Results 1 to 6 of 6

Thread: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

  1. #1
    Join Date
    Oct 2006
    Location
    Queens, NY
    Beans
    71
    Distro
    Kubuntu 18.04 Bionic Beaver

    chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

    Hello,

    I'm using:
    -chkrootkit version 0.48
    -Rootkit Hunter version 1.3.4
    -Ubuntu 9.10

    I don't know much about computers.

    A) Yesterday I ran 'chkrootkit' and it indicated:
    - Searching for Suckit rootkit... Warning: /sbin/init INFECTED
    Then, I ran 'rkhunter -c' and it said my PC did not have Suckit:
    - Suckit Rootkit [ Not found ]

    B) So, I thought my PC might be infected. So I reinstalled from scratch. After re-installing Ubuntu I installed 'chkrootkit' and ran it and it said:
    - Searching for Suckit rootkit... nothing found

    C) Next, I updated the system with Synaptic Package Manager. And I re-ran 'chkrootkit'. This time it found it again and said:
    - Searching for Suckit rootkit... Warning: /sbin/init INFECTED
    I also re-ran 'rkhunter -c'
    - Suckit Rootkit [ Not found ]

    D) What would you suggest the next step be? Should I ignore this?

  2. #2
    Join Date
    Oct 2006
    Beans
    4,628
    Distro
    Kubuntu 18.10 Cosmic Cuttlefish

    Re: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

    Did you add any third party repos or install anything from outside the official Ubuntu repos between the time you reinstalled and the time you installed the updates? If not it's most likely a false positive.
    Blog | Ubuntu User #15350 | Zsh FTW | Ubuntu Security | Nothing to hide?
    AMD Phenom II X6 1075T @ 3GHz, Nvidia GTX 650, 8GB DDR3 RAM, 1 X 1TB, 2 X 3TB HDD
    Please don't request support via PM


  3. #3
    Join Date
    Jan 2007
    Beans
    1,795

    Re: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

    chkrootkit has so many false positives I don't know how anyone uses it.

  4. #4
    Join Date
    Oct 2006
    Location
    Queens, NY
    Beans
    71
    Distro
    Kubuntu 18.04 Bionic Beaver

    Re: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

    Thanks for your help. I only use the default repos.
    I'll assume it's a false positive.

    Thanks!

  5. #5
    Join Date
    Jul 2007
    Location
    Magic City of the Plains
    Beans
    Hidden!
    Distro
    Xubuntu Development Release

    Re: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.


  6. #6
    Join Date
    Oct 2006
    Location
    Queens, NY
    Beans
    71
    Distro
    Kubuntu 18.04 Bionic Beaver

    Re: chkrootkit indicates Suckit Rootkit. Rootkit Hunter does not.

    Quote Originally Posted by oldos2er View Post
    Thank you!

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •