:25]   /usr/bin/nologin                                [ OK ]
[14:20:25]   /usr/bin/passwd                                 [ OK ]
[14:20:25]   /usr/bin/perl                                   [ OK ]
[14:20:25]   /usr/bin/pgrep                                  [ OK ]
[14:20:26]   /usr/bin/ping                                   [ OK ]
[14:20:26]   /usr/bin/pkill                                  [ OK ]
[14:20:26]   /usr/bin/ps                                     [ OK ]
[14:20:26]   /usr/bin/pstree                                 [ OK ]
[14:20:26]   /usr/bin/pwck                                   [ OK ]
[14:20:26]   /usr/bin/pwd                                    [ OK ]
[14:20:26]   /usr/bin/readlink                               [ OK ]
[14:20:26]   /usr/bin/rkhunter                               [ OK ]
[14:20:26]   /usr/bin/rmmod                                  [ OK ]
[14:20:26]   /usr/bin/route                                  [ OK ]
[14:20:26]   /usr/bin/runcon                                 [ OK ]
[14:20:26]   /usr/bin/runlevel                               [ OK ]
[14:20:26]   /usr/bin/sed                                    [ OK ]
[14:20:26]   /usr/bin/sh                                     [ OK ]
[14:20:26]   /usr/bin/sha1sum                                [ OK ]
[14:20:27]   /usr/bin/sha224sum                              [ OK ]
[14:20:27]   /usr/bin/sha256sum                              [ OK ]
[14:20:27]   /usr/bin/sha384sum                              [ OK ]
[14:20:27]   /usr/bin/sha512sum                              [ OK ]
[14:20:27]   /usr/bin/size                                   [ OK ]
[14:20:27]   /usr/bin/sort                                   [ OK ]
[14:20:27]   /usr/bin/ssh                                    [ OK ]
[14:20:27]   /usr/bin/sshd                                   [ OK ]
[14:20:27]   /usr/bin/stat                                   [ OK ]
[14:20:27]   /usr/bin/strings                                [ OK ]
[14:20:27]   /usr/bin/su                                     [ OK ]
[14:20:27]   /usr/bin/sudo                                   [ OK ]
[14:20:27]   /usr/bin/sulogin                                [ OK ]
[14:20:27]   /usr/bin/sysctl                                 [ OK ]
[14:20:27]   /usr/bin/tail                                   [ OK ]
[14:20:28]   /usr/bin/telnet                                 [ OK ]
[14:20:28]   /usr/bin/test                                   [ OK ]
[14:20:28]   /usr/bin/top                                    [ OK ]
[14:20:28]   /usr/bin/touch                                  [ OK ]
[14:20:28]   /usr/bin/tr                                     [ OK ]
[14:20:28]   /usr/bin/uname                                  [ OK ]
[14:20:28]   /usr/bin/uniq                                   [ OK ]
[14:20:28]   /usr/bin/useradd                                [ OK ]
[14:20:28]   /usr/bin/userdel                                [ OK ]
[14:20:28]   /usr/bin/usermod                                [ OK ]
[14:20:28]   /usr/bin/users                                  [ OK ]
[14:20:28]   /usr/bin/vipw                                   [ OK ]
[14:20:28]   /usr/bin/vmstat                                 [ OK ]
[14:20:28]   /usr/bin/w                                      [ OK ]
[14:20:28]   /usr/bin/watch                                  [ OK ]
[14:20:29]   /usr/bin/wc                                     [ OK ]
[14:20:29]   /usr/bin/wget                                   [ OK ]
[14:20:29]   /usr/bin/whatis                                 [ OK ]
[14:20:29]   /usr/bin/whereis                                [ OK ]
[14:20:29]   /usr/bin/which                                  [ OK ]
[14:20:29]   /usr/bin/who                                    [ OK ]
[14:20:29]   /usr/bin/whoami                                 [ OK ]
[14:20:29]   /usr/bin/gawk                                   [ OK ]
[14:20:29]   /usr/bin/kmod                                   [ OK ]
[14:20:29]   /usr/bin/systemctl                              [ OK ]
[14:20:31]   /usr/bin/vendor_perl/GET                        [ OK ]
[14:20:33]   /usr/lib/systemd/systemd                        [ OK ]
[14:20:33]   /etc/rkhunter.conf                              [ OK ]
[14:21:10]
[14:21:10] Info: Starting test name 'rootkits'
[14:21:10] Checking for rootkits...
[14:21:10]
[14:21:10] Info: Starting test name 'known_rkts'
[14:21:10] Performing check of known rootkit files and directories
[14:21:10]
[14:21:10] Checking for 55808 Trojan - Variant A...
[14:21:10]   Checking for file '/tmp/.../r'                  [ Not found ]
[14:21:10]   Checking for file '/tmp/.../a'                  [ Not found ]
[14:21:10] 55808 Trojan - Variant A                          [ Not found ]
[14:21:10]
[14:21:10] Checking for ADM Worm...
[14:21:10]   Checking for string 'w0rm'                      [ Not found ]
[14:21:10] ADM Worm                                          [ Not found ]
[14:21:10]
[14:21:10] Checking for AjaKit Rootkit...
[14:21:10]   Checking for file '/dev/tux/.addr'              [ Not found ]
[14:21:10]   Checking for file '/dev/tux/.proc'              [ Not found ]
[14:21:10]   Checking for file '/dev/tux/.file'              [ Not found ]
[14:21:10]   Checking for file '/lib/.libgh-gh/cleaner'      [ Not found ]
[14:21:10]   Checking for file '/lib/.libgh-gh/Patch/patch'  [ Not found ]
[14:21:10]   Checking for file '/lib/.libgh-gh/sb0k'         [ Not found ]
[14:21:10]   Checking for directory '/dev/tux'               [ Not found ]
[14:21:10]   Checking for directory '/lib/.libgh-gh'         [ Not found ]
[14:21:10] AjaKit Rootkit                                    [ Not found ]
[14:21:10]
[14:21:10] Checking for Adore Rootkit...
[14:21:10]   Checking for file '/usr/secure'                 [ Not found ]
[14:21:10]   Checking for file '/usr/doc/sys/qrt'            [ Not found ]
[14:21:10]   Checking for file '/usr/doc/sys/run'            [ Not found ]
[14:21:10]   Checking for file '/usr/doc/sys/crond'          [ Not found ]
[14:21:11]   Checking for file '/usr/sbin/kfd'               [ Not found ]
[14:21:11]   Checking for file '/usr/doc/kern/var'           [ Not found ]
[14:21:11]   Checking for file '/usr/doc/kern/string.o'      [ Not found ]
[14:21:11]   Checking for file '/usr/doc/kern/ava'           [ Not found ]
[14:21:11]   Checking for file '/usr/doc/kern/adore.o'       [ Not found ]
[14:21:11]   Checking for file '/var/log/ssh/old'            [ Not found ]
[14:21:11]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/kern'          [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/backup'        [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/backup/txt'    [ Not found ]
[14:21:11]   Checking for directory '/lib/backup'            [ Not found ]
[14:21:11]   Checking for directory '/lib/backup/txt'        [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/work'          [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/sys'           [ Not found ]
[14:21:11]   Checking for directory '/var/log/ssh'           [ Not found ]
[14:21:11]   Checking for directory '/usr/doc/.spool'        [ Not found ]
[14:21:11]   Checking for directory '/usr/lib/kterm'         [ Not found ]
[14:21:11] Adore Rootkit                                     [ Not found ]
[14:21:11]
[14:21:11] Checking for aPa Kit...
[14:21:11]   Checking for file '/usr/share/.aPa'             [ Not found ]
[14:21:11] aPa Kit                                           [ Not found ]
[14:21:11]
[14:21:11] Checking for Apache Worm...
[14:21:11]   Checking for file '/bin/.log'                   [ Not found ]
[14:21:11] Apache Worm                                       [ Not found ]
[14:21:11]
[14:21:11] Checking for Ambient (ark) Rootkit...
[14:21:11]   Checking for file '/usr/lib/.ark?'              [ Not found ]
[14:21:11]   Checking for file '/dev/ptyxx/.log'             [ Not found ]
[14:21:11]   Checking for file '/dev/ptyxx/.file'            [ Not found ]
[14:21:11]   Checking for file '/dev/ptyxx/.proc'            [ Not found ]
[14:21:11]   Checking for file '/dev/ptyxx/.addr'            [ Not found ]
[14:21:11]   Checking for directory '/dev/ptyxx'             [ Not found ]
[14:21:11] Ambient (ark) Rootkit                             [ Not found ]
[14:21:11]
[14:21:11] Checking for Balaur Rootkit...
[14:21:12]   Checking for file '/usr/lib/liblog.o'           [ Not found ]
[14:21:12]   Checking for directory '/usr/lib/.kinetic'      [ Not found ]
[14:21:12]   Checking for directory '/usr/lib/.egcs'         [ Not found ]
[14:21:12]   Checking for directory '/usr/lib/.wormie'       [ Not found ]
[14:21:12] Balaur Rootkit                                    [ Not found ]
[14:21:12]
[14:21:12] Checking for BeastKit Rootkit...
[14:21:12]   Checking for file '/usr/sbin/arobia'            [ Not found ]
[14:21:12]   Checking for file '/usr/sbin/idrun'             [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm'     [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/hk'  [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/hk.pub' [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/sc'  [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/sd.pp' [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/sdco' [ Not found ]
[14:21:12]   Checking for file '/usr/lib/elm/arobia/elm/srsd' [ Not found ]
[14:21:12]   Checking for directory '/lib/ldd.so/bktools'    [ Not found ]
[14:21:12] BeastKit Rootkit                                  [ Not found ]
[14:21:12]
[14:21:12] Checking for beX2 Rootkit...
[14:21:12]   Checking for file '/usr/info/termcap.info-5.gz' [ Not found ]
[14:21:12]   Checking for file '/usr/bin/sshd2'              [ Not found ]
[14:21:12]   Checking for directory '/usr/include/bex'       [ Not found ]
[14:21:12] beX2 Rootkit                                      [ Not found ]
[14:21:12]
[14:21:12] Checking for BOBKit Rootkit...
[14:21:12]   Checking for file '/usr/sbin/ntpsx'             [ Not found ]
[14:21:12]   Checking for file '/usr/sbin/.../bkit-ava'      [ Not found ]
[14:21:12]   Checking for file '/usr/sbin/.../bkit-d'        [ Not found ]
[14:21:12]   Checking for file '/usr/sbin/.../bkit-shd'      [ Not found ]
[14:21:12]   Checking for file '/usr/sbin/.../bkit-f'        [ Not found ]
[14:21:12]   Checking for file '/usr/include/.../proc.h'     [ Not found ]
[14:21:12]   Checking for file '/usr/include/.../.bash_history' [ Not found ]
[14:21:12]   Checking for file '/usr/include/.../bkit-get'   [ Not found ]
[14:21:12]   Checking for file '/usr/include/.../bkit-dl'    [ Not found ]
[14:21:13]   Checking for file '/usr/include/.../bkit-screen' [ Not found ]
[14:21:13]   Checking for file '/usr/include/.../bkit-sleep' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-adore.o'   [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../ls'             [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../netstat'        [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../lsof'           [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shdcfg' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shhk' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-ssh/bkit-pw' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shrs' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../bkit-ssh/bkit-mots' [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../uconf.inv'      [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../psr'            [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../find'           [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../pstree'         [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../slocate'        [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../du'             [ Not found ]
[14:21:13]   Checking for file '/usr/lib/.../top'            [ Not found ]
[14:21:13]   Checking for directory '/usr/sbin/...'          [ Not found ]
[14:21:13]   Checking for directory '/usr/include/...'       [ Not found ]
[14:21:13]   Checking for directory '/usr/include/.../.tmp'  [ Not found ]
[14:21:13]   Checking for directory '/usr/lib/...'           [ Not found ]
[14:21:13]   Checking for directory '/usr/lib/.../.ssh'      [ Not found ]
[14:21:13]   Checking for directory '/usr/lib/.../bkit-ssh'  [ Not found ]
[14:21:13]   Checking for directory '/usr/lib/.bkit-'        [ Not found ]
[14:21:13]   Checking for directory '/tmp/.bkp'              [ Not found ]
[14:21:13] BOBKit Rootkit                                    [ Not found ]
[14:21:13]
[14:21:13] Checking for cb Rootkit...
[14:21:13]   Checking for file '/dev/srd0'                   [ Not found ]
[14:21:13]   Checking for file '/lib/libproc.so.2.0.6'       [ Not found ]
[14:21:13]   Checking for file '/dev/mounnt'                 [ Not found ]
