Rootkit found on my Centos server

[viking60]

I did a scan with Rkunter on my Centos server and it came up with a possible rootkit find:

Code: Select all

Rootkit checks...
Rootkits checked : 368
Possible rootkits: 1
 Rootkit names    : Lite5-r Rootkit

So I checked the logs:

Code: Select all

cat /var/log/rkhunter/rkhunter.log |grep 'Lite5-r Rootkit'

And it came up with

Code: Select all

Found file '/tmp/.bash_history'. Possible rootkit: Lite5-r Rootkit

I cannot find that this is a false positive on the net.
The file /tmp/.bash_history contains :

Code: Select all

passwd
exit

Help!

[viking60]

Well I simply deleted the file -Berserk style

Code: Select all

rm /tmp/.bash_history


And checked again with rkhunter this time it did not find anything. I guess that kind of solves the issue (But rootkit issues often mean reinstalling the OS).
The history seems to work just fine.

[R_Head]

Interesting... I believe that I can use the same commands on my Mageia 5 PC?

[viking60]

Sure! if you have installed Rkhunter.
The command would be:

Code: Select all

sudo rkhunter -c

to scan your box for nasty stuff.

[Blackcrack]

Hi,

interesting how long the rootkit list today is..


i have test this proggy on my Fedora 33 server today too..
nice so far.. there should creating an runtime-service and a Plasma/Gnome systrayplugin for..
could be a nice thing.., and if found a rootkit, could be become a Popupmessage like:
"[IcoXicO] We have found a %Rootkit%, there is the log : %Log-Link% readable for all"
to make able for copy and send via mail or so to inform Armin or Serverowner

an plugin for own/nextcloud could be also a nice thing

best

System checks summary
=====================

File properties checks...
Required commands check failed
Files checked: 138
Suspect files: 4

Rootkit checks...
Rootkits checked : 502
Possible rootkits: 0

Applications checks...
All checks skipped

The system checks took: 11 minutes and 45 seconds

All results have been written to the log file: /var/log/rkhunter/rkhunter.log

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter/rkhunter.log)