1

I am new to rkhunter, which I have been using on Lubuntu 18.04. While it is running, it indicates an itemized scan of rootkits in two waves. First, it states: Performing check of known rootkit files and directories. Then: Performing additional rootkit checks. In both instances, literally every item scanned comes back as [not found]. So it is quite perplexing to find the following in the system checks summary at the bottom: 

Rootkit checks...
    Rootkits checked : 479
    Possible rootkits: 4

What is happening here? Why does the summary indicate four possible rootkits when the itemized scan indicate none?

Absurdistan
  • 185
  • 2
  • 6

1 Answers1

1

I think you are probably getting a couple [WARNING] messages in the Performing file properties checks, which is being flagged as a possible rootkit.

Running:

sudo rkhunter --propupd

when you first install rkhunter and after any software upgrades should fix it. Just understand that all this program does is check for changes in system files vs stored values in it's database. If these files were maliciously changed and you ran the above command, rkhunter would report everything as okay.

Source and additional info: https://help.ubuntu.com/community/RKhunter

they
  • 933
  • 1
  • 5
  • 7