# The Ubuntu Forum Community > Ubuntu Specialised Support > Security > [ubuntu] CHKRootkit returned a positive, RKHunter did not.

## LeoSolaris

I ran a random chkrootkit and it came back with two possible positives. before panicing, I did an rkhunter as well. The rkhunter did not return anything more than warnings. I did a tiger scan, but it uses chkrootkit for it's rootkit scan anyways, so it just returned the same two possible positives.

I have a couple of non-standard repos, they are as follows:

http://ppa.launchpad.net/reacocard-awn/ubuntu hardy
http://ppa.launchpad.net/lxde/ubuntu hardy
http://packages.medibuntu.org/ hardy
http://wine.budgetdedicated.com/apt hardy main

My Hardy install is fully updated to 8.04.1 from the main server.

Here's the chkrootkit scan results:



```
11:54 AM on Wed Jul 30 leo-laptop: ~$ sudo chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `crontab'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not found
Checking `grep'... not infected
Checking `hdparm'... not infected
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not infected
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not found
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... not found
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not found
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... 
/usr/lib/xulrunner-1.9.0.1/.autoreg
/usr/lib/firefox-3.0.1/.autoreg
/usr/lib/jvm/.java-6-sun.jinfo
/usr/lib/jvm/.java-6-openjdk.jinfo
/usr/lib/jvm/java-6-sun-1.6.0.06/.systemPrefs
/lib/linux-restricted-modules/.nvidia_new_installed
/lib/modules/2.6.24-20-generic/volatile/.mounted

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for OBSD rk v1... /usr/lib/security
/usr/lib/security/classpath.security
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for Fu rootkit default files... nothing found
Searching for ESRK rootkit default files... nothing found
Searching for rootedoor... nothing found
Searching for ENYELKM rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... INFECTED (PORTS:  1524 6667 31337)
Checking `lkm'... chkproc: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
wlan0: PACKET SNIFFER(/sbin/wpa_supplicant[8501], /sbin/dhclient3[8571])
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... chklastlog: nothing deleted
```

Here is my /var/log/rkhunter.log



```
[11:58:15] Running Rootkit Hunter version 1.3.0 on leo-laptop
[11:58:15]
[11:58:15] Info: Start date is Wed Jul 30 11:58:15 EDT 2008
[11:58:15]
[11:58:15] Checking configuration file and command-line options...
[11:58:15] Info: Detected operating system is 'Linux'
[11:58:15] Info: Found O/S name: Ubuntu 8.04.1
[11:58:15] Info: Command line is /usr/bin/rkhunter -c --sk
[11:58:15] Info: Environment shell is /bin/bash; rkhunter is using dash
[11:58:15] Info: Using configuration file '/etc/rkhunter.conf'
[11:58:15] Info: Installation directory is '/usr'
[11:58:15] Info: Using language 'en'
[11:58:15] Info: Using '/var/lib/rkhunter/db' as the database directory
[11:58:15] Info: Using '/usr/share/rkhunter/scripts' as the support script directory
[11:58:15] Info: Using '/usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /sbin /bin /usr/X11R6/bin /bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin /usr/libexec /usr/local/libexec' as the command directories
[11:58:15] Info: Using '/' as the root directory
[11:58:15] Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
[11:58:15] Info: No mail-on-warning address configured
[11:58:15] Info: X will automatically be detected
[11:58:15] Info: Using second color set
[11:58:15] Info: Found the 'diff' command: /usr/bin/diff
[11:58:15] Info: Found the 'file' command: /usr/bin/file
[11:58:15] Info: Found the 'find' command: /usr/bin/find
[11:58:15] Info: Found the 'ifconfig' command: /sbin/ifconfig
[11:58:15] Info: Found the 'ip' command: /sbin/ip
[11:58:15] Info: Found the 'ldd' command: /usr/bin/ldd
[11:58:16] Info: Found the 'lsattr' command: /usr/bin/lsattr
[11:58:16] Info: Found the 'lsmod' command: /sbin/lsmod
[11:58:16] Info: Found the 'lsof' command: /usr/bin/lsof
[11:58:16] Info: Found the 'mktemp' command: /bin/mktemp
[11:58:16] Info: Found the 'netstat' command: /bin/netstat
[11:58:16] Info: Found the 'perl' command: /usr/bin/perl
[11:58:16] Info: Found the 'ps' command: /bin/ps
[11:58:16] Info: Found the 'pwd' command: /bin/pwd
[11:58:16] Info: Found the 'readlink' command: /bin/readlink
[11:58:16] Info: Found the 'sort' command: /usr/bin/sort
[11:58:16] Info: Found the 'stat' command: /usr/bin/stat
[11:58:16] Info: Found the 'strings' command: /usr/bin/strings
[11:58:16] Info: Found the 'uniq' command: /usr/bin/uniq
[11:58:16] Info: System is not using prelinking
[11:58:16] Info: Using the '/usr/bin/sha1sum' command for the file hash checks
[11:58:16] Info: Stored hash values used hash function '/usr/bin/sha1sum'
[11:58:16] Info: Stored hash values did not use a package manager
[11:58:16] Info: The hash function field index is set to 1
[11:58:16] Info: No package manager specified: using hash function '/usr/bin/sha1sum'
[11:58:16] Info: Previous file attributes were stored
[11:58:16] Info: Enabled tests are: all
[11:58:16] Info: Disabled tests are: suspscan hidden_procs deleted_files packet_cap_apps
[11:58:16] Info: Found ksym file '/proc/kallsyms'
[11:58:16]
[11:58:16] Checking if the O/S has changed since last time...
[11:58:16] Info: Nothing seems to have changed
[11:58:16]
[11:58:16] Starting system checks...
[11:58:16]
[11:58:16] Checking system commands...
[11:58:16] Info: Starting test name 'system_commands'
[11:58:16]
[11:58:16] Performing 'strings' command checks
[11:58:16] Info: Starting test name 'strings'
[11:58:16] Scanning for string /usr/sbin/ntpsx               [ OK ]
[11:58:16] Scanning for string /usr/lib/.../ls               [ OK ]
[11:58:16] Scanning for string /usr/lib/.../netstat          [ OK ]
[11:58:16] Scanning for string /usr/lib/.../lsof             [ OK ]
[11:58:16] Scanning for string /usr/lib/.../bkit-ssh/bkit-shdcfg [ OK ]
[11:58:16] Scanning for string /usr/lib/.../bkit-ssh/bkit-shhk [ OK ]
[11:58:16] Scanning for string /usr/lib/.../bkit-ssh/bkit-pw [ OK ]
[11:58:16] Scanning for string /usr/lib/.../bkit-ssh/bkit-shrs [ OK ]
[11:58:16] Scanning for string /usr/lib/.../uconf.inv        [ OK ]
[11:58:16] Scanning for string /usr/lib/.../psr              [ OK ]
[11:58:16] Scanning for string /usr/lib/.../find             [ OK ]
[11:58:16] Scanning for string /usr/lib/.../pstree           [ OK ]
[11:58:16] Scanning for string /usr/lib/.../slocate          [ OK ]
[11:58:17] Scanning for string /usr/lib/.../du               [ OK ]
[11:58:17] Scanning for string /usr/lib/.../top              [ OK ]
[11:58:17] Scanning for string /usr/lib/...                  [ OK ]
[11:58:17] Scanning for string /usr/lib/.../bkit-ssh         [ OK ]
[11:58:17] Scanning for string /usr/lib/.bkit-               [ OK ]
[11:58:17] Scanning for string /tmp/.bkp                     [ OK ]
[11:58:17] Scanning for string /tmp/.cinik                   [ OK ]
[11:58:17] Scanning for string /tmp/.font-unix/.cinik        [ OK ]
[11:58:17] Scanning for string /lib/.sso                     [ OK ]
[11:58:17] Scanning for string /lib/.so                      [ OK ]
[11:58:17] Scanning for string /var/run/...dica/clean        [ OK ]
[11:58:17] Scanning for string /var/run/...dica/xl           [ OK ]
[11:58:17] Scanning for string /var/run/...dica/xdr          [ OK ]
[11:58:17] Scanning for string /var/run/...dica/psg          [ OK ]
[11:58:17] Scanning for string /var/run/...dica/secure       [ OK ]
[11:58:17] Scanning for string /var/run/...dica/rdx          [ OK ]
[11:58:17] Scanning for string /var/run/...dica/va           [ OK ]
[11:58:17] Scanning for string /var/run/...dica/cl.sh        [ OK ]
[11:58:17] Scanning for string /usr/bin/.etc                 [ OK ]
[11:58:17] Scanning for string /usr/lib/.fx/sched_host.2     [ OK ]
[11:58:17] Scanning for string /usr/lib/.fx/random_d.2       [ OK ]
[11:58:17] Scanning for string /usr/lib/.fx/set_pid.2        [ OK ]
[11:58:17] Scanning for string /usr/lib/.fx/cons.saver       [ OK ]
[11:58:17] Scanning for string /usr/lib/.fx/adore/adore/adore.ko [ OK ]
[11:58:17] Scanning for string /bin/sysback                  [ OK ]
[11:58:17] Scanning for string /usr/local/bin/sysback        [ OK ]
[11:58:17] Scanning for string /usr/lib/.tbd                 [ OK ]
[11:58:17] Scanning for string /dev/.lib/lib/lib/t0rns       [ OK ]
[11:58:17] Scanning for string /dev/.lib/lib/lib/du          [ OK ]
[11:58:17] Scanning for string /dev/.lib/lib/lib/ls          [ OK ]
[11:58:17] Scanning for string /dev/.lib/lib/lib/t0rnsb      [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/ps          [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/t0rnp       [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/find        [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/ifconfig    [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/pg          [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/ssh.tgz     [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/top         [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/sz          [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/login       [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/in.fingerd  [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/1i0n.sh     [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/pstree      [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/in.telnetd  [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/mjy         [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/sush        [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/tfn         [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/name        [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/getip.sh    [ OK ]
[11:58:18] Scanning for string /usr/info/.torn/sh*           [ OK ]
[11:58:18] Scanning for string /usr/src/.****/.1addr         [ OK ]
[11:58:18] Scanning for string /usr/src/.****/.1file         [ OK ]
[11:58:18] Scanning for string /usr/src/.****/.1proc         [ OK ]
[11:58:18] Scanning for string /usr/src/.****/.1logz         [ OK ]
[11:58:18] Scanning for string /usr/info/.t0rn               [ OK ]
[11:58:18] Scanning for string /dev/.lib                     [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib                 [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib             [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/lib/dev         [ OK ]
[11:58:18] Scanning for string /dev/.lib/lib/scan            [ OK ]
[11:58:18] Scanning for string /usr/src/.****                [ OK ]
[11:58:18] Scanning for string /usr/man/man1/man1            [ OK ]
[11:58:19] Scanning for string /usr/man/man1/man1/lib        [ OK ]
[11:58:19] Scanning for string /usr/man/man1/man1/lib/.lib   [ OK ]
[11:58:19] Scanning for string /usr/man/man1/man1/lib/.lib/.backup [ OK ]
[11:58:19]
[11:58:19] Performing 'shared libraries' checks
[11:58:19] Info: Starting test name 'shared_libs'
[11:58:19] Checking for preloading variables                 [ None found ]
[11:58:19] Checking for preload file                         [ Not found ]
[11:58:19] Info: Starting test name 'shared_libs_path'
[11:58:19] Checking LD_LIBRARY_PATH variable                 [ Not found ]
[11:58:19]
[11:58:19] Performing file properties checks
[11:58:19] Info: Starting test name 'properties'
[11:58:19] Checking for prerequisites                        [ OK ]
[11:58:19] /bin/bash                                         [ OK ]
[11:58:19] /bin/cat                                          [ OK ]
[11:58:19] /bin/chmod                                        [ OK ]
[11:58:20] /bin/chown                                        [ OK ]
[11:58:20] /bin/cp                                           [ OK ]
[11:58:20] /bin/date                                         [ OK ]
[11:58:20] /bin/df                                           [ OK ]
[11:58:20] /bin/dmesg                                        [ OK ]
[11:58:20] /bin/echo                                         [ OK ]
[11:58:20] /bin/ed                                           [ OK ]
[11:58:20] /bin/egrep                                        [ OK ]
[11:58:20] Info: Found file '/bin/egrep': it is whitelisted for the 'script replacement' check.
[11:58:21] /bin/fgrep                                        [ OK ]
[11:58:21] Info: Found file '/bin/fgrep': it is whitelisted for the 'script replacement' check.
[11:58:21] /bin/grep                                         [ OK ]
[11:58:21] /bin/ip                                           [ Warning ]
[11:58:21] Warning: The file properties have changed:
[11:58:21]          File: /bin/ip
[11:58:21]          Current inode: 122464    Stored inode: 122447
[11:58:21]          Current file modification time: 1215621293
[11:58:21]          Stored file modification time : 1207985280
[11:58:21] /bin/kill                                         [ Warning ]
[11:58:21] Warning: The file properties have changed:
[11:58:21]          File: /bin/kill
[11:58:21]          Current hash: 84e9b211a9a8b630da0421714d393fbc849922ea
[11:58:21]          Stored hash : e0baf2e8f195d5f58ba1d6253d152c5da35fea92
[11:58:21]          Current inode: 122447    Stored inode: 122449
[11:58:21]          Current file modification time: 1215682145
[11:58:21]          Stored file modification time : 1205449373
[11:58:21] /bin/login                                        [ OK ]
[11:58:22] /bin/ls                                           [ OK ]
[11:58:22] /bin/lsmod                                        [ OK ]
[11:58:22] /bin/mktemp                                       [ OK ]
[11:58:22] /bin/more                                         [ OK ]
[11:58:22] /bin/mount                                        [ OK ]
[11:58:22] /bin/mv                                           [ OK ]
[11:58:22] /bin/netstat                                      [ OK ]
[11:58:22] /bin/ps                                           [ Warning ]
[11:58:22] Warning: The file properties have changed:
[11:58:22]          File: /bin/ps
[11:58:23]          Current hash: e2a3f61272faa77bcf5560e2d16333f4a960d676
[11:58:23]          Stored hash : 585c1ea7e99a8c0bc5a0701c307b8f6bb7593200
[11:58:23]          Current inode: 122476    Stored inode: 122485
[11:58:23]          Current file modification time: 1215682145
[11:58:23]          Stored file modification time : 1205449373
[11:58:23] /bin/pwd                                          [ OK ]
[11:58:23] /bin/readlink                                     [ OK ]
[11:58:23] /bin/sed                                          [ OK ]
[11:58:23] /bin/sh                                           [ OK ]
[11:58:23] /bin/su                                           [ OK ]
[11:58:23] /bin/touch                                        [ OK ]
[11:58:24] /bin/uname                                        [ OK ]
[11:58:24] /bin/which                                        [ OK ]
[11:58:24] Info: Found file '/bin/which': it is whitelisted for the 'script replacement' check.
[11:58:24] /bin/dash                                         [ OK ]
[11:58:24] /usr/bin/awk                                      [ OK ]
[11:58:24] /usr/bin/basename                                 [ OK ]
[11:58:24] /usr/bin/chattr                                   [ OK ]
[11:58:24] /usr/bin/cut                                      [ OK ]
[11:58:25] /usr/bin/diff                                     [ OK ]
[11:58:25] /usr/bin/dirname                                  [ OK ]
[11:58:25] /usr/bin/dpkg                                     [ OK ]
[11:58:25] /usr/bin/dpkg-query                               [ OK ]
[11:58:25] /usr/bin/du                                       [ OK ]
[11:58:25] /usr/bin/env                                      [ OK ]
[11:58:25] /usr/bin/file                                     [ OK ]
[11:58:25] /usr/bin/find                                     [ OK ]
[11:58:26] /usr/bin/GET                                      [ OK ]
[11:58:26] /usr/bin/groups                                   [ OK ]
[11:58:26] Info: Found file '/usr/bin/groups': it is whitelisted for the 'script replacement' check.
[11:58:26] /usr/bin/head                                     [ OK ]
[11:58:26] /usr/bin/id                                       [ OK ]
[11:58:26] /usr/bin/killall                                  [ OK ]
[11:58:26] /usr/bin/last                                     [ OK ]
[11:58:26] /usr/bin/lastlog                                  [ OK ]
[11:58:26] /usr/bin/ldd                                      [ OK ]
[11:58:26] Info: Found file '/usr/bin/ldd': it is whitelisted for the 'script replacement' check.
[11:58:27] /usr/bin/less                                     [ OK ]
[11:58:27] /usr/bin/locate                                   [ OK ]
[11:58:27] /usr/bin/logger                                   [ OK ]
[11:58:27] /usr/bin/lsattr                                   [ OK ]
[11:58:27] /usr/bin/lsof                                     [ OK ]
[11:58:27] /usr/bin/mail                                     [ OK ]
[11:58:27] /usr/bin/md5sum                                   [ OK ]
[11:58:27] /usr/bin/mlocate                                  [ OK ]
[11:58:28] /usr/bin/newgrp                                   [ OK ]
[11:58:28] /usr/bin/passwd                                   [ OK ]
[11:58:28] /usr/bin/perl                                     [ OK ]
[11:58:28] /usr/bin/pstree                                   [ OK ]
[11:58:28] /usr/bin/rkhunter                                 [ OK ]
[11:58:28] /usr/bin/rpm                                      [ Warning ]
[11:58:28] Warning: The file '/usr/bin/rpm' exists on the system, but it is not present in the rkhunter.dat file.
[11:58:28] /usr/bin/runcon                                   [ OK ]
[11:58:29] /usr/bin/sha1sum                                  [ OK ]
[11:58:29] /usr/bin/size                                     [ OK ]
[11:58:29] /usr/bin/sort                                     [ OK ]
[11:58:29] /usr/bin/stat                                     [ OK ]
[11:58:29] /usr/bin/strace                                   [ OK ]
[11:58:29] /usr/bin/strings                                  [ OK ]
[11:58:29] /usr/bin/sudo                                     [ OK ]
[11:58:29] /usr/bin/tail                                     [ OK ]
[11:58:29] /usr/bin/test                                     [ OK ]
[11:58:30] /usr/bin/top                                      [ Warning ]
[11:58:30] Warning: The file properties have changed:
[11:58:30]          File: /usr/bin/top
[11:58:30]          Current hash: b4cf2a58383c07c23bb012a63b2608b82b3d6c40
[11:58:30]          Stored hash : 38c45e2dc5972a8177f364bbb81c6e246817a934
[11:58:30]          Current inode: 294642    Stored inode: 294793
[11:58:30]          Current file modification time: 1215682145
[11:58:30]          Stored file modification time : 1205449373
[11:58:30] /usr/bin/touch                                    [ OK ]
[11:58:30] /usr/bin/tr                                       [ OK ]
[11:58:30] /usr/bin/uniq                                     [ OK ]
[11:58:30] /usr/bin/users                                    [ OK ]
[11:58:30] /usr/bin/vmstat                                   [ Warning ]
[11:58:30] Warning: The file properties have changed:
[11:58:30]          File: /usr/bin/vmstat
[11:58:30]          Current hash: ac7946f2f2021ca52aae91db9844de1c3651e0e4
[11:58:30]          Stored hash : b0ddafbaa624a5a9cce0667ada94a4f084e94a9e
[11:58:30]          Current inode: 294651    Stored inode: 294868
[11:58:30]          Current file modification time: 1215682145
[11:58:30]          Stored file modification time : 1205449373
[11:58:31] /usr/bin/w                                        [ Warning ]
[11:58:31] Warning: The file properties have changed:
[11:58:31]          File: /usr/bin/w
[11:58:31]          Current hash: cacc1a2b6f692350301516a0e380e18ffa901cd9
[11:58:31]          Stored hash : 17aad0b16c5cc7f079784ce8b0436654325de29d
[11:58:31] /usr/bin/watch                                    [ Warning ]
[11:58:31] Warning: The file properties have changed:
[11:58:31]          File: /usr/bin/watch
[11:58:31]          Current hash: 78dfee98aa89089b102a100665c1352b15bedfbf
[11:58:31]          Stored hash : 0c484585d78e62e691adf4d32f55dd877e2f5c7c
[11:58:31]          Current inode: 297982    Stored inode: 294877
[11:58:31]          Current file modification time: 1215682145
[11:58:31]          Stored file modification time : 1205449373
[11:58:31] /usr/bin/wc                                       [ OK ]
[11:58:31] /usr/bin/wget                                     [ OK ]
[11:58:31] /usr/bin/whatis                                   [ OK ]
[11:58:31] /usr/bin/whereis                                  [ OK ]
[11:58:31] /usr/bin/which                                    [ OK ]
[11:58:32] /usr/bin/who                                      [ OK ]
[11:58:32] /usr/bin/whoami                                   [ OK ]
[11:58:32] /usr/bin/mawk                                     [ OK ]
[11:58:32] /usr/bin/lwp-request                              [ OK ]
[11:58:32] Info: Found file '/usr/bin/lwp-request': it is whitelisted for the 'script replacement' check.
[11:58:32] /usr/bin/w.procps                                 [ Warning ]
[11:58:32] Warning: The file properties have changed:
[11:58:32]          File: /usr/bin/w.procps
[11:58:32]          Current hash: cacc1a2b6f692350301516a0e380e18ffa901cd9
[11:58:32]          Stored hash : 17aad0b16c5cc7f079784ce8b0436654325de29d
[11:58:32]          Current inode: 298376    Stored inode: 294873
[11:58:32]          Current file modification time: 1215682145
[11:58:32]          Stored file modification time : 1205449373
[11:58:33] /sbin/depmod                                      [ OK ]
[11:58:33] /sbin/ifconfig                                    [ OK ]
[11:58:33] /sbin/ifdown                                      [ OK ]
[11:58:33] /sbin/ifup                                        [ OK ]
[11:58:33] /sbin/init                                        [ OK ]
[11:58:33] /sbin/insmod                                      [ OK ]
[11:58:33] /sbin/ip                                          [ Warning ]
[11:58:33] Warning: The file properties have changed:
[11:58:33]          File: /sbin/ip
[11:58:33]          Current inode: 212279    Stored inode: 212217
[11:58:33]          Current file modification time: 1215987445
[11:58:33]          Stored file modification time : 1211357699
[11:58:34] /sbin/lsmod                                       [ OK ]
[11:58:34] /sbin/modinfo                                     [ OK ]
[11:58:34] /sbin/modprobe                                    [ OK ]
[11:58:34] /sbin/rmmod                                       [ OK ]
[11:58:34] /sbin/runlevel                                    [ OK ]
[11:58:34] /sbin/sulogin                                     [ OK ]
[11:58:35] /sbin/sysctl                                      [ Warning ]
[11:58:35] Warning: The file properties have changed:
[11:58:35]          File: /sbin/sysctl
[11:58:35]          Current hash: 9ff13a7b24c9ef73cc8bf3577c97b77a40d3c1d2
[11:58:35]          Stored hash : a490b16d64f78bf8108e50a6b46d0e43d500d6ad
[11:58:35]          Current inode: 212217    Stored inode: 212310
[11:58:35]          Current file modification time: 1215682145
[11:58:35]          Stored file modification time : 1205449373
[11:58:35] /sbin/syslogd                                     [ OK ]
[11:58:35] /usr/sbin/adduser                                 [ OK ]
[11:58:35] Info: Found file '/usr/sbin/adduser': it is whitelisted for the 'script replacement' check.
[11:58:35] /usr/sbin/chroot                                  [ OK ]
[11:58:35] /usr/sbin/cron                                    [ OK ]
[11:58:36] /usr/sbin/groupadd                                [ OK ]
[11:58:36] /usr/sbin/groupdel                                [ OK ]
[11:58:36] /usr/sbin/groupmod                                [ OK ]
[11:58:36] /usr/sbin/grpck                                   [ OK ]
[11:58:36] /usr/sbin/nologin                                 [ OK ]
[11:58:36] /usr/sbin/pwck                                    [ OK ]
[11:58:37] /usr/sbin/tcpd                                    [ OK ]
[11:58:37] /usr/sbin/unhide                                  [ OK ]
[11:58:37] /usr/sbin/useradd                                 [ OK ]
[11:58:37] /usr/sbin/userdel                                 [ OK ]
[11:58:37] /usr/sbin/usermod                                 [ OK ]
[11:58:37] /usr/sbin/vipw                                    [ OK ]
[11:58:37] /usr/sbin/unhide-linux26                          [ OK ]
[11:58:39]
[11:58:39] Checking for rootkits...
[11:58:39] Info: Starting test name 'rootkits'
[11:58:39]
[11:58:39] Performing check of known rootkit files and directories
[11:58:39] Info: Starting test name 'known_rkts'
[11:58:39]
[11:58:39] Checking for 55808 Trojan - Variant A...
[11:58:39]   Checking for file '/tmp/.../r'                  [ Not found ]
[11:58:39]   Checking for file '/tmp/.../a'                  [ Not found ]
[11:58:39] 55808 Trojan - Variant A                          [ Not found ]
[11:58:39]
[11:58:39] Checking for ADM Worm...
[11:58:39]   Checking for string 'w0rm'                      [ Not found ]
[11:58:39] ADM Worm                                          [ Not found ]
[11:58:39]
[11:58:39] Checking for AjaKit Rootkit...
[11:58:39]   Checking for file '/dev/tux/.addr'              [ Not found ]
[11:58:39]   Checking for file '/dev/tux/.proc'              [ Not found ]
[11:58:39]   Checking for file '/dev/tux/.file'              [ Not found ]
[11:58:39]   Checking for file '/lib/.libgh-gh/cleaner'      [ Not found ]
[11:58:40]   Checking for file '/lib/.libgh-gh/Patch/patch'  [ Not found ]
[11:58:40]   Checking for file '/lib/.libgh-gh/sb0k'         [ Not found ]
[11:58:40]   Checking for directory '/dev/tux'               [ Not found ]
[11:58:40]   Checking for directory '/lib/.libgh-gh'         [ Not found ]
[11:58:40] AjaKit Rootkit                                    [ Not found ]
[11:58:40]
[11:58:40] Checking for aPa Kit...
[11:58:40]   Checking for file '/usr/share/.aPa'             [ Not found ]
[11:58:40] aPa Kit                                           [ Not found ]
[11:58:40]
[11:58:40] Checking for Apache Worm...
[11:58:40]   Checking for file '/bin/.log'                   [ Not found ]
[11:58:40] Apache Worm                                       [ Not found ]
[11:58:40]
[11:58:40] Checking for Ambient (ark) Rootkit...
[11:58:40]   Checking for file '/usr/lib/.ark?'              [ Not found ]
[11:58:40]   Checking for file '/dev/ptyxx/.log'             [ Not found ]
[11:58:40]   Checking for file '/dev/ptyxx/.file'            [ Not found ]
[11:58:40]   Checking for directory '/dev/ptyxx'             [ Not found ]
[11:58:40] Ambient (ark) Rootkit                             [ Not found ]
[11:58:40]
[11:58:40] Checking for Balaur Rootkit...
[11:58:40]   Checking for file '/usr/lib/liblog.o'           [ Not found ]
[11:58:40]   Checking for directory '/usr/lib/.kinetic'      [ Not found ]
[11:58:40]   Checking for directory '/usr/lib/.egcs'         [ Not found ]
[11:58:40]   Checking for directory '/usr/lib/.wormie'       [ Not found ]
[11:58:40] Balaur Rootkit                                    [ Not found ]
[11:58:40]
[11:58:40] Checking for BeastKit Rootkit...
[11:58:40]   Checking for file '/usr/sbin/arobia'            [ Not found ]
[11:58:40]   Checking for file '/usr/sbin/idrun'             [ Not found ]
[11:58:40]   Checking for file '/usr/lib/elm/arobia/elm'     [ Not found ]
[11:58:40]   Checking for file '/usr/lib/elm/arobia/elm/hk'  [ Not found ]
[11:58:40]   Checking for file '/usr/lib/elm/arobia/elm/hk.pub' [ Not found ]
[11:58:40]   Checking for file '/usr/lib/elm/arobia/elm/sc'  [ Not found ]
[11:58:40]   Checking for file '/usr/lib/elm/arobia/elm/sd.pp' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/elm/arobia/elm/sdco' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/elm/arobia/elm/srsd' [ Not found ]
[11:58:41]   Checking for directory '/lib/ldd.so/bktools'    [ Not found ]
[11:58:41] BeastKit Rootkit                                  [ Not found ]
[11:58:41]
[11:58:41] Checking for beX2 Rootkit...
[11:58:41]   Checking for directory '/usr/include/bex'       [ Not found ]
[11:58:41] beX2 Rootkit                                      [ Not found ]
[11:58:41]
[11:58:41] Checking for BOBKit Rootkit...
[11:58:41]   Checking for file '/usr/sbin/ntpsx'             [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../ls'             [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../netstat'        [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../lsof'           [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shdcfg' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shhk' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../bkit-ssh/bkit-pw' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../bkit-ssh/bkit-shrs' [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../uconf.inv'      [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../psr'            [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../find'           [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../pstree'         [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../slocate'        [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../du'             [ Not found ]
[11:58:41]   Checking for file '/usr/lib/.../top'            [ Not found ]
[11:58:41]   Checking for directory '/usr/lib/...'           [ Not found ]
[11:58:41]   Checking for directory '/usr/lib/.../bkit-ssh'  [ Not found ]
[11:58:41]   Checking for directory '/usr/lib/.bkit-'        [ Not found ]
[11:58:41]   Checking for directory '/tmp/.bkp'              [ Not found ]
[11:58:41] BOBKit Rootkit                                    [ Not found ]
[11:58:41]
[11:58:41] Checking for CiNIK Worm (Slapper.B variant)...
[11:58:41]   Checking for file '/tmp/.cinik'                 [ Not found ]
[11:58:41]   Checking for directory '/tmp/.font-unix/.cinik' [ Not found ]
[11:58:42] CiNIK Worm (Slapper.B variant)                    [ Not found ]
[11:58:42]
[11:58:42] Checking for Danny-Boy's Abuse Kit...
[11:58:42]   Checking for file '/dev/mdev'                   [ Not found ]
[11:58:42]   Checking for file '/usr/lib/libX.a'             [ Not found ]
[11:58:42] Danny-Boy's Abuse Kit                             [ Not found ]
[11:58:42]
[11:58:42] Checking for Devil RootKit...
[11:58:42]   Checking for file '/var/lib/games/.src'         [ Not found ]
[11:58:42]   Checking for file '/dev/dsx'                    [ Not found ]
[11:58:42]   Checking for file '/dev/caca'                   [ Not found ]
[11:58:42] Devil RootKit                                     [ Not found ]
[11:58:42]
[11:58:42] Checking for Dica-Kit Rootkit...
[11:58:42]   Checking for file '/lib/.sso'                   [ Not found ]
[11:58:42]   Checking for file '/lib/.so'                    [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/clean'      [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/xl'         [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/xdr'        [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/psg'        [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/secure'     [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/rdx'        [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/va'         [ Not found ]
[11:58:42]   Checking for file '/var/run/...dica/cl.sh'      [ Not found ]
[11:58:42]   Checking for file '/usr/bin/.etc'               [ Not found ]
[11:58:42]   Checking for directory '/var/run/...dica'       [ Not found ]
[11:58:42]   Checking for directory '/var/run/...dica/mh'    [ Not found ]
[11:58:42]   Checking for directory '/var/run/...dica/scan'  [ Not found ]
[11:58:42] Dica-Kit Rootkit                                  [ Not found ]
[11:58:42]
[11:58:42] Checking for Dreams Rootkit...
[11:58:42]   Checking for file '/dev/ttyoa'                  [ Not found ]
[11:58:42]   Checking for file '/dev/ttyof'                  [ Not found ]
[11:58:42]   Checking for file '/dev/ttyop'                  [ Not found ]
[11:58:42]   Checking for file '/usr/bin/sense'              [ Not found ]
[11:58:42]   Checking for file '/usr/bin/sl2'                [ Not found ]
[11:58:43]   Checking for file '/usr/bin/logclear'           [ Not found ]
[11:58:43]   Checking for file '/usr/bin/(swapd)'            [ Not found ]
[11:58:43]   Checking for file '/usr/bin/snfs'               [ Not found ]
[11:58:43]   Checking for file '/usr/lib/libsss'             [ Not found ]
[11:58:43]   Checking for directory '/dev/ida/.hpd'          [ Not found ]
[11:58:43] Dreams Rootkit                                    [ Not found ]
[11:58:43]
[11:58:43] Checking for Duarawkz Rootkit...
[11:58:43]   Checking for file '/usr/bin/duarawkz/loginpass' [ Not found ]
[11:58:43]   Checking for directory '/usr/bin/duarawkz'      [ Not found ]
[11:58:43] Duarawkz Rootkit                                  [ Not found ]
[11:58:43]
[11:58:43] Checking for Enye LKM...
[11:58:43]   Checking for file '/etc/.enyelkmHIDE^IT.ko'     [ Not found ]
[11:58:43] Enye LKM                                          [ Not found ]
[11:58:43]
[11:58:43] Checking for Flea Linux Rootkit...
[11:58:43]   Checking for file '/etc/ld.so.hash'             [ Not found ]
[11:58:43]   Checking for file '/lib/security/.config/ssh/ssh_host_key' [ Not found ]
[11:58:43]   Checking for file '/lib/security/.config/ssh/ssh_host_key.pub' [ Not found ]
[11:58:43]   Checking for file '/lib/security/.config/ssh/ssh_random_seed' [ Not found ]
[11:58:43]   Checking for file '/usr/bin/ssh2d'              [ Not found ]
[11:58:43]   Checking for file '/usr/lib/ldlibns.so'         [ Not found ]
[11:58:43]   Checking for file '/usr/lib/ldlibpst.so'        [ Not found ]
[11:58:43]   Checking for file '/usr/lib/ldlibdu.so'         [ Not found ]
[11:58:43]   Checking for file '/usr/lib/ldlibct.so'         [ Not found ]
[11:58:43]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[11:58:43]   Checking for directory '/dev/..0'               [ Not found ]
[11:58:43]   Checking for directory '/dev/..0/backup'        [ Not found ]
[11:58:43] Flea Linux Rootkit                                [ Not found ]
[11:58:43]
[11:58:43] Checking for FreeBSD Rootkit...
[11:58:43]   Checking for file '/usr/lib/.fx/sched_host.2'   [ Not found ]
[11:58:43]   Checking for file '/usr/lib/.fx/random_d.2'     [ Not found ]
[11:58:44]   Checking for file '/usr/lib/.fx/set_pid.2'      [ Not found ]
[11:58:44]   Checking for file '/usr/lib/.fx/cons.saver'     [ Not found ]
[11:58:44]   Checking for file '/usr/lib/.fx/adore/adore/adore.ko' [ Not found ]
[11:58:44]   Checking for file '/bin/sysback'                [ Not found ]
[11:58:44]   Checking for file '/usr/local/bin/sysback'      [ Not found ]
[11:58:44]   Checking for directory '/usr/lib/.fx'           [ Not found ]
[11:58:44]   Checking for directory '/usr/lib/.fx/adore'     [ Not found ]
[11:58:44] FreeBSD Rootkit                                   [ Not found ]
[11:58:44]
[11:58:44] Checking for ****`it Rootkit...
[11:58:44]   Checking for file '/dev/proc/****it/hax0r'      [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/hax0rshell' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/config/lports' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/config/rports' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/config/rkconf' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/config/password' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/****it/config/progs' [ Not found ]
[11:58:44]   Checking for file '/dev/proc/system-bins/init'  [ Not found ]
[11:58:44] ****`it Rootkit                                   [ Not found ]
[11:58:44]
[11:58:44] Checking for GasKit Rootkit...
[11:58:44]   Checking for file '/dev/dev/gaskit/sshd/sshdd'  [ Not found ]
[11:58:44]   Checking for directory '/dev/dev'               [ Not found ]
[11:58:44]   Checking for directory '/dev/dev/gaskit'        [ Not found ]
[11:58:44]   Checking for directory '/dev/dev/gaskit/sshd'   [ Not found ]
[11:58:44] GasKit Rootkit                                    [ Not found ]
[11:58:44]
[11:58:44] Checking for Heroin LKM...
[11:58:44]   Checking for kernel symbol 'heroin'             [ Not found ]
[11:58:44] Heroin LKM                                        [ Not found ]
[11:58:44]
[11:58:44] Checking for HjC Kit...
[11:58:44]   Checking for directory '/dev/.hijackerz'        [ Not found ]
[11:58:44] HjC Kit                                           [ Not found ]
[11:58:45]
[11:58:45] Checking for ignoKit Rootkit...
[11:58:45]   Checking for file '/lib/defs/p'                 [ Not found ]
[11:58:45]   Checking for file '/lib/defs/q'                 [ Not found ]
[11:58:45]   Checking for file '/lib/defs/r'                 [ Not found ]
[11:58:45]   Checking for file '/lib/defs/s'                 [ Not found ]
[11:58:45]   Checking for file '/lib/defs/t'                 [ Not found ]
[11:58:45]   Checking for file '/usr/lib/defs/p'             [ Not found ]
[11:58:45]   Checking for file '/usr/lib/defs/q'             [ Not found ]
[11:58:45]   Checking for file '/usr/lib/defs/r'             [ Not found ]
[11:58:45]   Checking for file '/usr/lib/defs/s'             [ Not found ]
[11:58:45]   Checking for file '/usr/lib/defs/t'             [ Not found ]
[11:58:45]   Checking for file '/usr/lib/.libigno/pkunsec'   [ Not found ]
[11:58:45]   Checking for file '/usr/lib/.libigno/.igno/psybnc/psybnc' [ Not found ]
[11:58:45]   Checking for directory '/usr/lib/.libigno'      [ Not found ]
[11:58:45]   Checking for directory '/usr/lib/.libigno/.igno' [ Not found ]
[11:58:45] ignoKit Rootkit                                   [ Not found ]
[11:58:45]
[11:58:45] Checking for ImperalsS-FBRK Rootkit...
[11:58:45]   Checking for directory '/dev/fd/.88'            [ Not found ]
[11:58:45]   Checking for directory '/dev/fd/.99'            [ Not found ]
[11:58:45] ImperalsS-FBRK Rootkit                            [ Not found ]
[11:58:45]
[11:58:45] Checking for Irix Rootkit...
[11:58:45]   Checking for directory '/dev/pts/01'            [ Not found ]
[11:58:45]   Checking for directory '/dev/pts/01/backup'     [ Not found ]
[11:58:45]   Checking for directory '/dev/pts/01/etc'        [ Not found ]
[11:58:45]   Checking for directory '/dev/pts/01/tmp'        [ Not found ]
[11:58:45] Irix Rootkit                                      [ Not found ]
[11:58:45]
[11:58:45] Checking for Kitko Rootkit...
[11:58:45]   Checking for directory '/usr/src/redhat/SRPMS/...' [ Not found ]
[11:58:45] Kitko Rootkit                                     [ Not found ]
[11:58:45]
[11:58:45] Checking for Knark Rootkit...
[11:58:45]   Checking for file '/proc/knark/pids'            [ Not found ]
[11:58:46]   Checking for directory '/proc/knark'            [ Not found ]
[11:58:46] Knark Rootkit                                     [ Not found ]
[11:58:46]
[11:58:46] Checking for Li0n Worm...
[11:58:46]   Checking for file '/bin/in.telnetd'             [ Not found ]
[11:58:46]   Checking for file '/bin/mjy'                    [ Not found ]
[11:58:46]   Checking for file '/usr/man/man1/man1/lib/.lib/mjy' [ Not found ]
[11:58:46]   Checking for file '/usr/man/man1/man1/lib/.lib/in.telnetd' [ Not found ]
[11:58:46]   Checking for file '/usr/man/man1/man1/lib/.lib/.x' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/1i0n.sh'  [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/hack.sh'  [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/bind'     [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/randb'    [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/scan.sh'  [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/pscan'    [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/star.sh'  [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/bindx.sh' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/scan/bindname.log' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/1i0n.sh'       [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/lib/netstat'   [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/lib/dev/.1addr' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/lib/dev/.1logz' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/lib/dev/.1proc' [ Not found ]
[11:58:46]   Checking for file '/dev/.lib/lib/lib/dev/.1file' [ Not found ]
[11:58:46] Li0n Worm                                         [ Not found ]
[11:58:46]
[11:58:46] Checking for Lockit / LJK2 Rootkit...
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_config' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_host_key' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_host_key.pub' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/ssh_random_seed*' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/sshd_config' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/backdoor/RK1bd' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/du' [ Not found ]
[11:58:46]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ifconfig' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/inetd.conf' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/locate' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/login' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ls' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/netstat' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/ps' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/pstree' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/rc.sysinit' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/syslogd' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/tcpd' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/backup/top' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/clean/RK1sauber' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/clean/RK1wted' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hack/RK1parser' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hack/RK1sniff' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1addr' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1dir' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1log' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/.RK1proc' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/hide/RK1phidemod.c' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/README.modules' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/RK1hidem.c' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/modules/RK1phide' [ Not found ]
[11:58:47]   Checking for file '/usr/lib/libmen.oo/.LJK2/sshconfig/RK1ssh' [ Not found ]
[11:58:47]   Checking for directory '/usr/lib/libmen.oo/.LJK2' [ Not found ]
[11:58:47] Lockit / LJK2 Rootkit                             [ Not found ]
[11:58:47]
[11:58:47] Checking for Mood-NT Rootkit...
[11:58:47]   Checking for file '/sbin/init__mood-nt-_-_cthulhu' [ Not found ]
[11:58:47]   Checking for file '/_cthulhu/mood-nt.init'      [ Not found ]
[11:58:47]   Checking for file '/_cthulhu/mood-nt.conf'      [ Not found ]
[11:58:47]   Checking for file '/_cthulhu/mood-nt.sniff'     [ Not found ]
[11:58:47]   Checking for directory '/_cthulhu'              [ Not found ]
[11:58:48] Mood-NT Rootkit                                   [ Not found ]
[11:58:48]
[11:58:48] Checking for MRK Rootkit...
[11:58:48]   Checking for file '/dev/ida/.inet/pid'          [ Not found ]
[11:58:48]   Checking for file '/dev/ida/.inet/ssh_host_key' [ Not found ]
[11:58:48]   Checking for file '/dev/ida/.inet/ssh_random_seed' [ Not found ]
[11:58:48]   Checking for file '/dev/ida/.inet/tcp.log'      [ Not found ]
[11:58:48]   Checking for directory '/dev/ida/.inet'         [ Not found ]
[11:58:48]   Checking for directory '/var/spool/cron/.sh'    [ Not found ]
[11:58:48] MRK Rootkit                                       [ Not found ]
[11:58:48]
[11:58:48] Checking for Ni0 Rootkit...
[11:58:48]   Checking for file '/var/lock/subsys/...datafile.../...net...' [ Not found ]
[11:58:48]   Checking for file '/var/lock/subsys/...datafile.../...port...' [ Not found ]
[11:58:48]   Checking for file '/var/lock/subsys/...datafile.../...ps...' [ Not found ]
[11:58:48]   Checking for file '/var/lock/subsys/...datafile.../...file...' [ Not found ]
[11:58:48]   Checking for directory '/tmp/waza'              [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile...' [ Not found ]
[11:58:48]   Checking for directory '/usr/sbin/es'           [ Not found ]
[11:58:48] Ni0 Rootkit                                       [ Not found ]
[11:58:48]
[11:58:48] Checking for Ohhara Rootkit...
[11:58:48]   Checking for file '/var/lock/subsys/...datafile.../...datafile.../in.smbd.log' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile...' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile.../...datafile...' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../bin' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../usr/bin' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../usr/sbin' [ Not found ]
[11:58:48]   Checking for directory '/var/lock/subsys/...datafile.../...datafile.../lib/security' [ Not found ]
[11:58:48] Ohhara Rootkit                                    [ Not found ]
[11:58:48]
[11:58:48] Checking for Optic Kit (Tux) Worm...
[11:58:48]   Checking for directory '/dev/tux'               [ Not found ]
[11:58:48]   Checking for directory '/usr/bin/xchk'          [ Not found ]
[11:58:48]   Checking for directory '/usr/bin/xsf'           [ Not found ]
[11:58:48]   Checking for directory '/usr/bin/ssh2d'         [ Not found ]
[11:58:48] Optic Kit (Tux) Worm                              [ Not found ]
[11:58:49]
[11:58:49] Checking for Oz Rootkit...
[11:58:49]   Checking for file '/dev/.oz/.nap/rkit/terror'   [ Not found ]
[11:58:49]   Checking for directory '/dev/.oz'               [ Not found ]
[11:58:49] Oz Rootkit                                        [ Not found ]
[11:58:49]
[11:58:49] Checking for Phalanx Rootkit...
[11:58:49]   Checking for file '/usr/share/.home.ph1/cb'     [ Not found ]
[11:58:49]   Checking for file '/etc/host.ph1'               [ Not found ]
[11:58:49]   Checking for file '/bin/host.ph1'               [ Not found ]
[11:58:49]   Checking for file '/usr/share/.home.ph1/phalanx' [ Not found ]
[11:58:49]   Checking for directory '/usr/share/.home.ph1'   [ Not found ]
[11:58:49] Phalanx Rootkit                                   [ Not found ]
[11:58:49]
[11:58:49] Checking for Phalanx Rootkit (strings)...
[11:58:49]   Checking for string 'phalanx'                   [ Not found ]
[11:58:49] Phalanx Rootkit (strings)                         [ Not found ]
[11:58:49]
[11:58:49] Checking for Portacelo Rootkit...
[11:58:49]   Checking for file '/var/lib/.../.ak'            [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../.hk'            [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../.rs'            [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../.p'             [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../getty'          [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../lkt.o'          [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../show'           [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../nlkt.o'         [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../ssshrc'         [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../sssh_equiv'     [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../sssh_known_hosts' [ Not found ]
[11:58:49]   Checking for file '/var/lib/.../sssh_pid'       [ Not found ]
[11:58:49]   Checking for file '~/.sssh/known_hosts'         [ Not found ]
[11:58:49] Portacelo Rootkit                                 [ Not found ]
[11:58:49]
[11:58:49] Checking for R3dstorm Toolkit...
[11:58:49]   Checking for file '/var/log/tk02/see_all'       [ Not found ]
[11:58:49]   Checking for file '/bin/.../sshd/sbin/sshd1'    [ Not found ]
[11:58:50]   Checking for file '/bin/.../hate/sk'            [ Not found ]
[11:58:50]   Checking for file '/bin/.../see_all'            [ Not found ]
[11:58:50]   Checking for directory '/var/log/tk02'          [ Not found ]
[11:58:50]   Checking for directory '/var/log/tk02/old'      [ Not found ]
[11:58:50]   Checking for directory '/bin/...'               [ Not found ]
[11:58:50] R3dstorm Toolkit                                  [ Not found ]
[11:58:50]
[11:58:50] Checking for RH-Sharpe's Rootkit...
[11:58:50]   Checking for file '/bin/lps'                    [ Not found ]
[11:58:50]   Checking for file '/usr/bin/lpstree'            [ Not found ]
[11:58:50]   Checking for file '/usr/bin/ltop'               [ Not found ]
[11:58:50]   Checking for file '/usr/bin/lkillall'           [ Not found ]
[11:58:50]   Checking for file '/usr/bin/ldu'                [ Not found ]
[11:58:50]   Checking for file '/usr/bin/lnetstat'           [ Not found ]
[11:58:50]   Checking for file '/usr/bin/wp'                 [ Not found ]
[11:58:50]   Checking for file '/usr/bin/shad'               [ Not found ]
[11:58:50]   Checking for file '/usr/bin/vadim'              [ Not found ]
[11:58:50]   Checking for file '/usr/bin/slice'              [ Not found ]
[11:58:50]   Checking for file '/usr/bin/cleaner'            [ Not found ]
[11:58:50]   Checking for file '/usr/include/rpcsvc/du'      [ Not found ]
[11:58:50] RH-Sharpe's Rootkit                               [ Not found ]
[11:58:50]
[11:58:50] Checking for RSHA's Rootkit...
[11:58:50]   Checking for file '/bin/kr4p'                   [ Not found ]
[11:58:50]   Checking for file '/usr/bin/n3tstat'            [ Not found ]
[11:58:50]   Checking for file '/usr/bin/chsh2'              [ Not found ]
[11:58:50]   Checking for file '/usr/bin/slice2'             [ Not found ]
[11:58:50]   Checking for file '/usr/src/linux/arch/alpha/lib/.lib/.1proc' [ Not found ]
[11:58:50]   Checking for file '/etc/rc.d/arch/alpha/lib/.lib/.1addr' [ Not found ]
[11:58:50]   Checking for directory '/etc/rc.d/rsha'         [ Not found ]
[11:58:50]   Checking for directory '/etc/rc.d/arch/alpha/lib/.lib' [ Not found ]
[11:58:50] RSHA's Rootkit                                    [ Not found ]
[11:58:50]
[11:58:50] Checking for Scalper Worm...
[11:58:50]   Checking for file '/tmp/.a'                     [ Not found ]
[11:58:51]   Checking for file '/tmp/.uua'                   [ Not found ]
[11:58:51] Scalper Worm                                      [ Not found ]
[11:58:51]
[11:58:51] Checking for Sebek LKM...
[11:58:51]   Checking for kernel symbol 'adore or sebek'     [ Not found ]
[11:58:51] Sebek LKM                                         [ Not found ]
[11:58:51]
[11:58:51] Checking for Shutdown Rootkit...
[11:58:51]   Checking for file '/usr/man/man5/.. /.dir/scannah/asus' [ Not found ]
[11:58:51]   Checking for file '/usr/man/man5/.. /.dir/see'  [ Not found ]
[11:58:51]   Checking for file '/usr/man/man5/.. /.dir/nscd' [ Not found ]
[11:58:51]   Checking for file '/usr/man/man5/.. /.dir/alpd' [ Not found ]
[11:58:51]   Checking for file '/etc/rc.d/rc.local '         [ Not found ]
[11:58:51]   Checking for directory '/usr/man/man5/.. /.dir' [ Not found ]
[11:58:51]   Checking for directory '/usr/man/man5/.. /.dir/scannah' [ Not found ]
[11:58:51]   Checking for directory '/etc/rc.d/rc0.d/.. /.dir' [ Not found ]
[11:58:51] Shutdown Rootkit                                  [ Not found ]
[11:58:51]
[11:58:51] Checking for SHV4 Rootkit...
[11:58:52]   Checking for file '/etc/ld.so.hash'             [ Not found ]
[11:58:52]   Checking for file '/lib/libext-2.so.7'          [ Not found ]
[11:58:52]   Checking for file '/lib/lidps1.so'              [ Not found ]
[11:58:52]   Checking for file '/usr/sbin/xntps'             [ Not found ]
[11:58:52]   Checking for directory '/lib/security/.config'  [ Not found ]
[11:58:52]   Checking for directory '/lib/security/.config/ssh' [ Not found ]
[11:58:52] SHV4 Rootkit                                      [ Not found ]
[11:58:52]
[11:58:52] Checking for SHV5 Rootkit...
[11:58:52]   Checking for file '/etc/sh.conf'                [ Not found ]
[11:58:52]   Checking for file '/dev/srd0'                   [ Not found ]
[11:58:52]   Checking for directory '/usr/lib/libsh'         [ Not found ]
[11:58:52] SHV5 Rootkit                                      [ Not found ]
[11:58:52]
[11:58:52] Checking for Sin Rootkit...
[11:58:52]   Checking for file '/dev/.haos/haos1/.f/Denyed'  [ Not found ]
[11:58:52]   Checking for file '/dev/ttyoa'                  [ Not found ]
[11:58:52]   Checking for file '/dev/ttyof'                  [ Not found ]
[11:58:52]   Checking for file '/dev/ttyop'                  [ Not found ]
[11:58:52]   Checking for file '/dev/ttyos'                  [ Not found ]
[11:58:52]   Checking for file '/usr/lib/.lib'               [ Not found ]
[11:58:52]   Checking for file '/usr/lib/sn/.X'              [ Not found ]
[11:58:52]   Checking for file '/usr/lib/sn/.sys'            [ Not found ]
[11:58:52]   Checking for file '/usr/lib/ld/.X'              [ Not found ]
[11:58:52]   Checking for file '/usr/man/man1/...'           [ Not found ]
[11:58:52]   Checking for file '/usr/man/man1/.../.m'        [ Not found ]
[11:58:52]   Checking for file '/usr/man/man1/.../.w'        [ Not found ]
[11:58:52]   Checking for directory '/usr/lib/sn'            [ Not found ]
[11:58:52]   Checking for directory '/usr/lib/man1/...'      [ Not found ]
[11:58:52]   Checking for directory '/dev/.haos'             [ Not found ]
[11:58:52] Sin Rootkit                                       [ Not found ]
[11:58:52]
[11:58:52] Checking for Slapper Worm...
[11:58:52]   Checking for file '/tmp/.bugtraq'               [ Not found ]
[11:58:52]   Checking for file '/tmp/.uubugtraq'             [ Not found ]
[11:58:53]   Checking for file '/tmp/.bugtraq.c'             [ Not found ]
[11:58:53]   Checking for file '/tmp/httpd'                  [ Not found ]
[11:58:53]   Checking for file '/tmp/.unlock'                [ Not found ]
[11:58:53]   Checking for file '/tmp/update'                 [ Not found ]
[11:58:53]   Checking for file '/tmp/.cinik'                 [ Not found ]
[11:58:53]   Checking for file '/tmp/.b'                     [ Not found ]
[11:58:53] Slapper Worm                                      [ Not found ]
[11:58:53]
[11:58:53] Checking for Sneakin Rootkit...
[11:58:53]   Checking for directory '/tmp/.X11-unix/.../rk'  [ Not found ]
[11:58:53] Sneakin Rootkit                                   [ Not found ]
[11:58:53]
[11:58:53] Checking for Suckit Rootkit...
[11:58:53]   Checking for file '/sbin/initsk12'              [ Not found ]
[11:58:53]   Checking for file '/sbin/initxrk'               [ Not found ]
[11:58:53]   Checking for file '/usr/bin/null'               [ Not found ]
[11:58:53]   Checking for file '/usr/share/locale/sk/.sk12/sk' [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc0.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc1.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc2.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc3.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc4.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc5.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for file '/etc/rc.d/rc6.d/S23kmdac'    [ Not found ]
[11:58:53]   Checking for directory '/dev/sdhu0/tehdrakg'    [ Not found ]
[11:58:53]   Checking for directory '/etc/.MG'               [ Not found ]
[11:58:53]   Checking for directory '/usr/share/locale/sk/.sk12' [ Not found ]
[11:58:53]   Checking for directory '/usr/lib/perl5/site_perl/i386-linux/auto/TimeDate/.packlist' [ Not found ]
[11:58:53] Suckit Rootkit                                    [ Not found ]
[11:58:53]
[11:58:53] Checking for SunOS Rootkit...
[11:58:53]   Checking for file '/etc/ld.so.hash'             [ Not found ]
[11:58:53]   Checking for file '/lib/libext-2.so.7'          [ Not found ]
[11:58:53]   Checking for file '/usr/bin/ssh2d'              [ Not found ]
[11:58:53]   Checking for file '/bin/xlogin'                 [ Not found ]
[11:58:54]   Checking for file '/usr/lib/crth.o'             [ Not found ]
[11:58:54]   Checking for file '/usr/lib/crtz.o'             [ Not found ]
[11:58:54]   Checking for file '/sbin/login'                 [ Not found ]
[11:58:54]   Checking for file '/lib/security/.config/sn'    [ Not found ]
[11:58:54]   Checking for file '/lib/security/.config/lpsched' [ Not found ]
[11:58:54]   Checking for file '/dev/kmod'                   [ Not found ]
[11:58:54]   Checking for file '/dev/dos'                    [ Not found ]
[11:58:54] SunOS Rootkit                                     [ Not found ]
[11:58:54]
[11:58:54] Checking for SunOS / NSDAP Rootkit...
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/.kit'    [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/defines' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/patcher' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/pg'      [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/cleaner' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/utime'   [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/crypt'   [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/findkit' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/sn2'     [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/sniffload' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/vold/nsdap/runsniff' [ Not found ]
[11:58:54]   Checking for file '/usr/lib/lpset'              [ Not found ]
[11:58:54]   Checking for directory '/usr/lib/vold/nsdap'    [ Not found ]
[11:58:54] SunOS / NSDAP Rootkit                             [ Not found ]
[11:58:54]
[11:58:54] Checking for Superkit Rootkit...
[11:58:54]   Checking for file '/usr/man/.sman/sk'           [ Not found ]
[11:58:54] Superkit Rootkit                                  [ Not found ]
[11:58:54]
[11:58:54] Checking for TBD (Telnet BackDoor)...
[11:58:54]   Checking for file '/usr/lib/.tbd'               [ Not found ]
[11:58:54] TBD (Telnet BackDoor)                             [ Not found ]
[11:58:54]
[11:58:54] Checking for TeLeKiT Rootkit...
[11:58:54]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/sniff' [ Not found ]
[11:58:54]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/telnetd' [ Not found ]
[11:58:54]   Checking for file '/usr/man/man3/.../TeLeKiT/bin/teleulo' [ Not found ]
[11:58:55]   Checking for file '/usr/man/man3/.../cl'        [ Not found ]
[11:58:55]   Checking for file '/dev/ptyr'                   [ Not found ]
[11:58:55]   Checking for file '/dev/ptyp'                   [ Not found ]
[11:58:55]   Checking for file '/dev/ptyq'                   [ Not found ]
[11:58:55]   Checking for file '/dev/hda06'                  [ Not found ]
[11:58:55]   Checking for file '/usr/info/libc1.so'          [ Not found ]
[11:58:55]   Checking for directory '/usr/man/man3/...'      [ Not found ]
[11:58:55]   Checking for directory '/usr/man/man3/.../lsniff' [ Not found ]
[11:58:55]   Checking for directory '/usr/man/man3/.../TeLeKiT' [ Not found ]
[11:58:55] TeLeKiT Rootkit                                   [ Not found ]
[11:58:55]
[11:58:55] Checking for T0rn Rootkit...
[11:58:55]   Checking for file '/dev/.lib/lib/lib/t0rns'     [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/du'        [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/ls'        [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/t0rnsb'    [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/ps'        [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/t0rnp'     [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/find'      [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/ifconfig'  [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/pg'        [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/ssh.tgz'   [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/top'       [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/sz'        [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/login'     [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/in.fingerd' [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/1i0n.sh'   [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/pstree'    [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/in.telnetd' [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/mjy'       [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/sush'      [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/tfn'       [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/name'      [ Not found ]
[11:58:55]   Checking for file '/dev/.lib/lib/lib/getip.sh'  [ Not found ]
[11:58:56]   Checking for file '/usr/info/.torn/sh*'         [ Not found ]
[11:58:56]   Checking for file '/usr/src/.****/.1addr'       [ Not found ]
[11:58:56]   Checking for file '/usr/src/.****/.1file'       [ Not found ]
[11:58:56]   Checking for file '/usr/src/.****/.1proc'       [ Not found ]
[11:58:56]   Checking for file '/usr/src/.****/.1logz'       [ Not found ]
[11:58:56]   Checking for file '/usr/info/.t0rn'             [ Not found ]
[11:58:56]   Checking for directory '/dev/.lib'              [ Not found ]
[11:58:56]   Checking for directory '/dev/.lib/lib'          [ Not found ]
[11:58:56]   Checking for directory '/dev/.lib/lib/lib'      [ Not found ]
[11:58:56]   Checking for directory '/dev/.lib/lib/lib/dev'  [ Not found ]
[11:58:56]   Checking for directory '/dev/.lib/lib/scan'     [ Not found ]
[11:58:56]   Checking for directory '/usr/src/.****'         [ Not found ]
[11:58:56]   Checking for directory '/usr/man/man1/man1'     [ Not found ]
[11:58:56]   Checking for directory '/usr/man/man1/man1/lib' [ Not found ]
[11:58:56]   Checking for directory '/usr/man/man1/man1/lib/.lib' [ Not found ]
[11:58:56]   Checking for directory '/usr/man/man1/man1/lib/.lib/.backup' [ Not found ]
[11:58:56] T0rn Rootkit                                      [ Not found ]
[11:58:56]
[11:58:56] Checking for Trojanit Kit...
[11:58:56]   Checking for file '/bin/.ls'                    [ Not found ]
[11:58:56]   Checking for file '/bin/.ps'                    [ Not found ]
[11:58:56]   Checking for file '/bin/.netstat'               [ Not found ]
[11:58:56]   Checking for file '/usr/bin/.nop'               [ Not found ]
[11:58:56]   Checking for file '/usr/bin/.who'               [ Not found ]
[11:58:56] Trojanit Kit                                      [ Not found ]
[11:58:56]
[11:58:56] Checking for Tuxtendo Rootkit...
[11:58:56]   Checking for file '/dev/tux/.addr'              [ Not found ]
[11:58:56]   Checking for file '/dev/tux/.cron'              [ Not found ]
[11:58:56]   Checking for file '/dev/tux/.file'              [ Not found ]
[11:58:56]   Checking for file '/dev/tux/.log'               [ Not found ]
[11:58:56]   Checking for file '/dev/tux/.proc'              [ Not found ]
[11:58:56]   Checking for file '/dev/tux/backup/crontab'     [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/df'          [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/dir'         [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/find'        [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/ifconfig'    [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/locate'      [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/netstat'     [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/ps'          [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/pstree'      [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/syslogd'     [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/tcpd'        [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/top'         [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/updatedb'    [ Not found ]
[11:58:57]   Checking for file '/dev/tux/backup/vdir'        [ Not found ]
[11:58:57]   Checking for directory '/dev/tux'               [ Not found ]
[11:58:57]   Checking for directory '/dev/tux/ssh2'          [ Not found ]
[11:58:57]   Checking for directory '/dev/tux/backup'        [ Not found ]
[11:58:57] Tuxtendo Rootkit                                  [ Not found ]
[11:58:57]
[11:58:57] Checking for URK Rootkit...
[11:58:57]   Checking for file '/usr/man/man1/xxxxxxbin/find' [ Not found ]
[11:58:57]   Checking for file '/usr/man/man1/xxxxxxbin/du'  [ Not found ]
[11:58:57]   Checking for file '/usr/man/man1/xxxxxxbin/ps'  [ Not found ]
[11:58:57]   Checking for file '/tmp/conf.inf'               [ Not found ]
[11:58:57]   Checking for directory '/usr/man/man1/xxxxxxbin' [ Not found ]
[11:58:57] URK Rootkit                                       [ Not found ]
[11:58:57]
[11:58:57] Checking for VcKit Rootkit...
[11:58:57]   Checking for directory '/usr/include/linux/modules/lib.so' [ Not found ]
[11:58:57]   Checking for directory '/usr/include/linux/modules/lib.so/bin' [ Not found ]
[11:58:57] VcKit Rootkit                                     [ Not found ]
[11:58:57]
[11:58:57] Checking for Volc Rootkit...
[11:58:57]   Checking for directory '/var/spool/.recent'     [ Not found ]
[11:58:58]   Checking for directory '/var/spool/.recent/.files' [ Not found ]
[11:58:58]   Checking for directory '/usr/lib/volc'          [ Not found ]
[11:58:58]   Checking for directory '/usr/lib/volc/backup'   [ Not found ]
[11:58:58] Volc Rootkit                                      [ Not found ]
[11:58:58]
[11:58:58] Checking for X-Org SunOS Rootkit...
[11:58:58]   Checking for file '/usr/lib/libX.a/bin/tmpfl'   [ Not found ]
[11:58:58]   Checking for file '/usr/lib/libX.a/bin/rps'     [ Not found ]
[11:58:58]   Checking for file '/usr/bin/srload'             [ Not found ]
[11:58:58]   Checking for file '/usr/lib/libX.a/bin/sparcv7/rps' [ Not found ]
[11:58:58]   Checking for file '/usr/sbin/modcheck'          [ Not found ]
[11:58:58]   Checking for directory '/usr/lib/libX.a'        [ Not found ]
[11:58:58]   Checking for directory '/usr/lib/libX.a/bin'    [ Not found ]
[11:58:58]   Checking for directory '/usr/lib/libX.a/bin/sparcv7' [ Not found ]
[11:58:58]   Checking for directory '/usr/share/man...'      [ Not found ]
[11:58:58] X-Org SunOS Rootkit                               [ Not found ]
[11:58:58]
[11:58:58] Checking for zaRwT.KiT Rootkit...
[11:58:58]   Checking for file '/dev/rd/s/sendmeil'          [ Not found ]
[11:58:58]   Checking for file '/dev/ttyf'                   [ Not found ]
[11:58:58]   Checking for file '/dev/ttyp'                   [ Not found ]
[11:58:58]   Checking for file '/dev/ttyn'                   [ Not found ]
[11:58:58]   Checking for file '/rk/tulz'                    [ Not found ]
[11:58:58]   Checking for directory '/rk'                    [ Not found ]
[11:58:58]   Checking for directory '/dev/rd/s'              [ Not found ]
[11:58:58] zaRwT.KiT Rootkit                                 [ Not found ]
[11:58:58]
[11:58:58] Performing additional rootkit checks
[11:58:58] Info: Starting test name 'additional_rkts'
[11:58:58]
[11:58:58]   Performing Suckit Rookit additional checks
[11:58:58]     Checking /sbin/init link count                [ OK ]
[11:58:58]     Checking for hidden file extensions           [ None found ]
[11:58:58]     Running skdet command                         [ Skipped ]
[11:58:59] Info: Unable to find the 'skdet' command
[11:58:59]   Suckit Rookit additional checks                 [ OK ]
[11:58:59]
[11:58:59]   Performing check of possible rootkit files and directories
[11:58:59] Info: Starting test name 'possible_rkt_files'
[11:58:59]     Checking for file '/dev/sdr0'                 [ Not found ]
[11:58:59]     Checking for file '/tmp/.syshackfile'         [ Not found ]
[11:58:59]     Checking for file '/tmp/.bash_history'        [ Not found ]
[11:58:59]     Checking for file '/usr/info/.clib'           [ Not found ]
[11:58:59]     Checking for file '/usr/sbin/tcp.log'         [ Not found ]
[11:58:59]     Checking for file '/usr/bin/take/pid'         [ Not found ]
[11:58:59]     Checking for file '/sbin/create'              [ Not found ]
[11:58:59]     Checking for file '/dev/ttypz'                [ Not found ]
[11:58:59]     Checking for directory '/usr/bin/take'        [ Not found ]
[11:58:59]     Checking for directory '/usr/src/.lib'        [ Not found ]
[11:58:59]     Checking for directory '/usr/share/man/man1/.1c' [ Not found ]
[11:58:59]     Checking for directory '/lib/lblip.tk'        [ Not found ]
[11:58:59]     Checking for directory '/usr/sbin/...'        [ Not found ]
[11:58:59]     Checking for directory '/usr/share/.gun'      [ Not found ]
[11:58:59]   Checking for possible rootkit files and directories [ None found ]
[11:58:59]
[11:58:59]   Performing check for possible rootkit strings
[11:58:59] Info: Starting test name 'possible_rkt_strings'
[11:58:59] Info: Found local startup file: /etc/rc.local
[11:58:59]     Checking for string '/dev/proc/****it'        [ Not found ]
[11:58:59]     Checking for string '****'                    [ Not found ]
[11:58:59]     Checking for string 'backdoor'                [ Not found ]
[11:58:59]     Checking for string 'vt200'                   [ Not found ]
[11:59:00]     Checking for string '/usr/bin/xstat'          [ Not found ]
[11:59:00]     Checking for string '/bin/envpc'              [ Not found ]
[11:59:00]     Checking for string 'L4m3r0x'                 [ Not found ]
[11:59:00]     Checking for string '/usr/lib/.tbd'           [ Not found ]
[11:59:00]     Checking for string '/dev/ptyxx/.file'        [ Not found ]
[11:59:00]     Checking for string '/dev/sgk'                [ Not found ]
[11:59:00]     Checking for string '/var/lock/subsys/...datafile...' [ Not found ]
[11:59:00]     Checking for string '/usr/lib/.tbd'           [ Not found ]
[11:59:00]     Checking for string '/dev/proc/****it'        [ Not found ]
[11:59:00]     Checking for string '/lib/.sso'               [ Not found ]
[11:59:00]     Checking for string '/var/lock/subsys/...datafile...' [ Not found ]
[11:59:00]     Checking for string '/dev/caca'               [ Not found ]
[11:59:00]     Checking for string '/dev/ttyoa'              [ Not found ]
[11:59:00]     Checking for string 'syg'                     [ Not found ]
[11:59:00]     Checking for string '/dev/pts/01'             [ Not found ]
[11:59:00]     Checking for string 'tw33dl3'                 [ Not found ]
[11:59:00]     Checking for string 'psniff'                  [ Not found ]
[11:59:00]     Checking for string '/var/lock/subsys/...datafile...' [ Not found ]
[11:59:00]     Checking for string 'promiscuous'             [ Not found ]
[11:59:01]     Checking for string '/usr/lib/.tbd'           [ Not found ]
[11:59:01]     Checking for string '/dev/xdta'               [ Not found ]
[11:59:01]     Checking for string '/usr/lib/.tbd'           [ Not found ]
[11:59:01]     Checking for string 'in.inetd'                [ Not found ]
[11:59:01]     Checking for string '#<HIDE_.*>'              [ Not found ]
[11:59:01]     Checking for string 'bin/xchk'                [ Not found ]
[11:59:01]     Checking for string 'bin/xsf'                 [ Not found ]
[11:59:01]   Checking for possible rootkit strings           [ None found ]
[11:59:01]
[11:59:01] Performing malware checks
[11:59:01] Info: Starting test name 'malware'
[11:59:01]
[11:59:01] Info: Test 'deleted_files' disabled at users request.
[11:59:01] Info: Starting test name 'running_procs'
[11:59:01]   Checking running processes for suspicious files [ None found ]
[11:59:01]
[11:59:01] Info: Test 'hidden_procs' disabled at users request.
[11:59:01]
[11:59:01] Info: Test 'suspscan' disabled at users request.
[11:59:01]
[11:59:01]   Performing check for login backdoors
[11:59:01] Info: Starting test name 'other_malware'
[11:59:01]     Checking for '/bin/.login'                    [ Not found ]
[11:59:02]     Checking for '/sbin/.login'                   [ Not found ]
[11:59:02]   Checking for login backdoors                    [ None found ]
[11:59:02]
[11:59:02]   Performing check for suspicious directories
[11:59:02]     Checking for directory '/usr/X11R6/bin/.,/copy' [ Not found ]
[11:59:02]     Checking for directory '/dev/rd/cdb'          [ Not found ]
[11:59:02]   Checking for suspicious directories             [ None found ]
[11:59:02]
[11:59:02]   Checking for software intrusions                [ Skipped ]
[11:59:02] Info: Check skipped - tripwire not installed
[11:59:02]
[11:59:02]   Performing check for sniffer log files
[11:59:02]     Checking for file '/usr/lib/libice.log'       [ Not found ]
[11:59:02]   Checking for sniffer log files                  [ None found ]
[11:59:02]
[11:59:02] Performing trojan specific checks
[11:59:02] Info: Starting test name 'trojans'
[11:59:02] Info: Using inetd configuration file '/etc/inetd.conf'
[11:59:02]   Checking for enabled inetd services             [ OK ]
[11:59:02]
[11:59:02]   Performing check for enabled xinetd services
[11:59:02]   Checking for enabled xinetd services            [ Skipped ]
[11:59:02] Info: Check skipped - file '/etc/xinetd.conf' does not exist.
[11:59:02] Info: Apache backdoor check skipped: Apache modules and configuration directories not found.
[11:59:02]
[11:59:02] Performing Linux specific checks
[11:59:02] Info: Starting test name 'os_specific'
[11:59:02]   Checking kernel module commands                 [ OK ]
[11:59:02] Info: Using modules pathname of '/lib/modules/2.6.24-20-generic'
[11:59:02]   Checking kernel module names                    [ OK ]
[11:59:02]
[11:59:02] Checking the network...
[11:59:02] Info: Starting test name 'network'
[11:59:02] Info: Starting test name 'ports'
[11:59:02]
[11:59:02] Performing check for backdoor ports
[11:59:03]   Checking for UDP port 2001                      [ Not found ]
[11:59:03]   Checking for TCP port 2006                      [ Not found ]
[11:59:03]   Checking for TCP port 2128                      [ Not found ]
[11:59:03]   Checking for TCP port 14856                     [ Not found ]
[11:59:03]   Checking for TCP port 47107                     [ Not found ]
[11:59:04]   Checking for TCP port 60922                     [ Not found ]
[11:59:04]
[11:59:04] Performing checks on the network interfaces
[11:59:04] Info: Starting test name 'promisc'
[11:59:04]   Checking for promiscuous interfaces             [ None found ]
[11:59:04]
[11:59:04] Info: Test 'packet_cap_apps' disabled at users request.
[11:59:04]
[11:59:04] Checking the local host...
[11:59:04] Info: Starting test name 'local_host'
[11:59:04]
[11:59:04] Performing system boot checks
[11:59:04] Info: Starting test name 'startup_files'
[11:59:04]   Checking for local host name                    [ Found ]
[11:59:04] Info: Starting test name 'startup_malware'
[11:59:04] Info: Found local startup file: /etc/rc.local
[11:59:04]   Checking for local startup files                [ Found ]
[11:59:04]   Checking local startup files for malware        [ None found ]
[11:59:04] Info: Found system startup directory: /etc/init.d
[11:59:05]   Checking system startup files for malware       [ None found ]
[11:59:05]
[11:59:05] Performing group and account checks
[11:59:05] Info: Starting test name 'group_accounts'
[11:59:05]   Checking for passwd file                        [ Found ]
[11:59:05] Info: Found password file: /etc/passwd
[11:59:05]   Checking for root equivalent (UID 0) accounts   [ None found ]
[11:59:05] Info: Found shadow file: /etc/shadow
[11:59:05]   Checking for passwordless accounts              [ None found ]
[11:59:06] Info: Starting test name 'passwd_changes'
[11:59:06]   Checking for passwd file changes                [ None found ]
[11:59:06] Info: Starting test name 'group_changes'
[11:59:06]   Checking for group file changes                 [ None found ]
[11:59:06]   Checking root account shell history files       [ OK ]
[11:59:06]
[11:59:06] Performing system configuration file checks
[11:59:06] Info: Starting test name 'system_configs'
[11:59:06]   Checking for SSH configuration file             [ Not found ]
[11:59:06]   Checking for running syslog daemon              [ Found ]
[11:59:06]   Checking for syslog configuration file          [ Found ]
[11:59:06] Info: Found syslog configuration file: /etc/syslog.conf
[11:59:06]   Checking if syslog remote logging is allowed    [ Not allowed ]
[11:59:06]
[11:59:06] Performing filesystem checks
[11:59:06] Info: Starting test name 'filesystem'
[11:59:06] Info: SCAN_MODE_DEV set to 'THOROUGH'
[11:59:18]   Checking /dev for suspicious file types         [ Warning ]
[11:59:18] Warning: Suspicious file types found in /dev:
[11:59:18]          /dev/shm/pulse-shm-550581904: data
[11:59:18]   Checking for hidden files and directories       [ Warning ]
[11:59:18] Warning: Hidden directory found: /etc/.java
[11:59:18] Warning: Hidden directory found: /dev/.static
[11:59:18] Warning: Hidden directory found: /dev/.udev
[11:59:18] Warning: Hidden directory found: /dev/.initramfs
[11:59:18]
[11:59:18] Checking application versions...
[11:59:18] Info: Starting test name 'apps'
[11:59:19]   Checking version of Exim MTA                    [ OK ]
[11:59:19] Info: Application 'exim' version '4.69' found.
[11:59:19]   Checking version of GnuPG                       [ OK ]
[11:59:19] Info: Application 'gpg' version '1.4.6' found.
[11:59:19] Info: Application 'httpd' not found.
[11:59:19] Info: Application 'named' not found.
[11:59:19]   Checking version of OpenSSL                     [ OK ]
[11:59:19] Info: Application 'openssl' version '0.9.8g' found.
[11:59:19] Info: Application 'php' not found.
[11:59:19] Info: Application 'procmail' not found.
[11:59:19] Info: Application 'proftpd' not found.
[11:59:19] Info: Application 'sshd' not found.
[11:59:19] Info: Applications checked: 3 out of 9
[11:59:19]
[11:59:19] System checks summary
[11:59:19] =====================
[11:59:19]
[11:59:19] File properties checks...
[11:59:19] Files checked: 126
[11:59:19] Suspect files: 11
[11:59:19]
[11:59:19] Rootkit checks...
[11:59:19] Rootkits checked : 109
[11:59:19] Possible rootkits: 0
[11:59:19]
[11:59:19] Applications checks...
[11:59:19] Applications checked: 3
[11:59:19] Suspect applications: 0
[11:59:19]
[11:59:19] The system checks took: 1 minute and 3 seconds
[11:59:20]
[11:59:20] Info: End date is Wed Jul 30 11:59:20 EDT 2008
```

Ok...   now what?

I have never had a rootkit, and nothing has been acting all that funny. I do have portsentry on... could it be a false positive?

Edit: Alright, here is the tiger log.



```
Security scripts *** 3.2.2, 2007.08.28.00.00 ***
Wed Jul 30 12:10:57 EDT 2008
12:10> Beginning security report for leo-laptop (x86_64 Linux 2.6.24-20-generic).

# Performing check of passwd files...
# Checking entries from /etc/passwd.
--WARN-- [pass014w] Login (backup) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (bin) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (daemon) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (games) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (gnats) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (irc) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (libuuid) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (list) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (lp) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (mail) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (man) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (news) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (nobody) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (proxy) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (root) is disabled, but has a valid shell. 
--WARN-- [pass015w] Login ID sync does not have a valid shell (/bin/sync). 
--WARN-- [pass014w] Login (sys) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (uucp) is disabled, but has a valid shell. 
--WARN-- [pass014w] Login (www-data) is disabled, but has a valid shell. 
--WARN-- [pass012w] Home directory /nonexistent exists multiple times (2) in 
         /etc/passwd. 
--WARN-- [pass006w] Integrity of password files questionable (/usr/sbin/pwck 
         -r). 

# Performing check of group files...

# Performing check of user accounts...
# Checking accounts from /etc/passwd.
--WARN-- [acc006w] Login ID gdm's home directory (/var/lib/gdm) has group 
         `gdm' write access. 
--WARN-- [acc021w] Login ID libuuid appears to be a dormant account. 
--WARN-- [acc022w] Login ID nobody home directory (/nonexistent) is not 
         accessible. 

# Performing check of /etc/hosts.equiv and .rhosts files...

# Checking accounts from /etc/passwd...

# Performing check of .netrc files...

# Checking accounts from /etc/passwd...

# Performing common access checks for root (in /etc/default/login, /securetty, and /etc/ttytab...
--WARN-- [root003w] Root user has message capability turned on. 

# Performing check of PATH components...
--WARN-- [path009w] /etc/profile does not export an initial setting for PATH. 
# Only checking user 'root'

# Performing check of anonymous FTP...

# Performing checks of mail aliases...
# Checking aliases from /etc/aliases.

# Performing check of `cron' entries...
--WARN-- [cron004w] Root crontab does not exist 
--WARN-- [cron005w] Use of cron is not restricted 

# Performing check of 'inetd'...
# Checking inetd entries from /etc/inetd.conf

# Performing check of services with tcp wrappers...
# Analysing inetd entries from /etc/inetd.conf

# Performing check of 'services' ...
# Checking services from /etc/services.
--WARN-- [inet003w] The port for service postgres is also assigned to service 
         postgresql. 
--WARN-- [inet003w] The port for service postgres is also assigned to service 
         postgresql. 
--WARN-- [inet003w] The port for service sane is also assigned to service 
         sane-port. 

# Performing NFS exports check...

# Performing check of system file permissions...

# Checking for known intrusion signs...
# Testing for promiscuous interfaces with /bin/ip
# Testing for backdoors in inetd.conf

# Performing check of files in system mail spool...

# Performing check for rookits...
# Running chkrootkit (/usr/sbin/chkrootkit) to perform further checks...
--ALERT-- [rootkit005a] Chkrootkit has found a file which seems to be infected 
          because of a rootkit 
--ALERT-- [rootkit009a] A rootkit seems to be installed in the system 
INFECTED (PORTS: 1524 6667 31337)

# Performing system specific checks...
# Performing checks for Linux/2...

# Checking boot loader file permissions...
--WARN-- [boot02] The configuration file /boot/grub/menu.lst has group 
         permissions. Should be 0600 
--FAIL-- [boot02] The configuration file /boot/grub/menu.lst has world 
         permissions. Should be 0600 
--WARN-- [boot06] The Grub bootloader does not have a password configured. 

# Checking for vulnerabilities in inittab configuration...

# Checking for correct umask settings for init scripts...
--WARN-- [misc021w] There are no umask entries in /etc/init.d/rcS 

# Checking Logins not used on the system ...

# Checking network configuration
--FAIL-- [lin013f] The system is not protected against Syn flooding attacks 
--WARN-- [lin017w] The system is not configured to log suspicious (martian) 
         packets 

# Verifying system specific password checks...

# Checking OS release...
--WARN-- [osv004w] Unreleased Debian GNU/Linux version `lenny/sid' 

# Checking installed packages vs Debian Security Advisories...

# Checking md5sums of installed files
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.pcimap' checksum differs from 
         installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file `/lib/modules/2.6.24-20-generic/modules.dep' 
         checksum differs from installed package 
         'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.ieee1394map' checksum differs 
         from installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.usbmap' checksum differs from 
         installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.isapnpmap' checksum differs 
         from installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.inputmap' checksum differs 
         from installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.seriomap' checksum differs 
         from installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.alias' checksum differs from 
         installed package 'linux-image-2.6.24-20-generic'. 
--FAIL-- [lin005f] Installed file 
         `/lib/modules/2.6.24-20-generic/modules.symbols' checksum differs 
         from installed package 'linux-image-2.6.24-20-generic'. 

# Checking installed files against packages...
--WARN-- [lin001w] File `/lib/linux-restricted-modules/.nvidia_new_installed' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-17-generic/misc/vboxdrv.ko' does 
         not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-19-generic/misc/vboxdrv.ko' does 
         not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/wl.ko' does 
         not belong to any package. 
--WARN-- [lin001w] File 
         `/lib/modules/2.6.24-20-generic/volatile/nvidia_new.ko' does not 
         belong to any package. 
--WARN-- [lin001w] File 
         `/lib/modules/2.6.24-20-generic/volatile/nvidia_legacy.ko' does not 
         belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/nvidia.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fglrx.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fcpci.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fcdslusb2.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fcdslusb.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File 
         `/lib/modules/2.6.24-20-generic/volatile/fcdslslusb.ko' does not 
         belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fcdslsl.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/fcdsl2.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/ath_hal.ko' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/volatile/.mounted' 
         does not belong to any package. 
--WARN-- [lin001w] File `/lib/modules/2.6.24-20-generic/misc/vboxdrv.ko' does 
         not belong to any package. 

# Performing check of root directory...

# Checking device permissions...
--FAIL-- [dev002f] /dev/log has world permissions 
--FAIL-- [dev002f] /dev/nvidia0 has world permissions 
--FAIL-- [dev002f] /dev/nvidiactl has world permissions 
--WARN-- [dev003w] File /dev/sndstat is a regular file in a device directory. 

# Checking for existence of log files...
--FAIL-- [logf005f] Log file /var/log/btmp permission should be 660 

# Checking for correct umask settings...

# Checking listening processes 
--WARN-- [lin003w] The process `avahi-daemon' is listening on socket 34124 
         (UDP on every interface) is run by avahi. 
--WARN-- [lin003w] The process `avahi-daemon' is listening on socket 5353 (UDP 
         on every interface) is run by avahi. 
--WARN-- [lin003w] The process `dhclient' is listening on socket 68 (UDP on 
         every interface) is run by dhcp. 
--WARN-- [lin002i] The process `nmbd' is listening on socket 137 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `nmbd' is listening on socket 138 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 1 (TCP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 1080 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 11 (TCP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 111 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 119 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 12345 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 12346 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 143 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 15 (TCP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 1524 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 2000 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 20034 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 27665 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 31337 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32771 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32772 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32773 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32774 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 40421 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 49724 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 540 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 54320 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 5742 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 635 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 6667 (TCP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 79 (TCP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 1 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 161 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 162 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 31335 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 31337 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32770 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32771 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32772 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32773 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 32774 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 34555 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 37444 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 513 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 54321 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 635 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 640 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 641 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 69 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 7 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 700 (UDP) 
         on every interface. 
--WARN-- [lin002i] The process `portsentry' is listening on socket 9 (UDP) on 
         every interface. 
--WARN-- [lin002i] The process `smbd' is listening on socket 139 (TCP) on 
         every interface. 
--WARN-- [lin002i] The process `smbd' is listening on socket 445 (TCP) on 
         every interface. 

# Checking sshd_config configuration files...
--FAIL-- [ssh005w] Cannot find a configuration file for SSH. 

# Performing common access checks for root...
--FAIL-- [netw020f] There is no /etc/ftpusers file. 

# Checking ntpd configuration...

# Checking unusual file names...

# Looking for unusual device files...
--ALERT-- [fsys006a] Unexpected device files found: 
lrwxrwxrwx 1 leo leo 9 Jun 13 18:44 /home/leo/.wine/dosdevices/e:: -> /dev/scd0
crw------- 1 root root 5, 1 Apr 22 14:04 /lib/udev/devices/console
crw-r----- 1 root kmem 1, 2 Apr 22 14:04 /lib/udev/devices/kmem
brw------- 1 root root 7, 0 Apr 22 14:04 /lib/udev/devices/loop0
crw------- 1 root root 10, 200 Apr 22 14:04 /lib/udev/devices/net/tun
crw------- 1 root root 1, 3 Apr 22 14:04 /lib/udev/devices/null
crw------- 1 root root 108, 0 Apr 22 14:04 /lib/udev/devices/ppp
lrwxrwxrwx 1 root root 15 May 21 04:14 /lib/udev/devices/stderr -> /proc/self/fd/2


# Checking symbolic links...
--WARN-- [xxxxx] The following files have undefined groups ownership:
/boot/grub
/boot/grub/default
/boot/grub/device.map
/boot/grub/e2fs_stage1_5
/boot/grub/fat_stage1_5
/boot/grub/installed-version
/boot/grub/jfs_stage1_5
/boot/grub/minix_stage1_5
/boot/grub/reiserfs_stage1_5
/boot/grub/stage1
/boot/grub/stage2
/boot/grub/xfs_stage1_5
/cdrom
/etc/apt/apt.conf.d/00trustcdrom
/etc/apt/sources.list
/etc/default/console-setup
/etc/default/locale
/etc/hosts
/etc/initramfs-tools/conf.d/resume
/etc/papersize
/etc/popularity-contest.conf
/home/leo/.wine/dosdevices/e:
/media/cdrom
/media/cdrom0
/var/cache/debconf/passwords.dat
/var/lib/apt/cdroms.list
/var/lib/locales/supported.d/local
/var/log/installer
/var/log/installer/initial-status.gz
/var/log/installer/partman


# Performing check of embedded pathnames...
12:22> Security report completed for leo-laptop.
```

