View Single Post
  #1  
Old 31st March 2010, 14:32
esezako esezako is offline
Senior Member
 
Join Date: Dec 2008
Posts: 176
Thanks: 16
Thanked 4 Times in 3 Posts
Default rkhunter warnings

Hi, i have problems with mails. When i pass the rkhunter i have this result:

Code:
(14:05:12) Running Rootkit Hunter version 1.3.4 on ns1
(14:05:12)
(14:05:12) Info: Start date is miť mar 31 14:05:12 CEST 2010
(14:05:12)
(14:05:12) Checking configuration file and command-line options...
(14:05:12) Info: Detected operating system is 'Linux'
(14:05:12) Info: Found O/S name: Debian 4.0
(14:05:12) Info: Command line is /usr/local/bin/rkhunter -c
(14:05:12) Info: Environment shell is /bin/bash; rkhunter is using bash
(14:05:12) Info: Using configuration file '/etc/rkhunter.conf'
(14:05:12) Info: Installation directory is '/usr/local'
(14:05:12) Info: Using language 'en'
(14:05:12) Info: Using '/var/lib/rkhunter/db' as the database directory
(14:05:12) Info: Using '/usr/local/lib/rkhunter/scripts' as the support script directory
(14:05:12) Info: Using '/usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /sbin /bin /bin /usr/bin /sbin /usr/sbin /usr/local/bin /usr/local/sbin /usr/libexec /usr/local/libexec' as the command directories
(14:05:12) Info: Using '/' as the root directory by default
(14:05:12) Info: Using '/var/lib/rkhunter/tmp' as the temporary directory
(14:05:13) Info: No mail-on-warning address configured
(14:05:13) Info: X will be automatically detected
(14:05:13) Info: Found the 'diff' command: /usr/bin/diff
(14:05:13) Info: Found the 'file' command: /usr/bin/file
(14:05:13) Info: Found the 'find' command: /usr/bin/find
(14:05:13) Info: Found the 'ifconfig' command: /sbin/ifconfig
(14:05:13) Info: Unable to find the 'ip' command
(14:05:13) Info: Found the 'ldd' command: /usr/bin/ldd
(14:05:13) Info: Found the 'lsattr' command: /usr/bin/lsattr
(14:05:13) Info: Found the 'lsmod' command: /sbin/lsmod
(14:05:13) Info: Unable to find the 'lsof' command
(14:05:13) Info: Found the 'mktemp' command: /bin/mktemp
(14:05:13) Info: Found the 'netstat' command: /bin/netstat
(14:05:13) Info: Found the 'perl' command: /usr/bin/perl
(14:05:13) Info: Found the 'ps' command: /bin/ps
(14:05:13) Info: Found the 'pwd' command: /bin/pwd
(14:05:13) Info: Found the 'readlink' command: /bin/readlink
(14:05:13) Info: Found the 'sort' command: /usr/bin/sort
(14:05:13) Info: Found the 'stat' command: /usr/bin/stat
(14:05:13) Info: Found the 'strings' command: /usr/bin/strings
(14:05:13) Info: Found the 'uniq' command: /usr/bin/uniq
(14:05:13) Info: System is not using prelinking
(14:05:13) Info: Using the '/usr/bin/sha1sum' command for the file hash checks
(14:05:13) Info: Stored hash values used hash function '/usr/bin/sha1sum'
(14:05:13) Info: Stored hash values did not use a package manager
(14:05:13) Info: The hash function field index is set to 1
(14:05:13) Info: No package manager specified: using hash function '/usr/bin/sha1sum'
(14:05:13) Info: Previous file attributes were stored
(14:05:13) Info: Enabled tests are: all
(14:05:13) Info: Disabled tests are: suspscan hidden_procs deleted_files packet_cap_apps
(14:05:13) Info: All ksyms and kallsyms checks will be skipped - neither file is present on the system.
(14:05:13)
(14:05:13) Checking if the O/S has changed since last time...
(14:05:13) Info: Nothing seems to have changed
(14:05:13)
(14:05:13) Starting system checks...
(14:05:13)
(14:05:13) Checking system commands...
(14:05:13) Info: Starting test name 'system_commands'
(14:05:13)
(14:05:13) Performing 'strings' command checks
(14:05:13) Info: Starting test name 'strings'
(14:05:13) Scanning for string /usr/sbin/ntpsx               ( OK )
(14:05:14) Scanning for string /usr/lib/.../ls               ( OK )
(14:05:14) Scanning for string /usr/lib/.../netstat          ( OK )
(14:05:14) Scanning for string /usr/lib/.../lsof             ( OK )
(14:05:14) Scanning for string /usr/lib/.../bkit-ssh/bkit-shdcfg ( OK )
(14:05:14) Scanning for string /usr/lib/.../bkit-ssh/bkit-shhk ( OK )
(14:05:14) Scanning for string /usr/lib/.../bkit-ssh/bkit-pw ( OK )
(14:05:14) Scanning for string /usr/lib/.../bkit-ssh/bkit-shrs ( OK )
(14:05:14) Scanning for string /usr/lib/.../uconf.inv        ( OK )
(14:05:14) Scanning for string /usr/lib/.../psr              ( OK )
(14:05:14) Scanning for string /usr/lib/.../find             ( OK )
(14:05:14) Scanning for string /usr/lib/.../pstree           ( OK )
(14:05:14) Scanning for string /usr/lib/.../slocate          ( OK )
(14:05:14) Scanning for string /usr/lib/.../du               ( OK )
(14:05:14) Scanning for string /usr/lib/.../top              ( OK )
(14:05:14) Scanning for string /usr/lib/...                  ( OK )
(14:05:14) Scanning for string /usr/lib/.../bkit-ssh         ( OK )
(14:05:14) Scanning for string /usr/lib/.bkit-               ( OK )
(14:05:14) Scanning for string /tmp/.bkp                     ( OK )
(14:05:14) Scanning for string /tmp/.cinik                   ( OK )
(14:05:14) Scanning for string /tmp/.font-unix/.cinik        ( OK )
(14:05:14) Scanning for string /lib/.sso                     ( OK )
(14:05:14) Scanning for string /lib/.so                      ( OK )
(14:05:14) Scanning for string /var/run/...dica/clean        ( OK )
(14:05:14) Scanning for string /var/run/...dica/xl           ( OK )
(14:05:14) Scanning for string /var/run/...dica/xdr          ( OK )
(14:05:15) Scanning for string /var/run/...dica/psg          ( OK )
(14:05:15) Scanning for string /var/run/...dica/secure       ( OK )
(14:05:15) Scanning for string /var/run/...dica/rdx          ( OK )
(14:05:15) Scanning for string /var/run/...dica/va           ( OK )
(14:05:15) Scanning for string /var/run/...dica/cl.sh        ( OK )
(14:05:15) Scanning for string /usr/bin/.etc                 ( OK )
(14:05:15) Scanning for string /usr/lib/.fx/sched_host.2     ( OK )
(14:05:15) Scanning for string /usr/lib/.fx/random_d.2       ( OK )
(14:05:15) Scanning for string /usr/lib/.fx/set_pid.2        ( OK )
(14:05:15) Scanning for string /usr/lib/.fx/cons.saver       ( OK )
(14:05:15) Scanning for string /usr/lib/.fx/adore/adore/adore.ko ( OK )
(14:05:15) Scanning for string /bin/sysback                  ( OK )
(14:05:15) Scanning for string /usr/local/bin/sysback        ( OK )
(14:05:15) Scanning for string /usr/lib/.tbd                 ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/t0rns       ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/du          ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/ls          ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/t0rnsb      ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/ps          ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/t0rnp       ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/find        ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/ifconfig    ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/pg          ( OK )
(14:05:15) Scanning for string /dev/.lib/lib/lib/ssh.tgz     ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/top         ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/sz          ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/login       ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/in.fingerd  ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/1i0n.sh     ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/pstree      ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/in.telnetd  ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/mjy         ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/sush        ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/tfn         ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/name        ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/getip.sh    ( OK )
(14:05:16) Scanning for string /usr/info/.torn/sh*           ( OK )
(14:05:16) Scanning for string /usr/src/.puta/.1addr         ( OK )
(14:05:16) Scanning for string /usr/src/.puta/.1file         ( OK )
(14:05:16) Scanning for string /usr/src/.puta/.1proc         ( OK )
(14:05:16) Scanning for string /usr/src/.puta/.1logz         ( OK )
(14:05:16) Scanning for string /usr/info/.t0rn               ( OK )
(14:05:16) Scanning for string /dev/.lib                     ( OK )
(14:05:16) Scanning for string /dev/.lib/lib                 ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib             ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/lib/dev         ( OK )
(14:05:16) Scanning for string /dev/.lib/lib/scan            ( OK )
(14:05:17) Scanning for string /usr/src/.puta                ( OK )
(14:05:17) Scanning for string /usr/man/man1/man1            ( OK )
(14:05:17) Scanning for string /usr/man/man1/man1/lib        ( OK )
(14:05:17) Scanning for string /usr/man/man1/man1/lib/.lib   ( OK )
(14:05:17) Scanning for string /usr/man/man1/man1/lib/.lib/.backup ( OK )
(14:05:17)
(14:05:17) Performing 'shared libraries' checks
(14:05:17) Info: Starting test name 'shared_libs'
(14:05:17) Checking for preloading variables                 ( None found )
(14:05:17) Checking for preload file                         ( Not found )
(14:05:17) Info: Starting test name 'shared_libs_path'
(14:05:17) Checking LD_LIBRARY_PATH variable                 ( Not found )
(14:05:17)
(14:05:17) Performing file properties checks
(14:05:17) Info: Starting test name 'properties'
(14:05:17) Checking for prerequisites                        ( OK )
(14:05:17) /bin/bash                                         ( Warning )
(14:05:17) Warning: The file properties have changed:
(14:05:17)          File: /bin/bash
(14:05:17)          Current inode: 85017415    Stored inode: 54214712
(14:05:17) /bin/cat                                          ( Warning )
(14:05:18) Warning: The file properties have changed:
(14:05:18)          File: /bin/cat
(14:05:18)          Current inode: 85017795    Stored inode: 54214717
(14:05:18) /bin/chmod                                        ( Warning )
(14:05:18) Warning: The file properties have changed:
(14:05:18)          File: /bin/chmod
(14:05:18)          Current inode: 85017814    Stored inode: 54214666
(14:05:18) /bin/chown                                        ( Warning )
(14:05:18) Warning: The file properties have changed:
(14:05:18)          File: /bin/chown
(14:05:18)          Current inode: 85017887    Stored inode: 54214707
(14:05:18) /bin/cp                                           ( Warning )
(14:05:18) Warning: The file properties have changed:
(14:05:18)          File: /bin/cp
(14:05:18)          Current inode: 85017991    Stored inode: 54214718
(14:05:18) /bin/date                                         ( Warning )
(14:05:18) Warning: The file properties have changed:
(14:05:18)          File: /bin/date
(14:05:18)          Current inode: 85018165    Stored inode: 54214662
(14:05:19) /bin/df                                           ( Warning )
(14:05:19) Warning: The file properties have changed:
(14:05:19)          File: /bin/df
(14:05:19)          Current inode: 85018287    Stored inode: 54214709
(14:05:19) /bin/dmesg                                        ( Warning )
(14:05:19) Warning: The file properties have changed:
(14:05:19)          File: /bin/dmesg
(14:05:19)          Current inode: 85018292    Stored inode: 54214664
(14:05:19) /bin/echo                                         ( Warning )
(14:05:19) Warning: The file properties have changed:
