1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
|
^ROOTDIR is `/[^ ]+/CHKROOTKIT_ROOT/'$
^Checking `amd'\.\.\. INFECTED$
^Checking `basename'\.\.\. INFECTED$
^Checking `biff'\.\.\. INFECTED$
^Checking `chfn'\.\.\. INFECTED$
^Checking `chsh'\.\.\. INFECTED$
^Checking `cron'\.\.\. INFECTED$
^Checking `crontab'\.\.\. WARNING$
^$
^WARNING: crontab for nobody found, possible Lupper\.Worm\.$
^Checking for Lupper\.Worm\.\.\. INFECTED$
^Checking `date'\.\.\. INFECTED$
^Checking `du'\.\.\. INFECTED$
^Checking `dirname'\.\.\. INFECTED$
^Checking `echo'\.\.\. INFECTED$
^Checking `egrep'\.\.\. INFECTED$
^Checking `env'\.\.\. INFECTED$
^Checking `find'\.\.\. INFECTED$
^Checking `fingerd'\.\.\. INFECTED$
^Checking `gpm'\.\.\. INFECTED$
^Checking `grep'\.\.\. INFECTED$
^Checking `hdparm'\.\.\. INFECTED$
^Checking `su'\.\.\. INFECTED$
^Checking `ifconfig'\.\.\. INFECTED$
^Checking `inetd'\.\.\. INFECTED$
^Checking `inetdconf'\.\.\. INFECTED$
^Checking `identd'\.\.\. INFECTED$
^Checking `init'\.\.\. INFECTED$
^Checking `killall'\.\.\. INFECTED$
^Checking `ldsopreload'\.\.\. not infected$
^Checking `login'\.\.\. INFECTED$
^Checking `ls'\.\.\. INFECTED$
^Checking `lsof'\.\.\. INFECTED$
^Checking `mail'\.\.\. INFECTED$
^Checking `mingetty'\.\.\. INFECTED$
^Checking `netstat'\.\.\. INFECTED$
^Checking `named'\.\.\. INFECTED$
^Checking `passwd'\.\.\. INFECTED$
^Checking `pidof'\.\.\. INFECTED$
^Checking `pop2'\.\.\. INFECTED$
^Checking `pop3'\.\.\. INFECTED$
^Checking `ps'\.\.\. INFECTED$
^Checking `pstree'\.\.\. INFECTED$
^Checking `rpcinfo'\.\.\. INFECTED$
^Checking `rlogind'\.\.\. INFECTED$
^Checking `rshd'\.\.\. INFECTED$
^Checking `slogin'\.\.\. INFECTED$
^Checking `sendmail'\.\.\. INFECTED$
^Checking `sshd'\.\.\. INFECTED but disabled$
^Checking `syslogd'\.\.\. INFECTED$
^Checking `tar'\.\.\. INFECTED$
^Checking `tcpd'\.\.\. INFECTED$
^Checking `tcpdump'\.\.\. INFECTED$
^Checking `top'\.\.\. INFECTED$
^Checking `telnetd'\.\.\. INFECTED$
^Checking `timed'\.\.\. INFECTED$
^Checking `traceroute'\.\.\. INFECTED$
^Checking `vdir'\.\.\. INFECTED$
^Checking `w'\.\.\. INFECTED$
^Checking `write'\.\.\. INFECTED$
^Checking `aliens'\.\.\. started$
^Searching for suspicious files in /[^ ]+/CHKROOTKIT_ROOT/dev\.\.\. +WARNING$
^WARNING: The following suspicious files were found in /[^ ]+/CHKROOTKIT_ROOT/dev:$
^/[^ ]+/CHKROOTKIT_ROOT/dev/bad-file$
^Searching for known suspicious directories\.\.\. WARNING$
^WARNING: Suspect directory /[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/ found\. Looking for sniffer logs:$
^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/$
^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/y$
^Searching for known suspicious files\.\.\. WARNING$
^WARNING: The following known suspicious files were found:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/atm$
^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$
^Searching for sniffer's logs\.\.\. WARNING$
^WARNING: The following potential sniffer's logs were found:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/tcp\.log$
^Searching for HiDrootkit rootkit\.\.\. WARNING$
^WARNING: Possible HiDrootkit rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/var/lib/games/\.k/$
^Searching for t0rn rootkit\.\.\. WARNING$
^WARNING: Possible t0rn rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/etc/ttyhash$
^Searching for t0rn v8 \(or variation\)\.\.\. WARNING$
^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/local/lib/libproc\.a$
^Searching for Lion rootkit\.\.\. WARNING$
^WARNING: Possible Lion rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/bin/mjy$
^Searching for RSHA rootkit\.\.\. WARNING$
^WARNING: Possible RSHA rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/n3tstat$
^Searching for RH-Sharpe rootkit\.\.\. WARNING$
^WARNING: Possible RH-Sharpe rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/bin/lps$
^Searching for Ambient \(ark\) rootkit\.\.\. WARNING$
^WARNING: Possible Ambient's rootkit \(ark\) installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/\.ark\?$
^Searching for suspicious files and dirs\.\.\. WARNING$
^WARNING: The following suspicious files and directories were found:$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.aaa$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1DIR$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.ark\?$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.DIR$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.bbb$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.DIR-aaa$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.$
^Searching for LPD Worm\.\.\. WARNING$
^WARNING: Possible LPD worm installed \(based on files found\)$
^Searching for Ramen Worm rootkit\.\.\. WARNING$
^WARNING: Possible Ramen Worm rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/src/\.poop/$
^Searching for Maniac rootkit\.\.\. WARNING$
^WARNING: Possible Maniac rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/mailrc$
^Searching for RK17 rootkit\.\.\. WARNING$
^WARNING: Possible RK17 rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus\.cgi$
