Shulou(Shulou.com)06/01 Report--

Chkrootkit is a tool that checks rootkit traces on the local system. It is a shell script that checks whether the system binaries have been modified by the rootkit virus.

System environment Centos 6.4

Chkrootkit-0.50 (currently the latest version)

# tar xf chkrootkit.tar.gz

# cd chkrootkit

Chkrootkit-0.50/ chkrootkit.tar.gz

# cd chkrootkit-0.50/

# make sense

Cc-DHAVE_LASTLOG_H-o chklastlog chklastlog.c

Make: cc: Command not found

Make: * * [chklastlog] Error 127

# yum install gcc

And then make sense again.

Cc-DHAVE_LASTLOG_H-o chklastlog chklastlog.c

Cc-DHAVE_LASTLOG_H-o chkwtmp chkwtmp.c

Cc-DHAVE_LASTLOG_H-D_FILE_OFFSET_BITS=64-o ifpromisc ifpromisc.c

Cc-o chkproc chkproc.c

Cc-o chkdirs chkdirs.c

Cc-o check_wtmpx check_wtmpx.c

Cc-static-o strings-static strings.c

/ usr/bin/ld: cannot find-lc

Collect2: ld returned 1 exit status

Make: * * [strings-static] Error 1

After searching for this mistake online for a long time, I finally found the answer on a fedora-related forum. Personally, I feel that this error is not often encountered when others install it, or it is directly installed by yum.

# yum install glibc-static

# make clean

# make sense

Cc-DHAVE_LASTLOG_H-o chklastlog chklastlog.c

Cc-DHAVE_LASTLOG_H-o chkwtmp chkwtmp.c

Cc-DHAVE_LASTLOG_H-D_FILE_OFFSET_BITS=64-o ifpromisc ifpromisc.c

Cc-o chkproc chkproc.c

Cc-o chkdirs chkdirs.c

Cc-o check_wtmpx check_wtmpx.c

Cc-static-o strings-static strings.c

Cc-o chkutmp chkutmp.c

#. / chkrootkit-V

Execute the chkrootkit command directly

#. / chkrootkit

ROOTDIR is `/'

Checking `amd'... Not found

Checking `basename'... Not infected

Checking `biff'... Not found

Checking `chfn'... Not infected

Checking `chsh'... Not infected

.

Checking `sniffer'... Eth0: PF_PACKET (/ sbin/dhclient)

Checking `w55808... Not infected

Checking `wted'... Chkwtmp: nothing deleted

Checking `scalper'... Not infected

Checking `slapper'... Not infected

Checking `z2mm... Chklastlog: nothing deleted

Checking `chkutmp'... Chkutmp: nothing deleted

Checking `OSX_RSPLUG'... Not infected

Chkrootkit will scan the important files in the system, and the above results show that the system is relatively clean.

It can be added to crontab scheduled tasks and scanned regularly, depending on the situation.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.