----------


## unoodles

Do you have nepenthes installed?
run the command: `netstat -tupl` to see which programs are accessing which ports.

----------


## LeoSolaris

I don't yet, but I am about to. I'll run it as soon as I get it downloaded.

Thanks

----------


## LeoSolaris

Alright, I picked up nepenthes and ran the requested command, here's the output:



```
12:44 PM on Wed Jul 30 leo-laptop: ~$ sudo netstat -tupl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:1025                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:imaps                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:tcpmux                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:20034                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:pop3s                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:32771                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:3140                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:32772                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:40421                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:32773                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:32774                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:loc-srv               *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:5000                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:31337                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:nameserver            *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ircd                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:systat                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:netbios-ssn           *:*                     LISTEN      7188/smbd       
tcp        0      0 *:3372                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:pop3                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:5742                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:imap2                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:sunrpc                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:finger                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:netstat               *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:www                   *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:webmin                *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:54320                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:sieve                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:6129                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ssmtp                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:27665                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:5554                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:27347                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:17300                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ingreslock            *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:ftp                   *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:3127                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:2103                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:nntp                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 localhost:ipp           *:*                     LISTEN      6810/cupsd      
tcp        0      0 *:socks                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:eklogin               *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:2745                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:12345                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 localhost:smtp          *:*                     LISTEN      7078/exim4      
tcp        0      0 *:12346                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:2107                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:https                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:635                   *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:imap3                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:49724                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:uucp                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:microsoft-ds          *:*                     LISTEN      7188/smbd       
tcp        0      0 *:1023                  *:*                     LISTEN      9238/nepenthes  
udp        0      0 *:640                   *:*                                 8193/portsentry 
udp        0      0 *:641                   *:*                                 8193/portsentry 
udp        0      0 *:who                   *:*                                 8193/portsentry 
udp        0      0 *:1                     *:*                                 8193/portsentry 
udp        0      0 *:32770                 *:*                                 8193/portsentry 
udp        0      0 *:32771                 *:*                                 8193/portsentry 
udp        0      0 *:32772                 *:*                                 8193/portsentry 
udp        0      0 *:32773                 *:*                                 8193/portsentry 
udp        0      0 *:32774                 *:*                                 8193/portsentry 
udp        0      0 *:echo                  *:*                                 8193/portsentry 
udp        0      0 leo-laptop.l:netbios-ns *:*                                 7172/nmbd       
udp        0      0 *:discard               *:*                                 8193/portsentry 
udp        0      0 *:netbios-ns            *:*                                 7172/nmbd       
udp        0      0 leo-laptop.:netbios-dgm *:*                                 7172/nmbd       
udp        0      0 *:netbios-dgm           *:*                                 7172/nmbd       
udp        0      0 *:ms-sql-m              *:*                                 9238/nepenthes  
udp        0      0 *:snmp                  *:*                                 8193/portsentry 
udp        0      0 *:snmp-trap             *:*                                 8193/portsentry 
udp        0      0 *:54321                 *:*                                 8193/portsentry 
udp        0      0 *:700                   *:*                                 8193/portsentry 
udp        0      0 *:bootpc                *:*                                 8571/dhclient   
udp        0      0 *:37444                 *:*                                 8193/portsentry 
udp        0      0 *:tftp                  *:*                                 8193/portsentry 
udp        0      0 *:34124                 *:*                                 6769/avahi-daemon: 
udp        0      0 *:31335                 *:*                                 8193/portsentry 
udp        0      0 *:31337                 *:*                                 8193/portsentry 
udp        0      0 *:mdns                  *:*                                 6769/avahi-daemon: 
udp        0      0 *:34555                 *:*                                 8193/portsentry 
udp        0      0 *:635                   *:*                                 8193/portsentry
```

----------


## LeoSolaris

After studying the help and manpages for nepenthes, I ran a secondary scan for some more information with the command netstat -vap