^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/number\.cgi$
^Searching for Ducoci rootkit\.\.\. WARNING$
^WARNING: Possible Ducoci rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last\.cgi$
^Searching for Adore Worm\.\.\. WARNING$
^WARNING: Possible Adore Worm installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/red\.tar$
^Searching for ShitC Worm\.\.\. WARNING$
^WARNING: Possible ShitC Worm installed:$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/dy$
^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/frgy$
^Searching for Omega Worm\.\.\. WARNING$
^WARNING: Possible Omega Worm installed:$
^/[^ ]+/CHKROOTKIT_ROOT/dev/chr$
^Searching for Sadmind/IIS Worm\.\.\. WARNING$
^WARNING: Possible Sadmin/IIS Worm installed:$
^/[^ ]+/CHKROOTKIT_ROOT/dev/cuc$
^Searching for MonKit\.\.\. WARNING$
^WARNING: Possible MonKit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/libpikapp\.a$
^Searching for Showtee rootkit\.\.\. WARNING$
^WARNING: Possible Showtee rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/chk\.h$
^Searching for OpticKit\.\.\. WARNING$
^WARNING: Possible OpticKit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$
^Searching for T\.R\.K\.\.\. WARNING$
^WARNING: Possible T\.R\.K installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$
^Searching for Mithra rootkit\.\.\. WARNING$
^WARNING: Possible Mithra installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/locale/uboot$
^Searching for OBSD rootkit v1\.\.\. not tested$
^Searching for LOC rootkit\.\.\. WARNING$
^WARNING: Possible LOC rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/xp$
^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/epic$
^Searching for Romanian rootkit\.\.\. WARNING$
^WARNING: Possible Romanian rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$
^Searching for HKRK rootkit\.\.\. WARNING$
^WARNING: Possible HKRK rootkit installed in /[^ ]+/CHKROOTKIT_ROOT/etc/rc\.d/init\.d/network$
^Searching for Suckit rootkit\.\.\. WARNING$
^WARNING: Possible Suckit:$
^/[^ ]+/CHKROOTKIT_ROOT/dev/\.golf/$
^Searching for Volc rootkit\.\.\. WARNING$
^WARNING: Possible Volc rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/volc$
^Searching for Gold2 rootkit\.\.\. WARNING$
^WARNING: Possible Gold2 rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/ishit$
^Searching for TC2 rootkit\.\.\. WARNING$
^WARNING: Possible TC2 rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/initcheck$
^Searching for Anonoying rootkit\.\.\. WARNING$
^WARNING: Possible Anonoying rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/mech$
^Searching for ZK rootkit\.\.\. WARNING$
^WARNING: Possible ZK rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/etc/sysconfig/console/load\.zk$
^Searching for ShKit rootkit\.\.\. WARNING$
^WARNING: Possible ShKit rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$
^Searching for AjaKit rootkit\.\.\. WARNING$
^WARNING: Possible AjaKit rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/dev/tux/$
^Searching for zaRwT rootkit\.\.\. WARNING$
^WARNING: Possible zaRwT rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/bin/imout$
^Searching for Madalin rootkit\.\.\. WARNING$
^WARNING: Possible Madalin rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/icekey\.h$
^Searching for Fu rootkit\.\.\. WARNING$
^WARNING: Possible Fu rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/sbin/xc$
^Searching for Kenga3 rootkit\.\.\. WARNING$
^WARNING: Possible Kenga3 rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./$
^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./foo$
^Searching for ESRK rootkit\.\.\. WARNING$
^WARNING: Possible ESRK rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/tcl5\.3/$
^Searching for rootedoor\.\.\. WARNING$
^WARNING: Possible rootedoor installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/rootedoor$
^/[^ ]+/CHKROOTKIT_ROOT/sbin/rootedoor$
^Searching for ENYELKM rootkit\.\.\. WARNING$
^WARNING: Possible ENYELKM rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/etc/\.enyelkmOCULTAR\.ko/$
^Searching for common ssh-scanners\.\.\. WARNING$
^WARNING: Possible ssh-scanner installed:$
^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/vuln\.txt$
^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$
^WARNING: /[^ ]+/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$
^Searching for Linux/Ebury 1\.6\.\.\. WARNING$
^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /[^ ]+/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils\.so\.1$
^Searching for 64-bit Linux Rootkit\.\.\. WARNING$
^WARNING: Possible 64-bit Linux Rootkit:
^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/$
^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/foo$
^/[^ ]+/CHKROOTKIT_ROOT/etc/rc\.local$
^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$
^WARNING: Possible 64-bit rootkit modules installed:$
^/[^ ]+/CHKROOTKIT_ROOT/lib/modules/module_init\.ko$
^Searching for Mumblehard\.\.\. WARNING$
^WARNING: Possible Mumblehard backdoor installed:$