[14:21:13]   Checking for file '/etc/rc.d/init.d/init'       [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/cl'    [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/.x.tgz' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/statdx' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/wted'  [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/write' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/scan'  [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/sc'    [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/sl2'   [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/wroot' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/wscan' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/wu'    [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/v'     [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/read'  [ Not found ]
[14:21:14]   Checking for file '/usr/lib/sshrc'              [ Not found ]
[14:21:14]   Checking for file '/usr/lib/ssh_host_key'       [ Not found ]
[14:21:14]   Checking for file '/usr/lib/ssh_host_key.pub'   [ Not found ]
[14:21:14]   Checking for file '/usr/lib/ssh_random_seed'    [ Not found ]
[14:21:14]   Checking for file '/usr/lib/sshd_config'        [ Not found ]
[14:21:14]   Checking for file '/usr/lib/shosts.equiv'       [ Not found ]
[14:21:14]   Checking for file '/usr/lib/ssh_known_hosts'    [ Not found ]
[14:21:14]   Checking for file '/u/zappa/.ssh/pid'           [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.system/..<SP>/tcp.log' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/curatare/attrib' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/curatare/chattr' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/curatare/ps' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.zeen/..<SP>/curatare/pstree' [ Not found ]
[14:21:14]   Checking for file '/usr/bin/.system/..<SP>/.x/xC.o' [ Not found ]
[14:21:14]   Checking for directory '/usr/bin/.zeen'         [ Not found ]
[14:21:14]   Checking for directory '/usr/bin/.zeen/..<SP>/curatare' [ Not found ]
[14:21:14]   Checking for directory '/usr/bin/.zeen/..<SP>/scan' [ Not found ]
[14:21:14]   Checking for directory '/usr/bin/.system/..<SP>' [ Not found ]
[14:21:14] cb Rootkit                                        [ Not found ]
[14:21:15]
[14:21:15] Checking for CiNIK Worm (Slapper.B variant)...
[14:21:15]   Checking for file '/tmp/.cinik'                 [ Not found ]
[14:21:15]   Checking for directory '/tmp/.font-unix/.cinik' [ Not found ]
[14:21:15] CiNIK Worm (Slapper.B variant)                    [ Not found ]
[14:21:15]
[14:21:15] Checking for Danny-Boy's Abuse Kit...
[14:21:15]   Checking for file '/dev/mdev'                   [ Not found ]
[14:21:15]   Checking for file '/usr/lib/libX.a'             [ Not found ]
[14:21:15] Danny-Boy's Abuse Kit                             [ Not found ]
[14:21:15]
[14:21:15] Checking for Devil RootKit...
[14:21:15]   Checking for file '/var/lib/games/.src'         [ Not found ]
[14:21:15]   Checking for file '/dev/dsx'                    [ Not found ]
[14:21:15]   Checking for file '/dev/caca'                   [ Not found ]
[14:21:15]   Checking for file '/dev/pro'                    [ Not found ]
[14:21:15]   Checking for file '/bin/bye'                    [ Not found ]
[14:21:15]   Checking for file '/bin/homedir'                [ Not found ]
[14:21:15]   Checking for file '/usr/bin/xfss'               [ Not found ]
[14:21:15]   Checking for file '/usr/sbin/tzava'             [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/holber' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/sense' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/clear' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/tzava' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/citeste' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/killrk' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/searchlog' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/gaoaza' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/cleaner' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/shk' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/srs' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/utile.tgz' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/webpage' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/getpsy' [ Not found ]
[14:21:15]   Checking for file '/usr/doc/tar/.../.dracusor/getbnc' [ Not found ]
[14:21:16]   Checking for file '/usr/doc/tar/.../.dracusor/getemech' [ Not found ]
[14:21:16]   Checking for file '/usr/doc/tar/.../.dracusor/localroot.sh' [ Not found ]
[14:21:16]   Checking for file '/usr/doc/tar/.../.dracusor/stuff/old/sense' [ Not found ]
[14:21:16]   Checking for directory '/usr/doc/tar/.../.dracusor' [ Not found ]
[14:21:16] Devil RootKit                                     [ Not found ]
[14:21:16]
[14:21:16] Checking for Dica-Kit Rootkit...
[14:21:16]   Checking for file '/lib/.sso'                   [ Not found ]
[14:21:16]   Checking for file '/lib/.so'                    [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/clean'      [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/dxr'        [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/read'       [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/write'      [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/lf'         [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/xl'         [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/xdr'        [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/psg'        [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/secure'     [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/rdx'        [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/va'         [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/cl.sh'      [ Not found ]
[14:21:16]   Checking for file '/var/run/...dica/last.log'   [ Not found ]
[14:21:16]   Checking for file '/usr/bin/.etc'               [ Not found ]
[14:21:16]   Checking for file '/etc/sshd_config'            [ Not found ]
[14:21:16]   Checking for file '/etc/ssh_host_key'           [ Not found ]
[14:21:16]   Checking for file '/etc/ssh_random_seed'        [ Not found ]
[14:21:16]   Checking for directory '/var/run/...dica'       [ Not found ]
[14:21:16]   Checking for directory '/var/run/...dica/mh'    [ Not found ]
[14:21:16]   Checking for directory '/var/run/...dica/scan'  [ Not found ]
[14:21:16] Dica-Kit Rootkit                                  [ Not found ]
[14:21:16]
[14:21:16] Checking for Dreams Rootkit...
[14:21:16]   Checking for file '/dev/ttyoa'                  [ Not found ]
[14:21:16]   Checking for file '/dev/ttyof'                  [ Not found ]
[14:21:17]   Checking for file '/dev/ttyop'                  [ Not found ]
[14:21:17]   Checking for file '/usr/bin/sense'              [ Not found ]
[14:21:17]   Checking for file '/usr/bin/sl2'                [ Not found ]
[14:21:17]   Checking for file '/usr/bin/logclear'           [ Not found ]
[14:21:17]   Checking for file '/usr/bin/(swapd)'            [ Not found ]
[14:21:17]   Checking for file '/usr/bin/initrd'             [ Not found ]
[14:21:17]   Checking for file '/usr/bin/crontabs'           [ Not found ]
[14:21:17]   Checking for file '/usr/bin/snfs'               [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libsss'             [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libsnf.log'         [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libshtift/top'      [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libshtift/ps'       [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libshtift/netstat'  [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libshtift/ls'       [ Not found ]
[14:21:17]   Checking for file '/usr/lib/libshtift/ifconfig' [ Not found ]
[14:21:17]   Checking for file '/usr/include/linseed.h'      [ Not found ]
[14:21:17]   Checking for file '/usr/include/linpid.h'       [ Not found ]
[14:21:17]   Checking for file '/usr/include/linkey.h'       [ Not found ]
[14:21:17]   Checking for file '/usr/include/linconf.h'      [ Not found ]
[14:21:18]   Checking for file '/usr/include/iceseed.h'      [ Not found ]
[14:21:18]   Checking for file '/usr/include/icepid.h'       [ Not found ]
[14:21:18]   Checking for file '/usr/include/icekey.h'       [ Not found ]
[14:21:18]   Checking for file '/usr/include/iceconf.h'      [ Not found ]
[14:21:18]   Checking for directory '/dev/ida/.hpd'          [ Not found ]
[14:21:18]   Checking for directory '/usr/lib/libshtift'     [ Not found ]
[14:21:18] Dreams Rootkit                                    [ Not found ]
[14:21:18]
[14:21:18] Checking for Duarawkz Rootkit...
[14:21:18]   Checking for file '/usr/bin/duarawkz/loginpass' [ Not found ]
[14:21:18]   Checking for directory '/usr/bin/duarawkz'      [ Not found ]
[14:21:18] Duarawkz Rootkit                                  [ Not found ]
[14:21:18]
[14:21:18] Checking for Enye LKM...
[14:21:18]   Checking for file '/etc/.enyelkmHIDE^IT.ko'     [ Not found ]
[14:21:18]   Checking for file '/etc/.enyelkmOCULTAR.ko'     [ Not found ]
[14:21:18] Enye LKM                                          [ Not found ]
[14:21:18]
[14:21:18] Checking for Flea Linux Rootkit...
[14:21:18]   Checking for file '/etc/ld.so.hash'             [ Not found ]
[14:21:18]   Checking for file '/lib/security/.config/ssh/sshd_config' [ Not found ]
[14:21:18]   Checking for file '/lib/security/.config/ssh/ssh_host_key' [ Not found ]
[14:21:18]   Checking for file '/lib/security/.config/ssh/ssh_host_key.pub' [ Not found ]
[14:21:18]   Checking for file '/lib/security/.config/ssh/ssh_random_seed' [ Not found ]
[14:21:18]   Checking for file '/usr/bin/ssh2d'              [ Not found ]
[14:21:18]   Checking for file '/usr/lib/ldlibns.so'         [ Not found ]
[14:21:18]   Checking for file '/usr/lib/ldlibps.so'         [ Not found ]
[14:21:18]   Checking for file '/usr/lib/ldlibpst.so'        [ Not found ]
[14:21:18]   Checking for file '/usr/lib/ldlibdu.so'         [ Not found ]
[14:21:18]   Checking for file '/usr/lib/ldlibct.so'         [ Not found ]
[14:21:18]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[14:21:18]   Checking for directory '/dev/..0'               [ Not found ]
[14:21:18]   Checking for directory '/dev/..0/backup'        [ Not found ]
[14:21:18] Flea Linux Rootkit                                [ Not found ]
[14:21:18]
[14:21:18] Checking for Fu Rootkit...
[14:21:19]   Checking for file '/sbin/xc'                    [ Not found ]
[14:21:19]   Checking for file '/usr/include/ivtype.h'       [ Not found ]
[14:21:19]   Checking for file '/bin/.lib'                   [ Not found ]
[14:21:19] Fu Rootkit                                        [ Not found ]
[14:21:19]
[14:21:19] Checking for Fuck`it Rootkit...
[14:21:19]   Checking for file '/lib/libproc.so.2.0.7'       [ Not found ]
[14:21:19]   Checking for file '/dev/proc/.bash_profile'     [ Not found ]
[14:21:19]   Checking for file '/dev/proc/.bashrc'           [ Not found ]
[14:21:19]   Checking for file '/dev/proc/.cshrc'            [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/hax0r'      [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/hax0rshell' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/config/lports' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/config/rports' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/config/rkconf' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/config/password' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/config/progs' [ Not found ]
[14:21:19]   Checking for file '/dev/proc/fuckit/system-bins/init' [ Not found ]
[14:21:19]   Checking for file '/usr/lib/libcps.a'           [ Not found ]
[14:21:19]   Checking for file '/usr/lib/libtty.a'           [ Not found ]
[14:21:19]   Checking for directory '/dev/proc'              [ Not found ]
[14:21:19]   Checking for directory '/dev/proc/fuckit'       [ Not found ]
[14:21:19]   Checking for directory '/dev/proc/fuckit/system-bins' [ Not found ]
[14:21:19]   Checking for directory '/dev/proc/toolz'        [ Not found ]
[14:21:19] Fuck`it Rootkit                                   [ Not found ]
[14:21:19]
[14:21:19] Checking for GasKit Rootkit...
[14:21:19]   Checking for file '/dev/dev/gaskit/sshd/sshdd'  [ Not found ]
[14:21:19]   Checking for directory '/dev/dev'               [ Not found ]
[14:21:20]   Checking for directory '/dev/dev/gaskit'        [ Not found ]
[14:21:20]   Checking for directory '/dev/dev/gaskit/sshd'   [ Not found ]
[14:21:20] GasKit Rootkit                                    [ Not found ]
[14:21:20]
[14:21:20] Checking for Heroin LKM...
[14:21:20]   Checking for kernel symbol 'heroin'             [ Not found ]
