Ubuntu Forums Archive Viewer

please help with rkhunter

Archived thread 1006870 from Security. Markdown source: Security/thread_1006870_please_help_with_rkhunter.md

Original URL About this archive
#1

could someone please look at my logfile and let me know if my system has been compromised. I got several warnings while running RKhunter. It doesn't look bad to me but I am not sure.

[20:48:37] /usr/sbin/unhide                                  [ Warning ]
[20:48:37] Warning: The file '/usr/sbin/unhide' exists on the system, but it is not present in the rkhunter.dat file.
[20:48:37] /usr/sbin/useradd                                 [ OK ]
[20:48:37] /usr/sbin/userdel                                 [ OK ]
[20:48:37] /usr/sbin/usermod                                 [ OK ]
[20:48:38] /usr/sbin/vipw                                    [ OK ]
[20:48:38] /usr/sbin/unhide-linux26                          [ Warning ]
[20:48:38] Warning: The file '/usr/sbin/unhide-linux26' exists on the system, but it is not present in the rkhunter.dat file.
[20:51:24] Performing filesystem checks
[20:51:24] Info: Starting test name 'filesystem'
[20:51:24] Info: SCAN_MODE_DEV set to 'THOROUGH'
[20:51:27]   Checking /dev for suspicious file types         [ Warning ]
[20:51:27] Warning: Suspicious file types found in /dev:
[20:51:27]          /dev/shm/pulse-shm-2035059263: data
[20:51:28]   Checking for hidden files and directories       [ None found ]

sorry if this is a stupid question it is my first time using Rkhunter so I don't know what to expect. thanks for the help.

#2

So just to be safe I did a fresh install. I used Dariks boot and nuke just to be safe. after the fresh install I installed rkhunter and ran another scan. I came up with the same warning results. So I am assuming that these are false positives. I am just looking for a second opinion on that.

#3

They are likely false positives.

If in doubt, google is your friend. If it is a known exploit, or a know false positive, google should give you some information. If not, I suggest you report it as a false positive to the depelopers.

#4

When you installed rkhunter, unhide was installed as a "recommend", and is used by rkhunter. I would doubt that it's anything more than a false positive.

https://launchpad.net/ubuntu/intrepid/+package/unhide

#5

Run

sudo rkhunter --propupd
#6

hey the --propupd was a real help the warnings disappeared after that. except the suspicious file type warning in /dev but I don't think that is a concern thanks!!