^/[^ ]+/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo$
^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$
^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/ss0-0$
^Searching for Malicious TinyDNS\.\.\. WARNING$
^WARNING: Possible Malicious TinyDNS installed:$
^/[^ ]+/CHKROOTKIT_ROOT/home/ \./$
^/[^ ]+/CHKROOTKIT_ROOT/home/ \./tinyDNS$
^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$
^WARNING: Possible Linux\.Xor\.DDoS installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/strings$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/uname$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/head$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/find$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/echo$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/netstat$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls\.orig$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ps$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/awk$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep\.orig$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dirname$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ss$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/sed$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/cut$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/id$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/xargs$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dpkg-query$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive$
^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$
^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$
^Searching for CrossRAT\.\.\. WARNING$
^WARNING: Possible Malicious CrossRAT installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/var/mediamgrs\.jar$
^Searching for Hidden Cobra\.\.\. WARNING$
^WARNING: Possible Malicious Hidden Cobra installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.ICE-unix/engine\.so$
^Searching for Rocke Miner rootkit\.\.\. WARNING$
^WARNING: Possible Rocke Miner rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/etc/xig$
^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$
^WARNING: Possible PWNLNX4 lkm rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/\.1/$
^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$
^WARNING: Possible PWNLNX6 lkm rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/suterusu/$
^Searching for Umbreon lrk\.\.\. WARNING$
^WARNING: Possible Malicious UMBREON LRK installed:$
^/[^ ]+/CHKROOTKIT_ROOT/usr/share/libc\.so\.69$
^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$
^WARNING: Possible Kinsing\.a backdoor rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/kdevtmpfsi$
^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$
^WARNING: Possible RotaJakiro backdoor rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/bin/systemd-daemon$
^Searching for Syslogk LKM rootkit\.\.\. not tested$
^Searching for Kovid LKM rootkit\.\.\. WARNING$
^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /[^ ]+/CHKROOTKIT_ROOT/proc/kovid$
^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$
^WARNING: Possible Tsunami DDoS Malware rootkit installed:$
^/[^ ]+/CHKROOTKIT_ROOT/bin/cls$
^Searching for Linux BPF Door\.\.\. WARNING$
^WARNING: Possible Linux BPFDoor Malware installed:$
^/proc/xx/stack$
^Searching for suspect PHP files\.\.\. WARNING$
^WARNING: The following suspicious PHP files were found:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/name\.php$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; "
^/[^ ]+/CHKROOTKIT_ROOT/tmp/by-content$
^Searching for zero-size shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$
^WARNING: Zero-size history files:$
^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$
^Searching for hardlinked shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$
^WARNING: shell history files hardlinked to another file:$
^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$
^Checking `aliens'\.\.\. finished$
^Checking `asp'\.\.\. WARNING$
^WARNING: Possible Ramen Worm installed in /[^ ]+/CHKROOTKIT_ROOT/etc/inetd\.conf$
^Checking `bindshell'\.\.\. not tested$
^Checking `lkm'\.\.\. started$
^Searching for Adore LKM\.\.\. not tested$
^Searching for sebek LKM \(Adore based\)\.\.\. not tested$
^Searching for knark LKM rootkit\.\.\. not found$
^Searching for for hidden processes with chkproc\.\.\. not tested$
^Searching for for hidden directories using chkdirs\.\.\.
^Checking `lkm'\.\.\. finished$
^Checking `rexedcs'\.\.\. INFECTED: /[^ ]+/CHKROOTKIT_ROOT/usr/bin/in\.rexedcs$
^Checking `sniffer'\.\.\. not tested$
^Checking `w55808'\.\.\. WARNING$
^WARNING: Possible 55808 Worm installed$
^Checking `wted'\.\.\. not (tested|found)$
^Checking `scalper'\.\.\. WARNING$
^WARNING: Possible Scalper Worm installed$
^Checking `slapper'\.\.\. WARNING$
^WARNING: Possible Slapper Worm installed:$
^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.bugtraq\.c$
^Checking `z2'\.\.\. not (tested|found)$
^Checking `chkutmp'\.\.\. not tested$
^Checking `OSX_RSPLUG'\.\.\. not tested$
|