[14:21:20] Heroin LKM                                        [ Not found ]
[14:21:20]
[14:21:20] Checking for HjC Kit...
[14:21:20]   Checking for directory '/dev/.hijackerz'        [ Not found ]
[14:21:20] HjC Kit                                           [ Not found ]
[14:21:20]
[14:21:20] Checking for ignoKit Rootkit...
[14:21:20]   Checking for file '/lib/defs/p'                 [ Not found ]
[14:21:20]   Checking for file '/lib/defs/q'                 [ Not found ]
[14:21:20]   Checking for file '/lib/defs/r'                 [ Not found ]
[14:21:20]   Checking for file '/lib/defs/s'                 [ Not found ]
[14:21:20]   Checking for file '/lib/defs/t'                 [ Not found ]
[14:21:20]   Checking for file '/usr/lib/defs/p'             [ Not found ]
[14:21:20]   Checking for file '/usr/lib/defs/q'             [ Not found ]
[14:21:20]   Checking for file '/usr/lib/defs/r'             [ Not found ]
[14:21:20]   Checking for file '/usr/lib/defs/s'             [ Not found ]
[14:21:20]   Checking for file '/usr/lib/defs/t'             [ Not found ]
[14:21:20]   Checking for file '/usr/lib/.libigno/pkunsec'   [ Not found ]
[14:21:20]   Checking for file '/usr/lib/.libigno/.igno/psybnc/psybnc' [ Not found ]
[14:21:20]   Checking for directory '/usr/lib/.libigno'      [ Not found ]
[14:21:20]   Checking for directory '/usr/lib/.libigno/.igno' [ Not found ]
[14:21:20] ignoKit Rootkit                                   [ Not found ]
[14:21:20]
[14:21:20] Checking for IntoXonia-NG Rootkit...
[14:21:20]   Checking for kernel symbol 'funces'             [ Not found ]
[14:21:20]   Checking for kernel symbol 'ixinit'             [ Not found ]
[14:21:21]   Checking for kernel symbol 'tricks'             [ Not found ]
[14:21:21]   Checking for kernel symbol 'kernel_unlink'      [ Not found ]
[14:21:21]   Checking for kernel symbol 'rootme'             [ Not found ]
[14:21:21]   Checking for kernel symbol 'hide_module'        [ Not found ]
[14:21:21]   Checking for kernel symbol 'find_sys_call_tbl'  [ Not found ]
[14:21:21] IntoXonia-NG Rootkit                              [ Not found ]
[14:21:21]
[14:21:21] Checking for Irix Rootkit...
[14:21:21]   Checking for directory '/dev/pts/01'            [ Not found ]
[14:21:21]   Checking for directory '/dev/pts/01/backup'     [ Not found ]
[14:21:21]   Checking for directory '/dev/pts/01/etc'        [ Not found ]
[14:21:21]   Checking for directory '/dev/pts/01/tmp'        [ Not found ]
[14:21:21] Irix Rootkit                                      [ Not found ]
[14:21:21]
[14:21:21] Checking for Jynx Rootkit...
[14:21:21]   Checking for file '/xochikit/bc'                [ Not found ]
[14:21:21]   Checking for file '/xochikit/ld_poison.so'      [ Not found ]
[14:21:21]   Checking for file '/omgxochi/bc'                [ Not found ]
[14:21:21]   Checking for file '/omgxochi/ld_poison.so'      [ Not found ]
[14:21:21]   Checking for file '/var/local/^^/bc'            [ Not found ]
[14:21:21]   Checking for file '/var/local/^^/ld_poison.so'  [ Not found ]
[14:21:21]   Checking for directory '/xochikit'              [ Not found ]
[14:21:21]   Checking for directory '/omgxochi'              [ Not found ]
[14:21:21]   Checking for directory '/var/local/^^'          [ Not found ]
[14:21:21] Jynx Rootkit                                      [ Not found ]
[14:21:21]
[14:21:21] Checking for KBeast Rootkit...
[14:21:22]   Checking for file '/usr/_h4x_/ipsecs-kbeast-v1.ko' [ Not found ]
[14:21:22]   Checking for file '/usr/_h4x_/_h4x_bd'          [ Not found ]
[14:21:22]   Checking for file '/usr/_h4x_/acctlog'          [ Not found ]
[14:21:22]   Checking for directory '/usr/_h4x_'             [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_delete_module'  [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_getdents64'     [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_kill'           [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_open'           [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_read'           [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_rename'         [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_rmdir'          [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_tcp4_seq_show'  [ Not found ]
[14:21:22]   Checking for kernel symbol 'h4x_write'          [ Not found ]
[14:21:22] KBeast Rootkit                                    [ Not found ]
[14:21:22]
[14:21:22] Checking for Kitko Rootkit...
[14:21:22]   Checking for directory '/usr/src/redhat/SRPMS/...' [ Not found ]
[14:21:22] Kitko Rootkit                                     [ Not found ]
[14:21:22]
[14:21:22] Checking for Knark Rootkit...
[14:21:22]   Checking for file '/proc/knark/pids'            [ Not found ]
[14:21:23]   Checking for directory '/proc/knark'            [ Not found ]
[14:21:23] Knark Rootkit                                     [ Not found ]
[14:21:23]
[14:21:23] Checking for ld-linuxv.so Rootkit...
[14:21:23]   Checking for file '/lib/ld-linuxv.so.1'         [ Not found ]
[14:21:23]   Checking for directory '/var/opt/_so_cache'     [ Not found ]
[14:21:23]   Checking for directory '/var/opt/_so_cache/ld'  [ Not found ]
[14:21:23]   Checking for directory '/var/opt/_so_cache/lc'  [ Not found ]
[14:21:23] ld-linuxv.so Rootkit                              [ Not found ]
[14:21:23]
[14:21:23] Checking for Li0n Worm...
[14:21:23]   Checking for file '/bin/in.telnetd'             [ Not found ]
[14:21:23]   Checking for file '/bin/mjy'                    [ Not found ]
[14:21:23]   Checking for file '/usr/man/man1/man1/lib/.lib/mjy' [ Not found ]
[14:21:23]   Checking for file '/usr/man/man1/man1/lib/.lib/in.telnetd' [ Not found ]
[14:21:23]   Checking for file '/usr/man/man1/man1/lib/.lib/.x' [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/1i0n.sh'  [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/hack.sh'  [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/bind'     [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/randb'    [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/scan.sh'  [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/pscan'    [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/star.sh'  [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/bindx.sh' [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/scan/bindname.log' [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/1i0n.sh'       [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/lib/netstat'   [ Not found ]
[14:21:23]   Checking for file '/dev/.lib/lib/lib/dev/.1addr' [ Not found ]
[14:21:24]   Checking for file '/dev/.lib/lib/lib/dev/.1logz' [ Not found ]
[14:21:24]   Checking for file '/dev/.lib/lib/lib/dev/.1proc' [ Not found ]
[14:21:24]   Checking for file '/dev/.lib/lib/lib/dev/.1file' [ Not found ]
[14:21:24] Li0n Worm                                         [ Not found ]
[14:21:24]
[14:21:24] Checking for Lockit / LJK2 Rootkit...
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_config' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_host_key' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_host_key.pub' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_random_seed*' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/sshd_config' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backdoor/RK1bd' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/du' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ifconfig' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/inetd.conf' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/locate' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/login' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ls' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/netstat' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ps' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/pstree' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/rc.sysinit' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/syslogd' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/tcpd' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/top' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/clean/RK1sauber' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/clean/RK1wted' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/hack/RK1parse' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/hack/RK1sniff' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1addr' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1dir' [ Not found ]
[14:21:24]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1log' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1proc' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/RK1phidemod.c' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/README.modules' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/RK1hidem.c' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/RK1phide' [ Not found ]
[14:21:25]   Checking for file '/usr/lib/libmen.oo/.LJK2/sshconfig/RK1ssh' [ Not found ]
[14:21:25]   Checking for directory '/usr/lib/libmen.oo/.LJK2' [ Not found ]
[14:21:25] Lockit / LJK2 Rootkit                             [ Not found ]
[14:21:25]
[14:21:25] Checking for Mood-NT Rootkit...
[14:21:25]   Checking for file '/sbin/init__mood-nt-_-_cthulhu' [ Not found ]
[14:21:25]   Checking for file '/_cthulhu/mood-nt.init'      [ Not found ]
[14:21:25]   Checking for file '/_cthulhu/mood-nt.conf'      [ Not found ]
[14:21:25]   Checking for file '/_cthulhu/mood-nt.sniff'     [ Not found ]
[14:21:25]   Checking for directory '/_cthulhu'              [ Not found ]
[14:21:25] Mood-NT Rootkit                                   [ Not found ]
[14:21:25]
[14:21:25] Checking for MRK Rootkit...
[14:21:25]   Checking for file '/dev/ida/.inet/pid'          [ Not found ]
[14:21:25]   Checking for file '/dev/ida/.inet/ssh_host_key' [ Not found ]
[14:21:25]   Checking for file '/dev/ida/.inet/ssh_random_seed' [ Not found ]
[14:21:25]   Checking for file '/dev/ida/.inet/tcp.log'      [ Not found ]
[14:21:25]   Checking for directory '/dev/ida/.inet'         [ Not found ]
[14:21:25]   Checking for directory '/var/spool/cron/.sh'    [ Not found ]
[14:21:25] MRK Rootkit                                       [ Not found ]
[14:21:25]
[14:21:25] Checking for Ni0 Rootkit...
[14:21:25]   Checking for file '/var/lock/subsys/...datafile.../...net...' [ Not found ]
[14:21:25]   Checking for file '/var/lock/subsys/...datafile.../...port...' [ Not found ]
[14:21:25]   Checking for file '/var/lock/subsys/...datafile.../...ps...' [ Not found ]
[14:21:25]   Checking for file '/var/lock/subsys/...datafile.../...file...' [ Not found ]
[14:21:25]   Checking for directory '/tmp/waza'              [ Not found ]
[14:21:25]   Checking for directory '/var/lock/subsys/...datafile...' [ Not found ]
[14:21:25]   Checking for directory '/usr/sbin/es'           [ Not found ]
[14:21:25] Ni0 Rootkit                                       [ Not found ]
[14:21:25]
[14:21:25] Checking for Ohhara Rootkit...
[14:21:26]   Checking for file '/var/lock/subsys/...datafile.../...datafile.../in.smbd.log' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile...' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile.../...datafile...' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../bin' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../usr/bin' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../usr/sbin' [ Not found ]
[14:21:26]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../lib/security' [ Not found ]
[14:21:26] Ohhara Rootkit                                    [ Not found ]
[14:21:26]
[14:21:26] Checking for Optic Kit (Tux) Worm...
[14:21:26]   Checking for directory '/dev/tux'               [ Not found ]
[14:21:26]   Checking for directory '/usr/bin/xchk'          [ Not found ]
[14:21:26]   Checking for directory '/usr/bin/xsf'           [ Not found ]
[14:21:26]   Checking for directory '/usr/bin/ssh2d'         [ Not found ]
[14:21:26] Optic Kit (Tux) Worm                              [ Not found ]
[14:21:26]
[14:21:26] Checking for Oz Rootkit...
[14:21:26]   Checking for file '/dev/.oz/.nap/rkit/terror'   [ Not found ]
[14:21:26]   Checking for directory '/dev/.oz'               [ Not found ]
[14:21:26] Oz Rootkit                                        [ Not found ]
[14:21:26]
[14:21:26] Checking for Phalanx Rootkit...
[14:21:26]   Checking for file '/uNFuNF'                     [ Not found ]
[14:21:26]   Checking for file '/etc/host.ph1'               [ Not found ]
[14:21:26]   Checking for file '/bin/host.ph1'               [ Not found ]
[14:21:26]   Checking for file '/usr/share/.home.ph1/phalanx' [ Not found ]
[14:21:26]   Checking for file '/usr/share/.home.ph1/cb'     [ Not found ]