Here is the result:


```
12:52 PM on Wed Jul 30 leo-laptop: ~$ sudo netstat -vap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:1025                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:imaps                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:tcpmux                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:20034                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:pop3s                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:32771                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:3140                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:32772                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:40421                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:32773                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:32774                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:loc-srv               *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:5000                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:31337                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:nameserver            *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ircd                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:systat                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:netbios-ssn           *:*                     LISTEN      7188/smbd       
tcp        0      0 *:3372                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:pop3                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:5742                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:imap2                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:sunrpc                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:finger                *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:netstat               *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:www                   *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:webmin                *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:54320                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:sieve                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:6129                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ssmtp                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:27665                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:5554                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:27347                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:17300                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:ingreslock            *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:ftp                   *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:3127                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:2103                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:nntp                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 localhost:ipp           *:*                     LISTEN      6810/cupsd      
tcp        0      0 *:socks                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:eklogin               *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:2745                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:12345                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 localhost:smtp          *:*                     LISTEN      7078/exim4      
tcp        0      0 *:12346                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:2107                  *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:https                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:635                   *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:imap3                 *:*                     LISTEN      9238/nepenthes  
tcp        0      0 *:49724                 *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:uucp                  *:*                     LISTEN      8185/portsentry 
tcp        0      0 *:microsoft-ds          *:*                     LISTEN      7188/smbd       
tcp        0      0 *:1023                  *:*                     LISTEN      9238/nepenthes  
udp        0      0 *:640                   *:*                                 8193/portsentry 
udp        0      0 *:641                   *:*                                 8193/portsentry 
udp        0      0 *:who                   *:*                                 8193/portsentry 
udp        0      0 *:1                     *:*                                 8193/portsentry 
udp        0      0 *:32770                 *:*                                 8193/portsentry 
udp        0      0 *:32771                 *:*                                 8193/portsentry 
udp        0      0 *:32772                 *:*                                 8193/portsentry 
udp        0      0 *:32773                 *:*                                 8193/portsentry 
udp        0      0 *:32774                 *:*                                 8193/portsentry 
udp        0      0 *:echo                  *:*                                 8193/portsentry 
udp        0      0 leo-laptop.l:netbios-ns *:*                                 7172/nmbd       
udp        0      0 *:discard               *:*                                 8193/portsentry 
udp        0      0 *:netbios-ns            *:*                                 7172/nmbd       
udp        0      0 leo-laptop.:netbios-dgm *:*                                 7172/nmbd       
udp        0      0 *:netbios-dgm           *:*                                 7172/nmbd       
udp        0      0 *:ms-sql-m              *:*                                 9238/nepenthes  
udp        0      0 *:snmp                  *:*                                 8193/portsentry 
udp        0      0 *:snmp-trap             *:*                                 8193/portsentry 
udp        0      0 *:54321                 *:*                                 8193/portsentry 
udp        0      0 *:700                   *:*                                 8193/portsentry 
udp        0      0 *:bootpc                *:*                                 8571/dhclient   
udp        0      0 *:37444                 *:*                                 8193/portsentry 
udp        0      0 *:tftp                  *:*                                 8193/portsentry 
udp        0      0 *:34124                 *:*                                 6769/avahi-daemon: 
udp        0      0 *:31335                 *:*                                 8193/portsentry 
udp        0      0 *:31337                 *:*                                 8193/portsentry 
udp        0      0 *:mdns                  *:*                                 6769/avahi-daemon: 
udp        0      0 *:34555                 *:*                                 8193/portsentry 
udp        0      0 *:635                   *:*                                 8193/portsentry 
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING     16663    6769/avahi-daemon:  /var/run/avahi-daemon/socket
unix  2      [ ACC ]     STREAM     LISTENING     17700    7423/winbindd       /tmp/.winbindd/pipe
unix  2      [ ACC ]     STREAM     LISTENING     17898    7447/xfstt          /tmp/.font-unix/fs7101
unix  2      [ ACC ]     STREAM     LISTENING     17702    7423/winbindd       /var/run/samba/winbindd_privileged/pipe
unix  2      [ ACC ]     STREAM     LISTENING     18921    7794/X              /tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     19928    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  2      [ ACC ]     STREAM     LISTENING     19938    8301/gnome-keyring- /tmp/orbit-leo/linc-2066-0-1556d84778eb
unix  2      [ ACC ]     STREAM     LISTENING     20111    8301/gnome-keyring- /tmp/keyring-XRaIfV/socket
unix  2      [ ACC ]     STREAM     LISTENING     20113    8301/gnome-keyring- /tmp/keyring-XRaIfV/ssh
unix  2      [ ACC ]     STREAM     LISTENING     20115    8301/gnome-keyring- /tmp/keyring-XRaIfV/socket.pkcs11
unix  2      [ ACC ]     STREAM     LISTENING     20276    8356/seahorse-agent /tmp/orbit-leo/linc-206e-0-2b722f10c6519
unix  2      [ ACC ]     STREAM     LISTENING     20307    8302/gnome-session  /tmp/seahorse-zSHsPz/S.gpg-agent
unix  2      [ ACC ]     STREAM     LISTENING     20347    8302/gnome-session  /tmp/orbit-leo/linc-206e-0-5b07c71e4fb6b
unix  2      [ ]         DGRAM                    6985     1/init              @/com/ubuntu/upstart
unix  2      [ ACC ]     STREAM     LISTENING     20351    8302/gnome-session  /tmp/.ICE-unix/8302
unix  2      [ ACC ]     STREAM     LISTENING     20408    8361/gnome-settings /tmp/orbit-leo/linc-20a9-0-597d09c6d1cf2
unix  2      [ ACC ]     STREAM     LISTENING     23782    8365/pulseaudio     /tmp/.esd-1000/socket
unix  2      [ ACC ]     STREAM     LISTENING     23789    8365/pulseaudio     /tmp/pulse-leo/native
unix  2      [ ACC ]     STREAM     LISTENING     23830    8372/gconf-helper   /tmp/orbit-leo/linc-20b4-0-5c52a53720cdf
unix  2      [ ACC ]     STREAM     LISTENING     23951    8393/gnome-screensa /tmp/orbit-leo/linc-20bc-0-106e8f325a1fc
unix  2      [ ACC ]     STREAM     LISTENING     18753    7777/gdm            /var/run/gdm_socket
unix  2      [ ACC ]     STREAM     LISTENING     24158    8398/gnome-panel    /tmp/orbit-leo/linc-20ce-0-13e218f4c9b02
unix  2      [ ACC ]     STREAM     LISTENING     24164    8395/nautilus       /tmp/orbit-leo/linc-20cb-0-13e218f4ca7db
unix  2      [ ACC ]     STREAM     LISTENING     24363    8413/bonobo-activat /tmp/orbit-leo/linc-20dd-0-103ceb0ee6319
unix  2      [ ACC ]     STREAM     LISTENING     24564    8465/gnome-volume-m /tmp/orbit-leo/linc-210e-0-7084c56060d47
unix  2      [ ACC ]     STREAM     LISTENING     24695    8456/compiz.real    /tmp/orbit-leo/linc-2108-0-205dba599959e
unix  2      [ ACC ]     STREAM     LISTENING     24699    8457/update-notifie /tmp/orbit-leo/linc-2109-0-1e834b49969a
unix  2      [ ACC ]     STREAM     LISTENING     24701    8470/gnome-power-ma /tmp/orbit-leo/linc-210a-0-7084c56099790
unix  2      [ ACC ]     STREAM     LISTENING     24722    8460/avant-window-n /tmp/orbit-leo/linc-210c-0-35aeadc4d7fdd
unix  2      [ ACC ]     STREAM     LISTENING     24747    8464/nm-applet      /tmp/orbit-leo/linc-2110-0-2807e8dc2fe23
unix  2      [ ACC ]     STREAM     LISTENING     16204    6455/acpid          /var/run/acpid.socket
unix  2      [ ACC ]     STREAM     LISTENING     24948    8480/drivemount_app /tmp/orbit-leo/linc-2120-0-1bc42400e470
unix  2      [ ACC ]     STREAM     LISTENING     16718    6810/cupsd          /var/run/cups/cups.sock
unix  2      [ ACC ]     STREAM     LISTENING     25085    8503/gnome-vfs-daem /tmp/orbit-leo/linc-2137-0-2a62829e321c7
unix  2      [ ACC ]     STREAM     LISTENING     25366    8495/python         /tmp/orbit-leo/linc-212f-0-1f1c297131c79
unix  2      [ ACC ]     STREAM     LISTENING     25390    8580/gtk-window-dec /tmp/orbit-leo/linc-2184-0-63807166428dc
unix  2      [ ACC ]     STREAM     LISTENING     25404    8491/python         /tmp/orbit-leo/linc-212b-0-67b0eba276040
unix  2      [ ACC ]     STREAM     LISTENING     25609    8493/python         /tmp/orbit-leo/linc-212d-0-e88917a89a50
unix  2      [ ACC ]     STREAM     LISTENING     75214    2710/firefox        /tmp/orbit-leo/linc-a96-0-67453211bf43b
unix  2      [ ACC ]     STREAM     LISTENING     20365    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  2      [ ACC ]     STREAM     LISTENING     76494    2951/gnome-terminal /tmp/orbit-leo/linc-b87-0-7d8f567c7b045
unix  3      [ ]         DGRAM                    25179    8501/wpa_supplicant /var/run/wpa_supplicant0/wlan0
unix  2      [ ]         DGRAM                    25181    6710/NetworkManager /var/run/NetworkManager/wpa_ctrl_6710-2
unix  2      [ ]         DGRAM                    8528     3785/udevd          @/org/kernel/udev/udevd
unix  2      [ ACC ]     STREAM     LISTENING     123177   29446/dbus-daemon   @/tmp/dbus-0gCB9I7gsF
unix  2      [ ]         DGRAM                    17913    7541/hald           @/org/freedesktop/hal/udev_event
unix  2      [ ACC ]     STREAM     LISTENING     17874    7541/hald           @/var/run/hald/dbus-bNTXvFTg9J
unix  2      [ ACC ]     STREAM     LISTENING     17047    7142/powertweakd    /var/run/powertweakd
unix  2      [ ACC ]     STREAM     LISTENING     16537    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     122441   29445/dbus-launch   /tmp/gedit-svn.root.123364257
unix  2      [ ACC ]     STREAM     LISTENING     17829    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  2      [ ]         DGRAM                    25028    8501/wpa_supplicant /var/run/wpa_supplicant-global
unix  8      [ ]         DGRAM                    16368    6579/syslogd        /dev/log
unix  3      [ ]         STREAM     CONNECTED     128796   7423/winbindd       
unix  3      [ ]         STREAM     CONNECTED     128795   30507/winbindd      
unix  3      [ ]         STREAM     CONNECTED     128793   7423/winbindd       
unix  3      [ ]         STREAM     CONNECTED     128792   30506/winbindd      
unix  2      [ ]         STREAM     CONNECTED     128791   30506/winbindd      /var/run/samba/winbindd_privileged/pipe
unix  3      [ ]         STREAM     CONNECTED     123183   7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     123182   29445/dbus-launch   
unix  3      [ ]         STREAM     CONNECTED     123179   29446/dbus-daemon   
unix  3      [ ]         STREAM     CONNECTED     123178   29446/dbus-daemon   
unix  3      [ ]         STREAM     CONNECTED     123165   7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     123164   29445/dbus-launch   
unix  3      [ ]         STREAM     CONNECTED     76517    2955/gnome-pty-help 
unix  3      [ ]         STREAM     CONNECTED     76516    2951/gnome-terminal 
unix  3      [ ]         STREAM     CONNECTED     76501    2951/gnome-terminal /tmp/orbit-leo/linc-b87-0-7d8f567c7b045
unix  3      [ ]         STREAM     CONNECTED     76500    8413/bonobo-activat 
unix  3      [ ]         STREAM     CONNECTED     76499    8413/bonobo-activat /tmp/orbit-leo/linc-20dd-0-103ceb0ee6319
unix  3      [ ]         STREAM     CONNECTED     76498    2951/gnome-terminal 
unix  3      [ ]         STREAM     CONNECTED     76497    2951/gnome-terminal /tmp/orbit-leo/linc-b87-0-7d8f567c7b045
unix  3      [ ]         STREAM     CONNECTED     76496    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     76493    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     76492    2951/gnome-terminal 
unix  3      [ ]         STREAM     CONNECTED     76490    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     76489    2951/gnome-terminal 
unix  3      [ ]         STREAM     CONNECTED     76485    7794/X              /tmp/.X11-unix/X0
unix  8      [ ]         STREAM     CONNECTED     76484    2951/gnome-terminal 
unix  3      [ ]         STREAM     CONNECTED     75225    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     75224    2710/firefox        
unix  3      [ ]         STREAM     CONNECTED     75217    2710/firefox        /tmp/orbit-leo/linc-a96-0-67453211bf43b
unix  3      [ ]         STREAM     CONNECTED     75216    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     75213    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     75212    2710/firefox        
unix  3      [ ]         STREAM     CONNECTED     75210    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     75209    2710/firefox        
unix  3      [ ]         STREAM     CONNECTED     75203    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     75202    2710/firefox        
unix  3      [ ]         STREAM     CONNECTED     25803    7794/X              /tmp/.X11-unix/X0
unix  4      [ ]         STREAM     CONNECTED     25802    8649/conky          
unix  2      [ ]         STREAM     CONNECTED     25751    8301/gnome-keyring- /tmp/keyring-XRaIfV/socket
unix  3      [ ]         STREAM     CONNECTED     25614    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25613    8493/python         
unix  3      [ ]         STREAM     CONNECTED     25612    8493/python         /tmp/orbit-leo/linc-212d-0-e88917a89a50
unix  3      [ ]         STREAM     CONNECTED     25611    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     25608    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     25607    8493/python         
unix  3      [ ]         STREAM     CONNECTED     25467    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25466    8495/python         
unix  3      [ ]         STREAM     CONNECTED     25431    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25430    8456/compiz.real    
unix  3      [ ]         STREAM     CONNECTED     25410    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25409    8491/python         
unix  3      [ ]         STREAM     CONNECTED     25407    8491/python         /tmp/orbit-leo/linc-212b-0-67b0eba276040
unix  3      [ ]         STREAM     CONNECTED     25406    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     25403    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     25402    8491/python         
unix  3      [ ]         STREAM     CONNECTED     25393    8580/gtk-window-dec /tmp/orbit-leo/linc-2184-0-63807166428dc
unix  3      [ ]         STREAM     CONNECTED     25392    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     25389    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     25388    8580/gtk-window-dec 
unix  3      [ ]         STREAM     CONNECTED     25384    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     25383    8580/gtk-window-dec 
unix  3      [ ]         STREAM     CONNECTED     25369    8495/python         /tmp/orbit-leo/linc-212f-0-1f1c297131c79
unix  3      [ ]         STREAM     CONNECTED     25368    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     25365    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     25364    8495/python         
unix  2      [ ]         DGRAM                    25348    8571/dhclient       
unix  3      [ ]         STREAM     CONNECTED     25267    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25266    8493/python         
unix  3      [ ]         STREAM     CONNECTED     25262    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     25261    8493/python         
unix  3      [ ]         STREAM     CONNECTED     25258    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     25257    8491/python         
unix  3      [ ]         STREAM     CONNECTED     25252    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     25251    8495/python         
unix  3      [ ]         STREAM     CONNECTED     25222    8518/gvfsd-trash    @/dbus-vfs-daemon/socket-vfNwdPHJ
unix  3      [ ]         STREAM     CONNECTED     25221    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25223    8518/gvfsd-trash    @/dbus-vfs-daemon/socket-t7pk8U19
unix  3      [ ]         STREAM     CONNECTED     25220    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25147    8518/gvfsd-trash    @/dbus-vfs-daemon/socket-ncWGgje6
unix  3      [ ]         STREAM     CONNECTED     25146    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25148    8518/gvfsd-trash    @/dbus-vfs-daemon/socket-8zEo8DjB
unix  3      [ ]         STREAM     CONNECTED     25145    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25123    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25122    8518/gvfsd-trash    
unix  3      [ ]         STREAM     CONNECTED     25117    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25116    8518/gvfsd-trash    
unix  3      [ ]         STREAM     CONNECTED     25090    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     25089    8503/gnome-vfs-daem 
unix  3      [ ]         STREAM     CONNECTED     25088    8503/gnome-vfs-daem /tmp/orbit-leo/linc-2137-0-2a62829e321c7
unix  3      [ ]         STREAM     CONNECTED     25087    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     25077    8509/gvfsd-burn     @/dbus-vfs-daemon/socket-MUFxWlzM
unix  3      [ ]         STREAM     CONNECTED     25076    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25075    8509/gvfsd-burn     @/dbus-vfs-daemon/socket-reKaKzVg
unix  3      [ ]         STREAM     CONNECTED     25074    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25067    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25066    8509/gvfsd-burn     
unix  3      [ ]         STREAM     CONNECTED     25045    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25044    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     25080    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     25039    8503/gnome-vfs-daem 
unix  3      [ ]         STREAM     CONNECTED     25036    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25035    8503/gnome-vfs-daem 
unix  3      [ ]         STREAM     CONNECTED     25014    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     25013    8480/drivemount_app 
unix  3      [ ]         STREAM     CONNECTED     25015    8398/gnome-panel    /tmp/orbit-leo/linc-20ce-0-13e218f4c9b02
unix  3      [ ]         STREAM     CONNECTED     25012    8480/drivemount_app 
unix  3      [ ]         STREAM     CONNECTED     25011    8480/drivemount_app /tmp/orbit-leo/linc-2120-0-1bc42400e470
unix  3      [ ]         STREAM     CONNECTED     25010    8398/gnome-panel    
unix  3      [ ]         STREAM     CONNECTED     24957    8480/drivemount_app /tmp/orbit-leo/linc-2120-0-1bc42400e470
unix  3      [ ]         STREAM     CONNECTED     24956    8413/bonobo-activat 
unix  3      [ ]         STREAM     CONNECTED     24955    8413/bonobo-activat /tmp/orbit-leo/linc-20dd-0-103ceb0ee6319
unix  3      [ ]         STREAM     CONNECTED     24952    8480/drivemount_app 
unix  3      [ ]         STREAM     CONNECTED     24951    8480/drivemount_app /tmp/orbit-leo/linc-2120-0-1bc42400e470
unix  3      [ ]         STREAM     CONNECTED     24950    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24945    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24944    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24946    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24901    8480/drivemount_app 
unix  3      [ ]         STREAM     CONNECTED     24897    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24896    8480/drivemount_app 
unix  3      [ ]         STREAM     CONNECTED     24840    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24839    8460/avant-window-n 
unix  3      [ ]         STREAM     CONNECTED     24777    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24776    8464/nm-applet      
unix  3      [ ]         STREAM     CONNECTED     24753    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24752    8460/avant-window-n 
unix  3      [ ]         STREAM     CONNECTED     24750    8464/nm-applet      /tmp/orbit-leo/linc-2110-0-2807e8dc2fe23
unix  3      [ ]         STREAM     CONNECTED     24749    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24742    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24741    8365/pulseaudio     
unix  3      [ ]         STREAM     CONNECTED     24746    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24740    8464/nm-applet      
unix  3      [ ]         STREAM     CONNECTED     24734    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24733    8457/update-notifie 
unix  3      [ ]         STREAM     CONNECTED     24732    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24731    8470/gnome-power-ma 
unix  3      [ ]         STREAM     CONNECTED     24730    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24729    8470/gnome-power-ma 
unix  2      [ ]         DGRAM                    24725    8470/gnome-power-ma 
unix  3      [ ]         STREAM     CONNECTED     24728    8460/avant-window-n /tmp/orbit-leo/linc-210c-0-35aeadc4d7fdd
unix  3      [ ]         STREAM     CONNECTED     24724    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24721    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24720    8457/update-notifie 
unix  3      [ ]         STREAM     CONNECTED     24718    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24717    8460/avant-window-n 
unix  3      [ ]         STREAM     CONNECTED     24713    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24712    8460/avant-window-n 
unix  3      [ ]         STREAM     CONNECTED     24708    8470/gnome-power-ma /tmp/orbit-leo/linc-210a-0-7084c56099790
unix  3      [ ]         STREAM     CONNECTED     24705    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24707    8457/update-notifie /tmp/orbit-leo/linc-2109-0-1e834b49969a
unix  3      [ ]         STREAM     CONNECTED     24704    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24706    8456/compiz.real    /tmp/orbit-leo/linc-2108-0-205dba599959e
unix  3      [ ]         STREAM     CONNECTED     24703    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24698    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24696    8465/gnome-volume-m 
unix  3      [ ]         STREAM     CONNECTED     24693    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24690    8470/gnome-power-ma 
unix  3      [ ]         STREAM     CONNECTED     24692    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24689    8457/update-notifie 
unix  3      [ ]         STREAM     CONNECTED     24691    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24624    8456/compiz.real    
unix  3      [ ]         STREAM     CONNECTED     24609    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24608    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24607    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24606    8464/nm-applet      
unix  3      [ ]         STREAM     CONNECTED     24569    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24568    8465/gnome-volume-m 
unix  3      [ ]         STREAM     CONNECTED     24567    8465/gnome-volume-m /tmp/orbit-leo/linc-210e-0-7084c56060d47
unix  3      [ ]         STREAM     CONNECTED     24566    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24563    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24562    8465/gnome-volume-m 
unix  3      [ ]         STREAM     CONNECTED     24525    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24524    8465/gnome-volume-m 
unix  3      [ ]         STREAM     CONNECTED     24457    8395/nautilus       /tmp/orbit-leo/linc-20cb-0-13e218f4ca7db
unix  3      [ ]         STREAM     CONNECTED     24456    8413/bonobo-activat 
unix  3      [ ]         STREAM     CONNECTED     24455    8398/gnome-panel    /tmp/orbit-leo/linc-20ce-0-13e218f4c9b02
unix  3      [ ]         STREAM     CONNECTED     24454    8413/bonobo-activat 
unix  3      [ ]         STREAM     CONNECTED     24453    8413/bonobo-activat /tmp/orbit-leo/linc-20dd-0-103ceb0ee6319
unix  3      [ ]         STREAM     CONNECTED     24451    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24452    8413/bonobo-activat /tmp/orbit-leo/linc-20dd-0-103ceb0ee6319
unix  3      [ ]         STREAM     CONNECTED     24450    8398/gnome-panel    
unix  3      [ ]         STREAM     CONNECTED     24688    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24449    8470/gnome-power-ma 
unix  3      [ ]         STREAM     CONNECTED     24445    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24444    8470/gnome-power-ma 
unix  3      [ ]         STREAM     CONNECTED     24687    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24373    8457/update-notifie 
unix  3      [ ]         STREAM     CONNECTED     24369    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24368    8457/update-notifie 
unix  3      [ ]         STREAM     CONNECTED     24300    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24299    8456/compiz.real    
unix  3      [ ]         STREAM     CONNECTED     24297    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24296    8456/compiz.real    
unix  3      [ ]         STREAM     CONNECTED     24220    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24219    8421/gvfsd          
unix  3      [ ]         STREAM     CONNECTED     24210    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     24209    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24167    8395/nautilus       /tmp/orbit-leo/linc-20cb-0-13e218f4ca7db
unix  3      [ ]         STREAM     CONNECTED     24166    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24163    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24162    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24161    8398/gnome-panel    /tmp/orbit-leo/linc-20ce-0-13e218f4c9b02
unix  3      [ ]         STREAM     CONNECTED     24160    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     24156    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     24155    8398/gnome-panel    
unix  3      [ ]         STREAM     CONNECTED     24157    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24154    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24153    8302/gnome-session  /tmp/.ICE-unix/8302
unix  3      [ ]         STREAM     CONNECTED     24152    8398/gnome-panel    
unix  3      [ ]         STREAM     CONNECTED     24145    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24144    8398/gnome-panel    
unix  3      [ ]         STREAM     CONNECTED     24141    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     24140    8395/nautilus       
unix  3      [ ]         STREAM     CONNECTED     24132    8365/pulseaudio     /tmp/.esd-1000/socket
unix  3      [ ]         STREAM     CONNECTED     24131    8302/gnome-session  
unix  3      [ ]         STREAM     CONNECTED     23958    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     23957    8393/gnome-screensa 
unix  3      [ ]         STREAM     CONNECTED     23956    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     23955    8393/gnome-screensa 
unix  3      [ ]         STREAM     CONNECTED     23954    8393/gnome-screensa /tmp/orbit-leo/linc-20bc-0-106e8f325a1fc
unix  3      [ ]         STREAM     CONNECTED     23953    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     23950    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     23949    8393/gnome-screensa 
unix  3      [ ]         STREAM     CONNECTED     23945    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     23944    8393/gnome-screensa 
unix  3      [ ]         STREAM     CONNECTED     23835    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     23834    8365/pulseaudio     
unix  3      [ ]         STREAM     CONNECTED     23833    8372/gconf-helper   /tmp/orbit-leo/linc-20b4-0-5c52a53720cdf
unix  3      [ ]         STREAM     CONNECTED     23832    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     23829    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     23828    8372/gconf-helper   
unix  3      [ ]         STREAM     CONNECTED     23839    8365/pulseaudio     /tmp/.esd-1000/socket
unix  3      [ ]         STREAM     CONNECTED     23787    8361/gnome-settings 
unix  3      [ ]         STREAM     CONNECTED     22241    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     22240    8365/pulseaudio     
unix  3      [ ]         STREAM     CONNECTED     21363    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     21362    8356/seahorse-agent 
unix  3      [ ]         STREAM     CONNECTED     20411    8361/gnome-settings /tmp/orbit-leo/linc-20a9-0-597d09c6d1cf2
unix  3      [ ]         STREAM     CONNECTED     20410    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     20407    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     20406    8361/gnome-settings 
unix  3      [ ]         STREAM     CONNECTED     20402    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     20401    8361/gnome-settings 
unix  3      [ ]         STREAM     CONNECTED     20400    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     20399    8361/gnome-settings 
unix  3      [ ]         STREAM     CONNECTED     20369    8360/dbus-daemon    @/tmp/dbus-HLGO7BzZAr
unix  3      [ ]         STREAM     CONNECTED     20368    8302/gnome-session  
unix  3      [ ]         STREAM     CONNECTED     20367    8360/dbus-daemon    
unix  3      [ ]         STREAM     CONNECTED     20366    8360/dbus-daemon    
unix  3      [ ]         STREAM     CONNECTED     20350    8302/gnome-session  /tmp/orbit-leo/linc-206e-0-5b07c71e4fb6b
unix  3      [ ]         STREAM     CONNECTED     20349    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     20346    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     20345    8302/gnome-session  
unix  3      [ ]         STREAM     CONNECTED     20314    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     20313    8302/gnome-session  
unix  3      [ ]         STREAM     CONNECTED     20279    8356/seahorse-agent /tmp/orbit-leo/linc-206e-0-2b722f10c6519
unix  3      [ ]         STREAM     CONNECTED     20278    8296/gconfd-2       
unix  3      [ ]         STREAM     CONNECTED     20275    8296/gconfd-2       /tmp/orbit-leo/linc-2068-0-6c4c11c161e29
unix  3      [ ]         STREAM     CONNECTED     20274    8356/seahorse-agent 
unix  3      [ ]         STREAM     CONNECTED     20270    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     20269    8356/seahorse-agent 
unix  3      [ ]         STREAM     CONNECTED     20128    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     20127    7783/gdm            
unix  3      [ ]         STREAM     CONNECTED     20119    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     20118    8301/gnome-keyring- 
unix  3      [ ]         STREAM     CONNECTED     19768    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     19767    7794/X              
unix  3      [ ]         STREAM     CONNECTED     19277    6455/acpid          /var/run/acpid.socket
unix  3      [ ]         STREAM     CONNECTED     19276    7794/X              
unix  3      [ ]         STREAM     CONNECTED     18965    6455/acpid          /var/run/acpid.socket
unix  3      [ ]         STREAM     CONNECTED     18964    7794/X              
unix  4      [ ]         STREAM     CONNECTED     19769    7794/X              /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     18925    7783/gdm            
unix  3      [ ]         STREAM     CONNECTED     18619    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  3      [ ]         STREAM     CONNECTED     18618    7727/scd0 (every 2  
unix  3      [ ]         STREAM     CONNECTED     18617    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     18616    7727/scd0 (every 2  
unix  3      [ ]         STREAM     CONNECTED     18242    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     18241    7673/hald-addon-cpu 
unix  3      [ ]         STREAM     CONNECTED     18229    6455/acpid          /var/run/acpid.socket
unix  3      [ ]         STREAM     CONNECTED     18228    7674/acpid.socket   
unix  3      [ ]         STREAM     CONNECTED     18223    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  3      [ ]         STREAM     CONNECTED     18221    7674/acpid.socket   
unix  3      [ ]         STREAM     CONNECTED     18222    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  3      [ ]         STREAM     CONNECTED     18220    7673/hald-addon-cpu 
unix  3      [ ]         STREAM     CONNECTED     18097    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  3      [ ]         STREAM     CONNECTED     18082    7656/event5         
unix  3      [ ]         STREAM     CONNECTED     18096    7541/hald           @/var/run/hald/dbus-cF2jvw99X9
unix  3      [ ]         STREAM     CONNECTED     18080    7655/hald-addon-del 
unix  3      [ ]         STREAM     CONNECTED     17893    7541/hald           @/var/run/hald/dbus-bNTXvFTg9J
unix  3      [ ]         STREAM     CONNECTED     17892    7557/hald-runner    
unix  3      [ ]         STREAM     CONNECTED     17873    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     17872    7556/console-kit-da 
unix  3      [ ]         STREAM     CONNECTED     17831    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     17830    7541/hald           
unix  3      [ ]         STREAM     CONNECTED     17777    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     17776    7510/dhcdbd         
unix  2      [ ]         DGRAM                    17775    7510/dhcdbd         
unix  3      [ ]         STREAM     CONNECTED     17705    7423/winbindd       
unix  3      [ ]         STREAM     CONNECTED     17704    7437/winbindd       
unix  3      [ ]         STREAM     CONNECTED     16666    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     16665    6769/avahi-daemon:  
unix  3      [ ]         STREAM     CONNECTED     16660    6770/avahi-daemon:  
unix  3      [ ]         STREAM     CONNECTED     16659    6769/avahi-daemon:  
unix  2      [ ]         DGRAM                    16657    6769/avahi-daemon:  
unix  3      [ ]         STREAM     CONNECTED     16601    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     16600    6737/system-tools-b 
unix  3      [ ]         STREAM     CONNECTED     16592    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     16591    6724/NetworkManager 
unix  3      [ ]         STREAM     CONNECTED     16562    6694/dbus-daemon    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     16561    6710/NetworkManager 
unix  2      [ ]         DGRAM                    16557    6710/NetworkManager 
unix  3      [ ]         STREAM     CONNECTED     16540    6694/dbus-daemon    
unix  3      [ ]         STREAM     CONNECTED     16539    6694/dbus-daemon    
unix  2      [ ]         DGRAM                    16462    6648/klogd          
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
```