[14:21:26]   Checking for file '/usr/share/.home.ph1/kebab'  [ Not found ]
[14:21:26]   Checking for directory '/usr/share/.home.ph1'   [ Not found ]
[14:21:26]   Checking for directory '/usr/share/.home.ph1/tty' [ Not found ]
[14:21:26] Phalanx Rootkit                                   [ Not found ]
[14:21:26]
[14:21:26] Checking for Phalanx2 Rootkit...
[14:21:26]   Checking for file '/etc/khubd.p2/.p2rc'         [ Not found ]
[14:21:26]   Checking for file '/etc/khubd.p2/.phalanx2'     [ Not found ]
[14:21:26]   Checking for file '/etc/khubd.p2/.sniff'        [ Not found ]
[14:21:26]   Checking for file '/etc/khubd.p2/sshgrab.py'    [ Not found ]
[14:21:27]   Checking for file '/etc/lolzz.p2/.p2rc'         [ Not found ]
[14:21:27]   Checking for file '/etc/lolzz.p2/.phalanx2'     [ Not found ]
[14:21:27]   Checking for file '/etc/lolzz.p2/.sniff'        [ Not found ]
[14:21:27]   Checking for file '/etc/lolzz.p2/sshgrab.py'    [ Not found ]
[14:21:27]   Checking for file '/etc/cron.d/zupzzplaceholder' [ Not found ]
[14:21:27]   Checking for file '/usr/lib/zupzz.p2/.p-2.3d'   [ Not found ]
[14:21:27]   Checking for file '/usr/lib/zupzz.p2/.p2rc'     [ Not found ]
[14:21:27]   Checking for directory '/etc/khubd.p2'          [ Not found ]
[14:21:27]   Checking for directory '/etc/lolzz.p2'          [ Not found ]
[14:21:27]   Checking for directory '/usr/lib/zupzz.p2'      [ Not found ]
[14:21:27] Phalanx2 Rootkit                                  [ Not found ]
[14:21:27]
[14:21:27] Checking for Phalanx2 Rootkit (extended tests)...
[14:21:27]   Checking for directory '/etc/khubd.p2'          [ Not found ]
[14:21:27]   Checking for directory '/etc/lolzz.p2'          [ Not found ]
[14:21:27]   Checking for directory '/usr/lib/zupzz.p2'      [ Not found ]
[14:21:27] Phalanx2 Rootkit (extended tests)                 [ Not found ]
[14:21:27]
[14:21:27] Checking for Portacelo Rootkit...
[14:21:27]   Checking for file '/var/lib/.../.ak'            [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../.hk'            [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../.rs'            [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../.p'             [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../getty'          [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../lkt.o'          [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../show'           [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../nlkt.o'         [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../ssshrc'         [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../sssh_equiv'     [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../sssh_known_hosts' [ Not found ]
[14:21:27]   Checking for file '/var/lib/.../sssh_pid'       [ Not found ]
[14:21:28]   Checking for file '~/.sssh/known_hosts'         [ Not found ]
[14:21:28] Portacelo Rootkit                                 [ Not found ]
[14:21:28]
[14:21:28] Checking for R3dstorm Toolkit...
[14:21:28]   Checking for file '/var/log/tk02/see_all'       [ Not found ]
[14:21:28]   Checking for file '/var/log/tk02/.scris'        [ Not found ]
[14:21:28]   Checking for file '/bin/.../sshd/sbin/sshd1'    [ Not found ]
[14:21:28]   Checking for file '/bin/.../hate/sk'            [ Not found ]
[14:21:28]   Checking for file '/bin/.../see_all'            [ Not found ]
[14:21:28]   Checking for directory '/var/log/tk02'          [ Not found ]
[14:21:28]   Checking for directory '/var/log/tk02/old'      [ Not found ]
[14:21:28]   Checking for directory '/bin/...'               [ Not found ]
[14:21:28] R3dstorm Toolkit                                  [ Not found ]
[14:21:28]
[14:21:28] Checking for RH-Sharpe's Rootkit...
[14:21:28]   Checking for file '/bin/lps'                    [ Not found ]
[14:21:28]   Checking for file '/usr/bin/lpstree'            [ Not found ]
[14:21:28]   Checking for file '/usr/bin/ltop'               [ Not found ]
[14:21:28]   Checking for file '/usr/bin/lkillall'           [ Not found ]
[14:21:28]   Checking for file '/usr/bin/ldu'                [ Not found ]
[14:21:28]   Checking for file '/usr/bin/lnetstat'           [ Not found ]
[14:21:28]   Checking for file '/usr/bin/wp'                 [ Not found ]
[14:21:28]   Checking for file '/usr/bin/shad'               [ Not found ]
[14:21:28]   Checking for file '/usr/bin/vadim'              [ Not found ]
[14:21:28]   Checking for file '/usr/bin/slice'              [ Not found ]
[14:21:28]   Checking for file '/usr/bin/cleaner'            [ Not found ]
[14:21:28]   Checking for file '/usr/include/rpcsvc/du'      [ Not found ]
[14:21:28] RH-Sharpe's Rootkit                               [ Not found ]
[14:21:28]
[14:21:28] Checking for RSHA's Rootkit...
[14:21:28]   Checking for file '/bin/kr4p'                   [ Not found ]
[14:21:28]   Checking for file '/usr/bin/n3tstat'            [ Not found ]
[14:21:28]   Checking for file '/usr/bin/chsh2'              [ Not found ]
[14:21:29]   Checking for file '/usr/bin/slice2'             [ Not found ]
[14:21:29]   Checking for file '/usr/src/linux/arch/alpha/lib/.lib/.1proc' [ Not found ]
[14:21:29]   Checking for file '/etc/rc.d/arch/alpha/lib/.lib/.1addr' [ Not found ]
[14:21:29]   Checking for directory '/etc/rc.d/rsha'         [ Not found ]
[14:21:29]   Checking for directory '/etc/rc.d/arch/alpha/lib/.lib' [ Not found ]
[14:21:29] RSHA's Rootkit                                    [ Not found ]
[14:21:29]
[14:21:29] Checking for Scalper Worm...
[14:21:29]   Checking for file '/tmp/.a'                     [ Not found ]
[14:21:29]   Checking for file '/tmp/.uua'                   [ Not found ]
[14:21:29] Scalper Worm                                      [ Not found ]
[14:21:29]
[14:21:29] Checking for Sebek LKM...
[14:21:29]   Checking for kernel symbol 'adore or sebek'     [ Not found ]
[14:21:29] Sebek LKM                                         [ Not found ]
[14:21:29]
[14:21:29] Checking for Shutdown Rootkit...
[14:21:29]   Checking for file '/usr/man/man5/..<SP>/.dir/scannah/asus' [ Not found ]
[14:21:29]   Checking for file '/usr/man/man5/..<SP>/.dir/see' [ Not found ]
[14:21:29]   Checking for file '/usr/man/man5/..<SP>/.dir/nscd' [ Not found ]
[14:21:29]   Checking for file '/usr/man/man5/..<SP>/.dir/alpd' [ Not found ]
[14:21:29]   Checking for file '/etc/rc.d/rc.local<SP>'      [ Not found ]
[14:21:29]   Checking for directory '/usr/man/man5/..<SP>/.dir' [ Not found ]
[14:21:29]   Checking for directory '/usr/man/man5/..<SP>/.dir/scannah' [ Not found ]
[14:21:29]   Checking for directory '/etc/rc.d/rc0.d/..<SP>/.dir' [ Not found ]
[14:21:29] Shutdown Rootkit                                  [ Not found ]
[14:21:29]
[14:21:29] Checking for SHV4 Rootkit...
[14:21:29]   Checking for file '/etc/ld.so.hash'             [ Not found ]
[14:21:29]   Checking for file '/lib/libext-2.so.7'          [ Not found ]
[14:21:29]   Checking for file '/lib/lidps1.so'              [ Not found ]
[14:21:30]   Checking for file '/lib/libproc.a'              [ Not found ]
[14:21:30]   Checking for file '/lib/libproc.so.2.0.6'       [ Not found ]
[14:21:30]   Checking for file '/lib/ldd.so/tks'             [ Not found ]
[14:21:30]   Checking for file '/lib/ldd.so/tkp'             [ Not found ]
[14:21:30]   Checking for file '/lib/ldd.so/tksb'            [ Not found ]
[14:21:30]   Checking for file '/lib/security/.config/sshd'  [ Not found ]
[14:21:30]   Checking for file '/lib/security/.config/ssh/ssh_host_key' [ Not found ]
[14:21:30]   Checking for file '/lib/security/.config/ssh/ssh_host_key.pub' [ Not found ]
[14:21:30]   Checking for file '/lib/security/.config/ssh/ssh_random_seed' [ Not found ]
[14:21:30]   Checking for file '/usr/include/file.h'         [ Not found ]
[14:21:30]   Checking for file '/usr/include/hosts.h'        [ Not found ]
[14:21:30]   Checking for file '/usr/include/lidps1.so'      [ Not found ]
[14:21:30]   Checking for file '/usr/include/log.h'          [ Not found ]
[14:21:30]   Checking for file '/usr/include/proc.h'         [ Not found ]
[14:21:30]   Checking for file '/usr/sbin/xntps'             [ Not found ]
[14:21:30]   Checking for file '/dev/srd0'                   [ Not found ]
[14:21:30]   Checking for directory '/lib/ldd.so'            [ Not found ]
[14:21:30]   Checking for directory '/lib/security/.config'  [ Not found ]
[14:21:30]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[14:21:30] SHV4 Rootkit                                      [ Not found ]
[14:21:30]
[14:21:30] Checking for SHV5 Rootkit...
[14:21:31]   Checking for file '/etc/sh.conf'                [ Not found ]
[14:21:31]   Checking for file '/lib/libproc.a'              [ Not found ]
[14:21:31]   Checking for file '/lib/libproc.so.2.0.6'       [ Not found ]
[14:21:31]   Checking for file '/lib/lidps1.so'              [ Not found ]
[14:21:31]   Checking for file '/lib/libsh.so/bash'          [ Not found ]
[14:21:31]   Checking for file '/usr/include/file.h'         [ Not found ]
[14:21:31]   Checking for file '/usr/include/hosts.h'        [ Not found ]
[14:21:31]   Checking for file '/usr/include/log.h'          [ Not found ]
[14:21:31]   Checking for file '/usr/include/proc.h'         [ Not found ]
[14:21:31]   Checking for file '/lib/libsh.so/shdcf2'        [ Not found ]
[14:21:31]   Checking for file '/lib/libsh.so/shhk'          [ Not found ]
[14:21:31]   Checking for file '/lib/libsh.so/shhk.pub'      [ Not found ]
[14:21:31]   Checking for file '/lib/libsh.so/shrs'          [ Not found ]
[14:21:31]   Checking for file '/usr/lib/libsh/.bashrc'      [ Not found ]
[14:21:31]   Checking for file '/usr/lib/libsh/shsb'         [ Not found ]
[14:21:31]   Checking for file '/usr/lib/libsh/hide'         [ Not found ]
[14:21:31]   Checking for file '/usr/lib/libsh/.sniff/shsniff' [ Not found ]
[14:21:31]   Checking for file '/usr/lib/libsh/.sniff/shp'   [ Not found ]
[14:21:31]   Checking for file '/dev/srd0'                   [ Not found ]
[14:21:31]   Checking for directory '/lib/libsh.so'          [ Not found ]
[14:21:31]   Checking for directory '/usr/lib/libsh'         [ Not found ]
[14:21:31]   Checking for directory '/usr/lib/libsh/utilz'   [ Not found ]
[14:21:31]   Checking for directory '/usr/lib/libsh/.backup' [ Not found ]
[14:21:31] SHV5 Rootkit                                      [ Not found ]
[14:21:31]
[14:21:31] Checking for Sin Rootkit...
[14:21:31]   Checking for file '/dev/.haos/haos1/.f/Denyed'  [ Not found ]
[14:21:32]   Checking for file '/dev/ttyoa'                  [ Not found ]
[14:21:32]   Checking for file '/dev/ttyof'                  [ Not found ]
[14:21:32]   Checking for file '/dev/ttyop'                  [ Not found ]
[14:21:32]   Checking for file '/dev/ttyos'                  [ Not found ]
[14:21:32]   Checking for file '/usr/lib/.lib'               [ Not found ]
[14:21:32]   Checking for file '/usr/lib/sn/.X'              [ Not found ]
[14:21:32]   Checking for file '/usr/lib/sn/.sys'            [ Not found ]
[14:21:32]   Checking for file '/usr/lib/ld/.X'              [ Not found ]
[14:21:32]   Checking for file '/usr/man/man1/...'           [ Not found ]
[14:21:32]   Checking for file '/usr/man/man1/.../.m'        [ Not found ]
[14:21:32]   Checking for file '/usr/man/man1/.../.w'        [ Not found ]
[14:21:32]   Checking for directory '/usr/lib/sn'            [ Not found ]
[14:21:32]   Checking for directory '/usr/lib/man1/...'      [ Not found ]
[14:21:32]   Checking for directory '/dev/.haos'             [ Not found ]
[14:21:32] Sin Rootkit                                       [ Not found ]
[14:21:32]
[14:21:32] Checking for Slapper Worm...
[14:21:32]   Checking for file '/tmp/.bugtraq'               [ Not found ]
[14:21:32]   Checking for file '/tmp/.uubugtraq'             [ Not found ]
[14:21:32]   Checking for file '/tmp/.bugtraq.c'             [ Not found ]
[14:21:32]   Checking for file '/tmp/httpd'                  [ Not found ]
[14:21:32]   Checking for file '/tmp/.unlock'                [ Not found ]
[14:21:32]   Checking for file '/tmp/update'                 [ Not found ]
[14:21:32]   Checking for file '/tmp/.cinik'                 [ Not found ]
[14:21:32]   Checking for file '/tmp/.b'                     [ Not found ]
[14:21:33] Slapper Worm                                      [ Not found ]
[14:21:33]
[14:21:33] Checking for Sneakin Rootkit...
[14:21:33]   Checking for directory '/tmp/.X11-unix/.../rk'  [ Not found ]
[14:21:33] Sneakin Rootkit                                   [ Not found ]
[14:21:33]
[14:21:33] Checking for 'Spanish' Rootkit...
[14:21:33]   Checking for file '/dev/ptyq'                   [ Not found ]
[14:21:33]   Checking for file '/bin/ad'                     [ Not found ]
[14:21:33]   Checking for file '/bin/ava'                    [ Not found ]
[14:21:33]   Checking for file '/bin/server'                 [ Not found ]
[14:21:33]   Checking for file '/usr/sbin/rescue'            [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../chrps'        [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../chrifconfig'  [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../netstat'      [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../linsniffer'   [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../charbd'       [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../charbd2'      [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../charbd3'      [ Not found ]
[14:21:33]   Checking for file '/usr/share/.../charbd4'      [ Not found ]
[14:21:33]   Checking for file '/usr/man/tmp/update.tgz'     [ Not found ]
[14:21:33]   Checking for file '/var/lib/rpm/db.rpm'         [ Not found ]
[14:21:33]   Checking for file '/var/cache/man/.cat'         [ Not found ]
[14:21:33]   Checking for file '/var/spool/lpd/remote/.lpq'  [ Not found ]
[14:21:33]   Checking for directory '/usr/share/...'         [ Not found ]
[14:21:33] 'Spanish' Rootkit                                 [ Not found ]
[14:21:33]
[14:21:33] Checking for Suckit Rootkit...
[14:21:33]   Checking for file '/sbin/initsk12'              [ Not found ]
[14:21:33]   Checking for file '/sbin/initxrk'               [ Not found ]
[14:21:33]   Checking for file '/usr/bin/null'               [ Not found ]
[14:21:34]   Checking for file '/usr/share/locale/sk/.sk12/sk' [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc0.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc1.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc2.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc3.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc4.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc5.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for file '/etc/rc.d/rc6.d/S23kmdac'    [ Not found ]
[14:21:34]   Checking for directory '/dev/sdhu0/tehdrakg'    [ Not found ]
[14:21:34]   Checking for directory '/etc/.MG'               [ Not found ]
[14:21:34]   Checking for directory '/usr/share/locale/sk/.sk12' [ Not found ]
[14:21:34]   Checking for directory '/usr/lib/perl5/site_perl/i386-linux/auto/TimeDate/.packlist' [ Not found ]
[14:21:34] Suckit Rootkit                                    [ Not found ]
[14:21:34]
[14:21:34] Checking for Superkit Rootkit...
[14:21:34]   Checking for file '/usr/man/.sman/sk/backsh'    [ Not found ]
[14:21:34]   Checking for file '/usr/man/.sman/sk/izbtrag'   [ Not found ]
[14:21:34]   Checking for file '/usr/man/.sman/sk/sksniff'   [ Not found ]
[14:21:34]   Checking for file '/var/www/cgi-bin/cgiback.cgi' [ Not found ]
[14:21:34]   Checking for directory '/usr/man/.sman/sk'      [ Not found ]
[14:21:34] Superkit Rootkit                                  [ Not found ]
[14:21:34]
[14:21:34] Checking for TBD (Telnet BackDoor)...
[14:21:34]   Checking for file '/usr/lib/.tbd'               [ Not found ]
[14:21:34] TBD (Telnet BackDoor)                             [ Not found ]
[14:21:34]
[14:21:34] Checking for TeLeKiT Rootkit...
[14:21:34]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/sniff' [ Not found ]
[14:21:35]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/telnetd' [ Not found ]
[14:21:35]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/teleulo' [ Not found ]
[14:21:35]   Checking for file '/usr/man/man3/.../cl'        [ Not found ]
[14:21:35]   Checking for file '/dev/ptyr'                   [ Not found ]
[14:21:35]   Checking for file '/dev/ptyp'                   [ Not found ]
[14:21:35]   Checking for file '/dev/ptyq'                   [ Not found ]
[14:21:35]   Checking for file '/dev/hda06'                  [ Not found ]
[14:21:35]   Checking for file '/usr/info/libc1.so'          [ Not found ]
[14:21:35]   Checking for directory '/usr/man/man3/...'      [ Not found ]
[14:21:35]   Checking for directory '/usr/man/man3/.../lsniff' [ Not found ]
[14:21:35]   Checking for directory '/usr/man/man3/.../TeLeKiT' [ Not found ]
[14:21:35] TeLeKiT Rootkit                                   [ Not found ]
[14:21:35]
[14:21:35] Checking for T0rn Rootkit...
[14:21:35]   Checking for file '/dev/.lib/lib/lib/t0rns'     [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/du'        [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/ls'        [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/t0rnsb'    [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/ps'        [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/t0rnp'     [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/find'      [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/ifconfig'  [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/pg'        [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/ssh.tgz'   [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/top'       [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/sz'        [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/login'     [ Not found ]
[14:21:35]   Checking for file '/dev/.lib/lib/lib/in.fingerd' [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/1i0n.sh'   [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/pstree'    [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/in.telnetd' [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/mjy'       [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/sush'      [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/tfn'       [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/name'      [ Not found ]
[14:21:36]   Checking for file '/dev/.lib/lib/lib/getip.sh'  [ Not found ]
[14:21:36]   Checking for file '/usr/info/.torn/sh*'         [ Not found ]
[14:21:36]   Checking for file '/usr/src/.puta/.1addr'       [ Not found ]
[14:21:36]   Checking for file '/usr/src/.puta/.1file'       [ Not found ]
[14:21:36]   Checking for file '/usr/src/.puta/.1proc'       [ Not found ]
[14:21:36]   Checking for file '/usr/src/.puta/.1logz'       [ Not found ]
[14:21:36]   Checking for file '/usr/info/.t0rn'             [ Not found ]
[14:21:36]   Checking for directory '/dev/.lib'              [ Not found ]
[14:21:36]   Checking for directory '/dev/.lib/lib'          [ Not found ]
[14:21:36]   Checking for directory '/dev/.lib/lib/lib'      [ Not found ]
[14:21:36]   Checking for directory '/dev/.lib/lib/lib/dev'  [ Not found ]
[14:21:36]   Checking for directory '/dev/.lib/lib/scan'     [ Not found ]
[14:21:36]   Checking for directory '/usr/src/.puta'         [ Not found ]
[14:21:36]   Checking for directory '/usr/man/man1/man1'     [ Not found ]
[14:21:36]   Checking for directory '/usr/man/man1/man1/lib' [ Not found ]
[14:21:36]   Checking for directory '/usr/man/man1/man1/lib/.lib' [ Not found ]
[14:21:36]   Checking for directory '/usr/man/man1/man1/lib/.lib/.backup' [ Not found ]
[14:21:37] T0rn Rootkit                                      [ Not found ]
[14:21:37]
[14:21:37] Checking for trNkit Rootkit...
[14:21:37]   Checking for file '/usr/lib/libbins.la'         [ Not found ]
[14:21:37]   Checking for file '/usr/lib/libtcs.so'          [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/ulogin.sh'        [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/tcpshell.sh'      [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/bupdu'            [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/buloc'            [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/buloc1'           [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/buloc2'           [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/stat'             [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/backps'           [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/tree'             [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/topk'             [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/wold'             [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/whoold'           [ Not found ]
[14:21:37]   Checking for file '/dev/.ttpy/backdoors'        [ Not found ]
[14:21:37] trNkit Rootkit                                    [ Not found ]
[14:21:37]
[14:21:37] Checking for Trojanit Kit...
[14:21:37]   Checking for file '/bin/.ls'                    [ Not found ]
[14:21:37]   Checking for file '/bin/.ps'                    [ Not found ]
[14:21:37]   Checking for file '/bin/.netstat'               [ Not found ]
[14:21:37]   Checking for file '/usr/bin/.nop'               [ Not found ]
[14:21:37]   Checking for file '/usr/bin/.who'               [ Not found ]
[14:21:37] Trojanit Kit                                      [ Not found ]
[14:21:37]
[14:21:37] Checking for Tuxtendo Rootkit...
[14:21:37]   Checking for file '/lib/libproc.so.2.0.7'       [ Not found ]
[14:21:38]   Checking for file '/usr/bin/xchk'               [ Not found ]
[14:21:38]   Checking for file '/usr/bin/xsf'                [ Not found ]
[14:21:38]   Checking for file '/dev/tux/suidsh'             [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.addr'              [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.cron'              [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.file'              [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.log'               [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.proc'              [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.iface'             [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.pw'                [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.df'                [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.ssh'               [ Not found ]
[14:21:38]   Checking for file '/dev/tux/.tux'               [ Not found ]
[14:21:38]   Checking for file '/dev/tux/ssh2/sshd2_config'  [ Not found ]
[14:21:38]   Checking for file '/dev/tux/ssh2/hostkey'       [ Not found ]
[14:21:38]   Checking for file '/dev/tux/ssh2/hostkey.pub'   [ Not found ]
[14:21:38]   Checking for file '/dev/tux/ssh2/logo'          [ Not found ]
[14:21:38]   Checking for file '/dev/tux/ssh2/random_seed'   [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/crontab'     [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/df'          [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/dir'         [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/find'        [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/ifconfig'    [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/locate'      [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/netstat'     [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/ps'          [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/pstree'      [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/syslogd'     [ Not found ]
[14:21:38]   Checking for file '/dev/tux/backup/tcpd'        [ Not found ]
[14:21:39]   Checking for file '/dev/tux/backup/top'         [ Not found ]
[14:21:39]   Checking for file '/dev/tux/backup/updatedb'    [ Not found ]
[14:21:39]   Checking for file '/dev/tux/backup/vdir'        [ Not found ]
[14:21:39]   Checking for directory '/dev/tux'               [ Not found ]
[14:21:39]   Checking for directory '/dev/tux/ssh2'          [ Not found ]
[14:21:39]   Checking for directory '/dev/tux/backup'        [ Not found ]
[14:21:39] Tuxtendo Rootkit                                  [ Not found ]
[14:21:39]
[14:21:39] Checking for URK Rootkit...
[14:21:39]   Checking for file '/dev/prom/sn.l'              [ Not found ]
[14:21:39]   Checking for file '/usr/lib/ldlibps.so'         [ Not found ]
[14:21:39]   Checking for file '/usr/lib/ldlibnet.so'        [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/uconf.inv'       [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/cleaner'         [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/psniff'      [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/du'          [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/ls'          [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/passwd'      [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/ps'          [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/psr'         [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/su'          [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/find'        [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/netstat'     [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/ping'        [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/strings'     [ Not found ]