----------


## unoodles

Actually the reason I asked if you had nepenthes was that it will emulate rootkits and vulnerabilities to pick up malware. I used to think i was infected by bindshell, but it turned out that it was only nepenthes. It could be portsentry.

----------


## LeoSolaris

ahhh...    I see.

Well then, I'll remove nepenthes...

----------


## Sydero

You don't have two rootkits, just one.  wlan is normal.  And even then you probably don't have any.

PortSentry is listed is known to give false positives, as listed in the README.




> the sniffer check is just an informational check, it doesn't necessarily
> mean that you've been rooted.  there are several legitimate sniffers out
> there; however, you may still want to check that the sniffer is the one
> that you think it is, etc.
> 
> In general, any process starting at around same time as lkm test may
> trigger a warning. Just try while true;do chkrootkit lkm;sleep 1;done
> during normal system use. See also FAQ 6 on www.chkrootkit.org -- paolo
> 
> ...

----------


## LeoSolaris

Thank ya!

The second, other than the bindshell was this one:

Searching for OBSD rk v1... /usr/lib/security
/usr/lib/security/classpath.security

I looked at that, and it did not "seem" to be threatening. At least the comments and the names of the commands. 

I should have known to check the known false positives lists that was likely to be on chkrootkit's homepage.

Leo

----------


## pedja_portugalac

I also found this:



> eth0: PACKET SNIFFER(/sbin/dhclient3[5648])


Investigating around I found that's DHCP client for linux. What is DHCP? DHCP is the protocol computers use to request and receive a "dynamic" IP address.
As my internet provider use DHCP on cable modem to allocate me one IP address and I have allowed that service on my firewall, I presume that's normal, or maybe not. If you guys know something about it please post it here. 

*DHCP is the protocol computers use to request and receive a "dynamic" IP address.* by Leo Notenboom

What is DHCP?

DHCP stands for "Dynamic Host Configuration Protocol".

So I can hear you thinking, "great ... what's that?"

In a nutshell, it's the request your computer makes and the response it receives that assigns it a "dynamic" IP address.

Let's look at that a little more closely.



First, a refresher. Every computer on the internet has an "address". That address is just a number, but it uniquely identifies that computer; no other computer on the internet can have the same address.

There are two types of IP addresses: static and dynamic. Static IP addresses are just that - unchanging. They refer to a particular computer, whether that computer is turned on or not, connected or not. Most typically domain names like "ask-leo.com" map to a single static IP address.

Dynamic IP addresses are assigned to a computer on-the-fly. The most common scenario is dial-up. When you dial-up to your ISP, part of the connection sequence is your computer asking for an IP address, and your ISP assigning it one of the addresses it has available. When you disconnect, that IP address is returned to the list of available addresses and may be reused by another computer when it dials in.

Because most home users tend to turn their computers off, even broadband connections such as DSL and Cable continue to use dynamic addresses. If your computer is off, you don't need an address so someone else might get to use it.

Dynamic addresses are also used by NAT routers. Not necessarily on their internet connection, though it can, but rather on the local area network side. Each computer that you connect to your router will ask for an IP address, and that router will respond with an IP address that's available within your LAN.

The actual DHCP protocol is fairly simple. The computer in need of an IP address broadcasts a request, meaning it sends out a request to anyone who'll listen. That, in essence, says "Hey, anyone? I need an IP address!" By definition on any network (or more correctly, sub-network), there should at most one device who's job it is to answer back "Sure, here ya go, have this one." That's a DHCP server. Along with that answer is additional information as well, such as what machines to ask for domain name (DNS) look-ups and what address to forward all outgoing network traffic, too (the gateway).

In Windows, if your computer doesn't get a response from a DHCP server within a certain amount of time, it will give up or it may fall back to only asking every few minutes. It may "make up" an answer as well. In fact if your IP address begins with "169.", that's probably exactly what's happened; no IP address was assigned, and Windows made one up. And I'll bet your networking and internet don't work.

----------


## x3roconf

> Actually the reason I asked if you had nepenthes was that it will emulate rootkits and vulnerabilities to pick up malware. I used to think i was infected by bindshell, but it turned out that it was only nepenthes. It could be portsentry.


Wtf are you talking about? Nepenthes emulates only windows vulnerabilities and it can't emulate any rootkits!  :Smile:

----------