[14:21:39]   Checking for file '/dev/pts/01/bin/bash'        [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/du'  [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/ls'  [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/passwd' [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/ps'  [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/psr' [ Not found ]
[14:21:39]   Checking for file '/usr/man/man1/xxxxxxbin/su'  [ Not found ]
[14:21:40]   Checking for file '/usr/man/man1/xxxxxxbin/find' [ Not found ]
[14:21:40]   Checking for file '/usr/man/man1/xxxxxxbin/netstat' [ Not found ]
[14:21:40]   Checking for file '/usr/man/man1/xxxxxxbin/ping' [ Not found ]
[14:21:40]   Checking for file '/usr/man/man1/xxxxxxbin/strings' [ Not found ]
[14:21:40]   Checking for file '/usr/man/man1/xxxxxxbin/bash' [ Not found ]
[14:21:40]   Checking for file '/tmp/conf.inv'               [ Not found ]
[14:21:40]   Checking for directory '/dev/prom'              [ Not found ]
[14:21:40]   Checking for directory '/dev/pts/01'            [ Not found ]
[14:21:40]   Checking for directory '/dev/pts/01/bin'        [ Not found ]
[14:21:40]   Checking for directory '/usr/man/man1/xxxxxxbin' [ Not found ]
[14:21:40] URK Rootkit                                       [ Not found ]
[14:21:40]
[14:21:40] Checking for Vampire Rootkit...
[14:21:40]   Checking for kernel symbol 'new_getdents'       [ Not found ]
[14:21:40]   Checking for kernel symbol 'old_getdents'       [ Not found ]
[14:21:40]   Checking for kernel symbol 'should_hide_file_name' [ Not found ]
[14:21:40]   Checking for kernel symbol 'should_hide_task_name' [ Not found ]
[14:21:40] Vampire Rootkit                                   [ Not found ]
[14:21:40]
[14:21:40] Checking for VcKit Rootkit...
[14:21:40]   Checking for directory '/usr/include/linux/modules/lib.so' [ Not found ]
[14:21:40]   Checking for directory '/usr/include/linux/modules/lib.so/bin' [ Not found ]
[14:21:40] VcKit Rootkit                                     [ Not found ]
[14:21:40]
[14:21:40] Checking for Volc Rootkit...
[14:21:40]   Checking for file '/usr/bin/volc'               [ Not found ]
[14:21:40]   Checking for file '/usr/lib/volc/backdoor/divine' [ Not found ]
[14:21:41]   Checking for file '/usr/lib/volc/linsniff'      [ Not found ]
[14:21:41]   Checking for file '/etc/rc.d/rc1.d/S25sysconf'  [ Not found ]
[14:21:41]   Checking for file '/etc/rc.d/rc2.d/S25sysconf'  [ Not found ]
[14:21:41]   Checking for file '/etc/rc.d/rc3.d/S25sysconf'  [ Not found ]
[14:21:41]   Checking for file '/etc/rc.d/rc4.d/S25sysconf'  [ Not found ]
[14:21:41]   Checking for file '/etc/rc.d/rc5.d/S25sysconf'  [ Not found ]
[14:21:41]   Checking for directory '/var/spool/.recent'     [ Not found ]
[14:21:41]   Checking for directory '/var/spool/.recent/.files' [ Not found ]
[14:21:41]   Checking for directory '/usr/lib/volc'          [ Not found ]
[14:21:41]   Checking for directory '/usr/lib/volc/backup'   [ Not found ]
[14:21:41] Volc Rootkit                                      [ Not found ]
[14:21:41]
[14:21:41] Checking for Xzibit Rootkit...
[14:21:41]   Checking for file '/dev/dsx'                    [ Not found ]
[14:21:41]   Checking for file '/dev/caca'                   [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/linsniffer'   [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/logclear'     [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/sense'        [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/sl2'          [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/sshdu'        [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/s'            [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/ssh_host_key' [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/ssh_random_seed' [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/sl2new.c'     [ Not found ]
[14:21:41]   Checking for file '/dev/ida/.inet/tcp.log'      [ Not found ]
[14:21:41]   Checking for file '/home/httpd/cgi-bin/becys.cgi' [ Not found ]
[14:21:41]   Checking for file '/usr/local/httpd/cgi-bin/becys.cgi' [ Not found ]
[14:21:41]   Checking for file '/usr/local/apache/cgi-bin/becys.cgi' [ Not found ]
[14:21:41]   Checking for file '/www/httpd/cgi-bin/becys.cgi' [ Not found ]
[14:21:41]   Checking for file '/www/cgi-bin/becys.cgi'      [ Not found ]
[14:21:42]   Checking for directory '/dev/ida/.inet'         [ Not found ]
[14:21:42] Xzibit Rootkit                                    [ Not found ]
[14:21:42]
[14:21:42] Checking for zaRwT.KiT Rootkit...
[14:21:42]   Checking for file '/dev/rd/s/sendmeil'          [ Not found ]
[14:21:42]   Checking for file '/dev/ttyf'                   [ Not found ]
[14:21:42]   Checking for file '/dev/ttyp'                   [ Not found ]
[14:21:42]   Checking for file '/dev/ttyn'                   [ Not found ]
[14:21:42]   Checking for file '/rk/tulz'                    [ Not found ]
[14:21:42]   Checking for directory '/rk'                    [ Not found ]
[14:21:42]   Checking for directory '/dev/rd/s'              [ Not found ]
[14:21:42] zaRwT.KiT Rootkit                                 [ Not found ]
[14:21:42]
[14:21:42] Checking for ZK Rootkit...
[14:21:42]   Checking for file '/usr/share/.zk/zk'           [ Not found ]
[14:21:42]   Checking for file '/usr/X11R6/.zk/xfs'          [ Not found ]
[14:21:42]   Checking for file '/usr/X11R6/.zk/echo'         [ Not found ]
[14:21:42]   Checking for file '/etc/1ssue.net'              [ Not found ]
[14:21:42]   Checking for file '/etc/sysconfig/console/load.zk' [ Not found ]
[14:21:42]   Checking for directory '/usr/share/.zk'         [ Not found ]
[14:21:42]   Checking for directory '/usr/X11R6/.zk'         [ Not found ]
[14:21:42] ZK Rootkit                                        [ Not found ]
[14:22:06]
[14:22:06] Info: Starting test name 'additional_rkts'
[14:22:06] Performing additional rootkit checks
[14:22:06]
[14:22:06]   Performing Suckit Rookit additional checks
[14:22:06]     Checking hard link count on '/sbin/init'      [ OK ]
[14:22:06]     Checking for hidden file extensions           [ None found ]
[14:22:06]     Running skdet command                         [ Skipped ]
[14:22:06] Info: Unable to find the 'skdet' command
[14:22:06]   Suckit Rookit additional checks                 [ OK ]
[14:22:06]
[14:22:06] Info: Starting test name 'possible_rkt_files'
[14:22:06]   Performing check of possible rootkit files and directories
[14:22:07]     Checking for file '/dev/sdr0'                 [ Not found ]
[14:22:07]     Checking for file '/dev/pisu'                 [ Not found ]
[14:22:07]     Checking for file '/dev/xdta'                 [ Not found ]
[14:22:07]     Checking for file '/dev/saux'                 [ Not found ]
[14:22:07]     Checking for file '/dev/hdx'                  [ Not found ]
[14:22:07]     Checking for file '/dev/hdx1'                 [ Not found ]
[14:22:07]     Checking for file '/dev/hdx2'                 [ Not found ]
[14:22:07]     Checking for file '/dev/ptyy'                 [ Not found ]
[14:22:07]     Checking for file '/dev/ptyu'                 [ Not found ]
[14:22:07]     Checking for file '/dev/ptyv'                 [ Not found ]
[14:22:07]     Checking for file '/dev/hdbb'                 [ Not found ]
[14:22:07]     Checking for file '/tmp/.syshackfile'         [ Not found ]
[14:22:07]     Checking for file '/tmp/.bash_history'        [ Not found ]
[14:22:07]     Checking for file '/usr/info/.clib'           [ Not found ]
[14:22:07]     Checking for file '/usr/sbin/tcp.log'         [ Not found ]
[14:22:07]     Checking for file '/usr/bin/take/pid'         [ Not found ]
[14:22:07]     Checking for file '/sbin/create'              [ Not found ]
[14:22:07]     Checking for file '/dev/ttypz'                [ Not found ]
[14:22:07]     Checking for file '/var/log/tcp.log'          [ Not found ]
[14:22:07]     Checking for file '/usr/include/audit.h'      [ Not found ]
[14:22:07]     Checking for file '/usr/bin/sourcemask'       [ Not found ]
[14:22:07]     Checking for file '/usr/bin/ras2xm'           [ Not found ]
[14:22:07]     Checking for file '/dev/xmx'                  [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/gpm.root'        [ Not found ]
[14:22:08]     Checking for file '/bin/vobiscum'             [ Not found ]
[14:22:08]     Checking for file '/bin/psr'                  [ Not found ]
[14:22:08]     Checking for file '/dev/kdx'                  [ Not found ]
[14:22:08]     Checking for file '/dev/dkx'                  [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/sshd3'           [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/jcd'             [ Not found ]
[14:22:08]     Checking for file '/etc/rc.d/init.d/jcd'      [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/atd2'            [ Not found ]
[14:22:08]     Checking for file '/home/httpd/cgi-bin/linux.cgi' [ Not found ]
[14:22:08]     Checking for file '/home/httpd/cgi-bin/psid'  [ Not found ]
[14:22:08]     Checking for file '/home/httpd/cgi-bin/void.cgi' [ Not found ]
[14:22:08]     Checking for file '/etc/rc.d/init.d/system'   [ Not found ]
[14:22:08]     Checking for file '/etc/rc.d/rc3.d/S93users'  [ Not found ]
[14:22:08]     Checking for file '/tmp/.ush'                 [ Not found ]
[14:22:08]     Checking for file '/usr/lib/libhidefile.so'   [ Not found ]
[14:22:08]     Checking for file '/etc/cron.d/kmod'          [ Not found ]
[14:22:08]     Checking for file '/usr/lib/dmis/dmisd'       [ Not found ]
[14:22:08]     Checking for file '/lib/secure/libhij.so'     [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/sshd3'           [ Not found ]
[14:22:08]     Checking for file '/etc/rc.d/init.d/crontab'  [ Not found ]
[14:22:08]     Checking for file '/etc/rc.d/init.d/jcd'      [ Not found ]
[14:22:08]     Checking for file '/usr/sbin/atd2'            [ Not found ]
[14:22:09]     Checking for file '/etc/rc.d/rc5.d/S93users'  [ Not found ]
[14:22:09]     Checking for file '/usr/include/mysql/mysql.hh1' [ Not found ]
[14:22:09]     Checking for file '/etc/init.d/xfs3'          [ Not found ]
[14:22:09]     Checking for file '/usr/sbin/t.txt'           [ Not found ]
[14:22:09]     Checking for file '/usr/sbin/change'          [ Not found ]
[14:22:09]     Checking for file '/usr/sbin/s'               [ Not found ]
[14:22:09]     Checking for file '/bin/f'                    [ Not found ]
[14:22:09]     Checking for file '/bin/i'                    [ Not found ]
[14:22:09]     Checking for file '/lib/libncom.so.4.0.1'     [ Not found ]
[14:22:09]     Checking for file '/sbin/zinit'               [ Not found ]
[14:22:09]     Checking for file '/tmp/pass_ssh.log'         [ Not found ]
[14:22:09]     Checking for file '/usr/include/gpm2.h'       [ Not found ]
[14:22:09]     Checking for file '/etc/ssh/.sshd_auth'       [ Not found ]
[14:22:09]     Checking for file '/usr/lib/.sshd.h'          [ Not found ]
[14:22:09]     Checking for file '/var/run/.defunct'         [ Not found ]
[14:22:09]     Checking for file '/etc/httpd/run/.defunct'   [ Not found ]
[14:22:09]     Checking for file '/usr/share/pci.r'          [ Not found ]
[14:22:09]     Checking for file '/etc/cron.daily/dnsquery'  [ Not found ]
[14:22:09]     Checking for file '/usr/lib/libutil1.2.1.2.so' [ Not found ]
[14:22:09]     Checking for file '/bin/ceva'                 [ Not found ]
[14:22:10]     Checking for file '/sbin/syslogd<SP>'         [ Not found ]
[14:22:10]     Checking for file '/usr/include/shup.h'       [ Not found ]
[14:22:10]     Checking for file '/etc/rpm/sshdOLD'          [ Not found ]
[14:22:10]     Checking for file '/etc/rpm/sshOLD'           [ Not found ]
[14:22:10]     Checking for file '/usr/share/passwd.h'       [ Not found ]
[14:22:10]     Checking for file '/lib/.xsyslog'             [ Not found ]
[14:22:10]     Checking for file '/etc/.xsyslog'             [ Not found ]
[14:22:10]     Checking for file '/lib/.ssyslog'             [ Not found ]
[14:22:10]     Checking for file '/tmp/.sendmail'            [ Not found ]
[14:22:10]     Checking for file '/usr/share/sshd.sync'      [ Not found ]
[14:22:10]     Checking for file '/bin/zcut'                 [ Not found ]
[14:22:10]     Checking for file '/usr/bin/zmuie'            [ Not found ]
[14:22:10]     Checking for file '/lib/libkeyutils.so.1.9'   [ Not found ]
[14:22:10]     Checking for file '/lib64/libkeyutils.so.1.9' [ Not found ]
[14:22:10]     Checking for file '/usr/lib/libkeyutils.so.1.9' [ Not found ]
[14:22:10]     Checking for file '/usr/lib64/libkeyutils.so.1.9' [ Not found ]
[14:22:10]     Checking for directory '/dev/ptyas'           [ Not found ]
[14:22:10]     Checking for directory '/usr/bin/take'        [ Not found ]
[14:22:10]     Checking for directory '/usr/src/.lib'        [ Not found ]
[14:22:10]     Checking for directory '/usr/share/man/man1/.1c' [ Not found ]
[14:22:11]     Checking for directory '/lib/lblip.tk'        [ Not found ]
[14:22:11]     Checking for directory '/usr/sbin/...'        [ Not found ]
[14:22:11]     Checking for directory '/usr/share/.gun'      [ Not found ]
[14:22:11]     Checking for directory '/unde/vrei/tu/sa/te/ascunzi/in/server' [ Not found ]
[14:22:11]     Checking for directory '/usr/man/man1/..<SP><SP>/.dir' [ Not found ]
[14:22:11]     Checking for directory '/usr/X11R6/include/X11/...' [ Not found ]
[14:22:11]     Checking for directory '/usr/X11R6/lib/X11/.fonts/misc/...' [ Not found ]
[14:22:11]     Checking for directory '/tmp/.sys'            [ Not found ]
[14:22:11]     Checking for directory '/tmp/''               [ Not found ]
[14:22:11]     Checking for directory '/tmp/.,'              [ Not found ]
[14:22:11]     Checking for directory '/tmp/,.,'             [ Not found ]
[14:22:11]     Checking for directory '/dev/shm/emilien'     [ Not found ]
[14:22:11]     Checking for directory '/var/tmp/.log'        [ Not found ]
[14:22:11]     Checking for directory '/tmp/zmeu/...<SP>'    [ Not found ]
[14:22:11]     Checking for directory '/var/log/ssh'         [ Not found ]
[14:22:11]     Checking for directory '/dev/ida'             [ Not found ]
[14:22:11]     Checking for directory '/var/lib/games/.src/ssk/shit' [ Not found ]
[14:22:11]     Checking for directory '/usr/lib/libshtift'   [ Not found ]
[14:22:11]     Checking for directory '/usr/src/.poop'       [ Not found ]
[14:22:11]     Checking for directory '/dev/wd4'             [ Not found ]
[14:22:11]     Checking for directory '/var/run/.tmp'        [ Not found ]
[14:22:11]     Checking for directory '/usr/man/man1/lib/.lib' [ Not found ]
[14:22:11]     Checking for directory '/dev/portd'           [ Not found ]
[14:22:11]     Checking for directory '/dev/...'             [ Not found ]
[14:22:12]     Checking for directory '/usr/share/man/mansps' [ Not found ]
[14:22:12]     Checking for directory '/lib/.so'             [ Not found ]
[14:22:12]     Checking for directory '/lib/.sso'            [ Not found ]
[14:22:12]     Checking for directory '/usr/include/sslv3'   [ Not found ]
[14:22:12]     Checking for directory '/dev/shm/sshd'        [ Not found ]
[14:22:12]     Checking for directory '/usr/share/locale/mk/.dev/sk' [ Not found ]
[14:22:12]     Checking for directory '/usr/share/locale/mk/.dev' [ Not found ]
[14:22:12]     Checking for directory '/usr/include/netda.h' [ Not found ]
[14:22:12]     Checking for directory '/usr/include/.ssh'    [ Not found ]
[14:22:12]     Checking for directory '/usr/share/locale/jp/.<SP>' [ Not found ]
[14:22:12]     Checking for directory '/usr/share/.sqe'      [ Not found ]
[14:22:12]   Checking for possible rootkit files and directories [ None found ]
[14:22:12]
[14:22:12] Info: Starting test name 'possible_rkt_strings'
[14:22:12]   Performing check for possible rootkit strings
[14:22:12] Info: Using system startup paths: /etc/rc.d /etc/rc.local /usr/local/etc/rc.d /usr/local/etc/rc.local /etc/conf.d/local.start /etc/init.d /etc/inittab
[14:22:12] Warning: Checking for possible rootkit strings    [ Warning ]
[14:22:12]          No system startup files found.
[14:22:12]
[14:22:12] Info: Starting test name 'malware'
[14:22:12] Performing malware checks
[14:22:13]
[14:22:13] Info: Test 'deleted_files' disabled at users request.
[14:22:13]
[14:22:13] Info: Starting test name 'running_procs'
[14:22:15]   Checking running processes for suspicious files [ None found ]
[14:22:15]
[14:22:15] Info: Test 'hidden_procs' disabled at users request.
[14:22:15]
[14:22:15] Info: Test 'suspscan' disabled at users request.
[14:22:15]
[14:22:15] Info: Starting test name 'other_malware'
[14:22:15]   Performing check for login backdoors
[14:22:15]     Checking for '/bin/.login'                    [ Not found ]
[14:22:15]     Checking for '/sbin/.login'                   [ Not found ]
[14:22:15]   Checking for login backdoors                    [ None found ]
[14:22:15]
[14:22:15]   Performing check for suspicious directories
[14:22:15]     Checking for directory '/usr/X11R6/bin/.,/copy' [ Not found ]
[14:22:15]     Checking for directory '/dev/rd/cdb'          [ Not found ]
[14:22:15]   Checking for suspicious directories             [ None found ]
[14:22:15]
[14:22:15]   Checking for software intrusions                [ Skipped ]
[14:22:15] Info: Check skipped - tripwire not installed
[14:22:15]
[14:22:15]   Performing check for sniffer log files
[14:22:15]     Checking for file '/usr/lib/libice.log'       [ Not found ]
[14:22:15]     Checking for file '/dev/prom/sn.l'            [ Not found ]
[14:22:15]     Checking for file '/dev/fd/.88/zxsniff.log'   [ Not found ]
[14:22:15]   Checking for sniffer log files                  [ None found ]
[14:22:15]
[14:22:15] Suspicious Shared Memory segments
[14:22:15]   Suspicious Shared Memory segments               [ None found ]
[14:22:16]
[14:22:16] Info: Starting test name 'trojans'
[14:22:16] Performing trojan specific checks
[14:22:16]   Checking for enabled inetd services             [ Skipped ]
[14:22:16] Info: Check skipped - file '/etc/inetd.conf' does not exist.
[14:22:16]
[14:22:16]   Performing check for enabled xinetd services
[14:22:16]   Checking for enabled xinetd services            [ Skipped ]
[14:22:16] Info: Check skipped - file '/etc/xinetd.conf' does not exist.
[14:22:16]   Checking for Apache backdoor                    [ Not found ]
[14:22:16]
[14:22:16] Info: Starting test name 'os_specific'
[14:22:16] Performing Linux specific checks
[14:22:16]   Checking loaded kernel modules                  [ OK ]
[14:22:16] Info: Using modules pathname of '/lib/modules/4.0.4-2-ARCH'
[14:22:17]   Checking kernel module names                    [ OK ]
[14:22:19]
[14:22:19] Info: Starting test name 'network'
[14:22:19] Checking the network...
[14:22:19]
[14:22:19] Performing checks on the network ports
[14:22:19] Info: Starting test name 'ports'
[14:22:19]   Performing check for backdoor ports
[14:22:20]     Checking for TCP port 1524                    [ Not found ]
[14:22:20]     Checking for TCP port 1984                    [ Not found ]
[14:22:20]     Checking for UDP port 2001                    [ Not found ]
[14:22:20]     Checking for TCP port 2006                    [ Not found ]
[14:22:20]     Checking for TCP port 2128                    [ Not found ]
[14:22:20]     Checking for TCP port 6666                    [ Not found ]
[14:22:20]     Checking for TCP port 6667                    [ Not found ]
[14:22:20]     Checking for TCP port 6668                    [ Not found ]
[14:22:20]     Checking for TCP port 6669                    [ Not found ]
[14:22:20]     Checking for TCP port 7000                    [ Not found ]
[14:22:20]     Checking for TCP port 13000                   [ Not found ]
[14:22:20]     Checking for TCP port 14856                   [ Not found ]
[14:22:20]     Checking for TCP port 25000                   [ Not found ]
[14:22:20]     Checking for TCP port 29812                   [ Not found ]
[14:22:21]     Checking for TCP port 31337                   [ Not found ]
[14:22:21]     Checking for TCP port 32982                   [ Not found ]
[14:22:21]     Checking for TCP port 33369                   [ Not found ]
[14:22:21]     Checking for TCP port 47107                   [ Not found ]
[14:22:21]     Checking for TCP port 47018                   [ Not found ]
[14:22:21]     Checking for TCP port 60922                   [ Not found ]
[14:22:21]     Checking for TCP port 62883                   [ Not found ]
[14:22:21]     Checking for TCP port 65535                   [ Not found ]
[14:22:21]   Checking for backdoor ports                     [ None found ]
[14:22:21]
[14:22:21] Info: Test 'hidden_ports' disabled at users request.
[14:22:21]
[14:22:21] Performing checks on the network interfaces
[14:22:21] Info: Starting test name 'promisc'
[14:22:21]   Checking for promiscuous interfaces             [ None found ]
[14:22:21]
[14:22:21] Info: Test 'packet_cap_apps' disabled at users request.
[14:22:21]
[14:22:21] Info: Starting test name 'local_host'
[14:22:21] Checking the local host...
[14:22:21]
[14:22:21] Info: Starting test name 'startup_files'
[14:22:21] Performing system boot checks
[14:22:21]   Checking for local host name                    [ Found ]
[14:22:21]
[14:22:21] Info: Starting test name 'startup_malware'
[14:22:22]   Checking for system startup files               [ Warning ]
[14:22:22] Warning: No system startup files found.
[14:22:22]
[14:22:22] Info: Starting test name 'group_accounts'
[14:22:22] Performing group and account checks
[14:22:22]   Checking for passwd file                        [ Found ]
[14:22:22] Info: Found password file: /etc/passwd
[14:22:22]   Checking for root equivalent (UID 0) accounts   [ None found ]
[14:22:22] Info: Found shadow file: /etc/shadow
[14:22:22]   Checking for passwordless accounts              [ None found ]
[14:22:22]
[14:22:22] Info: Starting test name 'passwd_changes'
[14:22:22]   Checking for passwd file changes                [ Warning ]
[14:22:22] Warning: User 'bitdefender' has been added to the passwd file.
[14:22:22]
[14:22:22] Info: Starting test name 'group_changes'
[14:22:22]   Checking for group file changes                 [ Warning ]
[14:22:22] Warning: Group 'bitdefender' has been added to the group file.
[14:22:22]   Checking root account shell history files       [ OK ]
[14:22:22]
[14:22:22] Info: Starting test name 'system_configs'
[14:22:22] Performing system configuration file checks
[14:22:22]   Checking for an SSH configuration file          [ Found ]
[14:22:22] Info: Found an SSH configuration file: /etc/ssh/sshd_config
[14:22:22] Info: Rkhunter option ALLOW_SSH_ROOT_USER set to 'no'.
[14:22:22] Info: Rkhunter option ALLOW_SSH_PROT_V1 set to '0'.
[14:22:22]   Checking if SSH root access is allowed          [ Warning ]
[14:22:22] Warning: The SSH configuration option 'PermitRootLogin' has not been set.
           The default value may be 'yes', to allow root access.
[14:22:22]   Checking if SSH protocol v1 is allowed          [ Warning ]
[14:22:22] Warning: The SSH configuration option 'Protocol' has not been set.
           The default value may be '2,1', to allow the use of protocol version 1.
[14:22:23]   Checking for a running system logging daemon    [ Found ]
[14:22:23] Info: A running 'systemd-journald' daemon has been found.
[14:22:23] Info: Found a systemd configuration file: /etc/systemd/journald.conf
[14:22:23]   Checking for a system logging configuration file [ Found ]
[14:22:23]
[14:22:23] Info: Starting test name 'filesystem'
[14:22:23] Performing filesystem checks
[14:22:23] Info: SCAN_MODE_DEV set to 'THOROUGH'
[14:22:26]   Checking /dev for suspicious file types         [ None found ]
[14:22:27]   Checking for hidden files and directories       [ Warning ]
[14:22:27] Warning: Hidden file found: /usr/share/man/man5/.k5identity.5.gz: gzip compressed data, max compression, from Unix
[14:22:27] Warning: Hidden file found: /usr/share/man/man5/.k5login.5.gz: gzip compressed data, max compression, from Unix
[14:22:27] Warning: Hidden file found: /usr/share/man/man3/.3ssl.gz: symbolic link to SSL_CTX_use_serverinfo.3ssl.gz
[14:22:27]   Checking for missing log files                  [ Skipped ]
[14:22:27]   Checking for empty log files                    [ Skipped ]
[14:22:30]
[14:22:30] Info: Starting test name 'apps'
[14:22:30] Checking application versions...
[14:22:31] Info: Application 'exim' not found.
[14:22:31]   Checking version of GnuPG                       [ OK ]
[14:22:31] Info: Application 'gpg' version '2.1.4' found.
[14:22:31] Info: Application 'httpd' not found.
[14:22:31] Info: Application 'named' not found.
[14:22:31]   Checking version of OpenSSL                     [ OK ]
[14:22:31] Info: Application 'openssl' version '1.0.2a' found.
[14:22:31] Info: Application 'php' not found.
[14:22:31] Info: Application 'procmail' not found.
[14:22:31] Info: Application 'proftpd' not found.
[14:22:31]   Checking version of OpenSSH                     [ OK ]
[14:22:31] Info: Application 'sshd' version '6.8,' found.
[14:22:31] Info: Applications checked: 3 out of 9
[14:22:31]
[14:22:31] System checks summary
[14:22:31] =====================
[14:22:31]
[14:22:31] File properties checks...
[14:22:31] Required commands check failed
[14:22:31] Files checked: 122
[14:22:31] Suspect files: 3
[14:22:31]
[14:22:31] Rootkit checks...
[14:22:31] Rootkits checked : 263
[14:22:31] Possible rootkits: 0
[14:22:31]
[14:22:31] Applications checks...
[14:22:31] Applications checked: 3
[14:22:31] Suspect applications: 0
[14:22:31]
[14:22:31] The system checks took: 2 minutes and 16 seconds
[14:22:31]
[14:22:31] Info: End date is Sat Jun  6 14:22:31 BRT 2015

Offline

#5 2015-06-06 17:51:40

Head_on_a_Stick
Member
From: London
Registered: 2014-02-20
Posts: 5,476
Website

Re: DNS malware and dhcpcd

Remove the malicious nameserver and make resolv.conf immutable.

Sounds like your router is pwned -- change the firmware ASAP to something more open.
https://openwrt.org/
http://www.dd-wrt.com/site/index

Offline

#6 2015-06-06 18:20:23

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

Vain wrote:

Hmm... suppose your DHCP server got hijacked and it now just pushes that nameserver to your box. Wouldn't that explain your problem? Maybe you're not using DHCP on Windows?

No, just confirmed that DHCP is enabled on Windows...

The output of sudo dhcpcd -T wlp3s0 is the following:

# dhcpcd -T wlp3s0
wlp3s0: IPv6 kernel autoconf disabled
wlp3s0: IAID 43:fa:1b:eb
wlp3s0: soliciting an IPv6 router
wlp3s0: rebinding lease of 192.168.0.10
wlp3s0: leased 192.168.0.10 for 3600 seconds
interface=wlp3s0
pid=929
reason=TEST
skip_hooks=lookup-hostname
ifcarrier=up
ifflags=4163
ifmtu=1500
ifssid=KOdA
ifwireless=1
new_broadcast_address=192.168.0.255
new_dhcp_lease_time=3600
new_dhcp_message_type=5
new_dhcp_server_identifier=192.168.0.1
new_domain_name_servers='89.248.166.149 8.8.8.8'
new_ip_address=192.168.0.10
new_network_number=192.168.0.0
new_routers=192.168.0.1
new_subnet_cidr=24
new_subnet_mask=255.255.255.0
old_broadcast_address=192.168.0.255
old_dhcp_lease_time=3600
old_dhcp_message_type=5
old_dhcp_server_identifier=192.168.0.1
old_domain_name_servers='89.248.166.149 8.8.8.8'
old_ip_address=192.168.0.10
old_network_number=192.168.0.0
old_routers=192.168.0.1
old_subnet_cidr=24
old_subnet_mask=255.255.255.0
dhcpcd exited
Head_on_a_Stick wrote:

Remove the malicious nameserver and make resolv.conf immutable.

Just did that. Now, systemctl restart dhcpcd does not change /etc/resolv.conf anymore. However, the problem persists and the white boxes keep appearing on my browser, and the output of dhcpcd -T wlp3s0 hasn't changed (except for the pid value) even after a full system restart.
Now, sorry if I'm mistaken, but if the problem was the router, wouldn't the same problem be reflected on Windows or other computers in the same network? As far I'm concerned, only my PC seems to be malfunctioning... Anyway, I'll take a look at the suggested firmware, although I won't be able to update the router right now.

Offline

#7 2015-06-06 18:44:58

graysky
Wiki Maintainer
From: :wq
Registered: 2008-12-01
Posts: 10,018
Website

Re: DNS malware and dhcpcd

Remove dhcpcd and try netctl... problem in that package?


CPU-optimized Linux-ck packages @ Repo-ck  • AUR packagesZsh and other configs

Offline

#8 2015-06-06 19:36:20

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

graysky wrote:

Remove dhcpcd and try netctl... problem in that package?

No luck... netctl and wicd gave the same result and the problem persists.

Offline

#9 2015-06-06 19:44:53

graysky
Wiki Maintainer
From: :wq
Registered: 2008-12-01
Posts: 10,018
Website

Re: DNS malware and dhcpcd

What if you boot to a live CD/USB and then cat /etc/resolv.conf?  Does it have the bad entry?  If not, that could support the idea that your Linux install is actually what is compromised, not your router... you already know that your windows is unaffected.


CPU-optimized Linux-ck packages @ Repo-ck  • AUR packagesZsh and other configs

Offline

#10 2015-06-06 19:59:24

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

Just a while ago, Head_on_a_Stick suggests me to make /etc/resolv.conf immutable, as did this link. I did that and the file wasn't changed since, i.e. the bad nameserver isn't there anymore. However, I already know that using dhcpcd, netctl or wicd returns the same problem, even with /etc/resolv.conf immutable and correctly filled. This file must not be the problem, then. What else could be?

Offline

#11 2015-06-06 20:08:58

graysky
Wiki Maintainer
From: :wq
Registered: 2008-12-01
Posts: 10,018
Website

Re: DNS malware and dhcpcd

adoksl wrote:

Just a while ago, Head_on_a_Stick suggests me to make /etc/resolv.conf immutable, as did this link. I did that and the file wasn't changed since, i.e. the bad nameserver isn't there anymore. However, I already know that using dhcpcd, netctl or wicd returns the same problem, even with /etc/resolv.conf immutable and correctly filled. This file must not be the problem, then. What else could be?

Not sure.  Guess I would modify my experiment to put a fresh Arch install on a blank partition, GUI and all, then see if the same web browser gives the same white boxes... maybe an easier experiment is for you to create a new user on your existing Arch install, then browse to the website.  White boxes present?  If not, perhaps the problem lies in your browser profile.


CPU-optimized Linux-ck packages @ Repo-ck  • AUR packagesZsh and other configs

Offline

#12 2015-06-06 20:43:02

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

Nice! Thank you for your precise suggestion, graysky. Just created a dummy account and tested its functionality. I haven't detected any problem in this fresh account's browsers: both Firefox and Chromium are working well. Well, now I'm gonna full reinstall these browsers on my user account and verify if the problem is over.

However, does the browser profile explain the changes in /etc/resolv.conf? Is there a malware in these softwares that enable them do this kind of trickery? I mean, could I be still under the menace of an undetected malware?

Offline

#13 2015-06-06 21:27:52

graysky
Wiki Maintainer
From: :wq
Registered: 2008-12-01
Posts: 10,018
Website

Re: DNS malware and dhcpcd

1) No need to do a full reinstall since it the "bad" stuff could be in the profiles, not the package provided files.
2) No, it does not explain the /etc/resolv.conf but it could be that whatever did modify that was also the vector into your profiles.  I do not know.

...if it were my system, I would make sure that my critical data files less the browser profiles are backed-up (you can save your bookmarks but that's it in my opinion), then nuke the partitions from orbit (ie from a live USB) and do a full reinstall of Arch, then restore my data.  That's just me.


CPU-optimized Linux-ck packages @ Repo-ck  • AUR packagesZsh and other configs

Offline

#14 2015-06-06 23:55:05

bleach
Member
Registered: 2013-07-26
Posts: 264

Re: DNS malware and dhcpcd

isp's(us as far as I know) like to impose on resolve i am looking at you comcast chattr is a nice tool.

Offline

#15 2015-06-07 20:02:09

adoksl
Member
Registered: 2015-06-06
Posts: 7

Re: DNS malware and dhcpcd

graysky wrote:

...if it were my system, I would make sure that my critical data files less the browser profiles are backed-up (you can save your bookmarks but that's it in my opinion), then nuke the partitions from orbit (ie from a live USB) and do a full reinstall of Arch, then restore my data.  That's just me.

Thank you for your support, graysky. Unfortunately, I'll have to delay this reinstall 'til next month, but I'll do it for sure. Breaks my heart being forced to do this kind of thing, specially on Linux.

bleach wrote:

isp's(us as far as I know) like to impose on resolve i am looking at you comcast chattr is a nice tool.

Not sure the problem was the ISP. Just changed my location (and ISP) and the problem is still bugging me...

Offline

#16 2015-06-10 18:49:43

aelfric
Member
Registered: 2015-06-10
Posts: 1

Re: DNS malware and dhcpcd

The problem is probably in your router

http://www.theregister.co.uk/2015/05/26 … er_attack/

Offline

#17 2015-06-10 20:50:11

karol
Archivist
Registered: 2009-05-06
Posts: 25,440

Re: DNS malware and dhcpcd

OP said his other computer running Windows works fine.

Offline

#18 2015-06-11 09:19:37

rsmarples
Member
Registered: 2009-05-12
Posts: 245

Re: DNS malware and dhcpcd

new_dhcp_server_identifier=192.168.0.1
new_domain_name_servers='89.248.166.149 8.8.8.8'

So this shows you got a DHCP message from 192.168.0.1 with the dns servers 89.248.166.149 and 8.8.8.8, which are the the same servers in your resolv.conf which you claim are incorrect.
dhcpcd in this case is just doing what it is told, as will other clients.

I would run a wireshark trace to verify this, as the DHCP server id is plucked from the DHCP message and is not the actual ip address of the device that sent the packet.
You could have a rogue DHCP server or as others have said, your router is owned and should be re-imaged.

Offline

Board footer

Powered by FluxBB