(14:05:19)          File: /bin/echo
(14:05:19)          Current inode: 85018294    Stored inode: 54214706
(14:05:19) /bin/ed                                           ( Warning )
(14:05:19) Warning: The file properties have changed:
(14:05:19)          File: /bin/ed
(14:05:19)          Current inode: 85018295    Stored inode: 54214685
(14:05:19) /bin/egrep                                        ( Warning )
(14:05:19) Warning: The file properties have changed:
(14:05:19)          File: /bin/egrep
(14:05:19)          Current inode: 85018296    Stored inode: 54214728
(14:05:20) Warning: The command '/bin/egrep' has been replaced by a script: /bin/egrep: Bourne shell script text executable
(14:05:20) /bin/fgrep                                        ( Warning )
(14:05:20) Warning: The file properties have changed:
(14:05:20)          File: /bin/fgrep
(14:05:20)          Current inode: 85018298    Stored inode: 54214711
(14:05:20) Warning: The command '/bin/fgrep' has been replaced by a script: /bin/fgrep: Bourne shell script text executable
(14:05:20) /bin/fuser                                        ( Warning )
(14:05:20) Warning: The file properties have changed:
(14:05:20)          File: /bin/fuser
(14:05:20)          Current inode: 85018299    Stored inode: 54216329
(14:05:20) /bin/grep                                         ( Warning )
(14:05:20) Warning: The file properties have changed:
(14:05:20)          File: /bin/grep
(14:05:20)          Current inode: 85018300    Stored inode: 54214731
(14:05:20) /bin/kill                                         ( Warning )
(14:05:20) Warning: The file properties have changed:
(14:05:20)          File: /bin/kill
(14:05:20)          Current inode: 85018303    Stored inode: 54214681
(14:05:21) /bin/login                                        ( Warning )
(14:05:21) Warning: The file properties have changed:
(14:05:21)          File: /bin/login
(14:05:21)          Current inode: 85018305    Stored inode: 54215634
(14:05:21) /bin/ls                                           ( Warning )
(14:05:21) Warning: The file properties have changed:
(14:05:21)          File: /bin/ls
(14:05:21)          Current inode: 85018306    Stored inode: 54214696
(14:05:21) /bin/lsmod                                        ( Warning )
(14:05:21) Warning: The file properties have changed:
(14:05:21)          File: /bin/lsmod
(14:05:21)          Current inode: 85018307    Stored inode: 54214670
(14:05:21) /bin/mktemp                                       ( Warning )
(14:05:21) Warning: The file properties have changed:
(14:05:21)          File: /bin/mktemp
(14:05:21)          Current inode: 85018310    Stored inode: 54214727
(14:05:22) /bin/more                                         ( Warning )
(14:05:22) Warning: The file properties have changed:
(14:05:22)          File: /bin/more
(14:05:22)          Current inode: 85018311    Stored inode: 54214697
(14:05:22) /bin/mount                                        ( Warning )
(14:05:22) Warning: The file properties have changed:
(14:05:22)          File: /bin/mount
(14:05:22)          Current inode: 85018312    Stored inode: 54214723
(14:05:22) /bin/mv                                           ( Warning )
(14:05:22) Warning: The file properties have changed:
(14:05:22)          File: /bin/mv
(14:05:22)          Current inode: 85018315    Stored inode: 54214691
(14:05:22) /bin/netstat                                      ( Warning )
(14:05:22) Warning: The file properties have changed:
(14:05:22)          File: /bin/netstat
(14:05:22)          Current inode: 85018318    Stored inode: 54214669
(14:05:22) /bin/ps                                           ( Warning )
(14:05:22) Warning: The file properties have changed:
(14:05:22)          File: /bin/ps
(14:05:23)          Current inode: 85018321    Stored inode: 54214719
(14:05:23) /bin/pwd                                          ( Warning )
(14:05:23) Warning: The file properties have changed:
(14:05:23)          File: /bin/pwd
(14:05:23)          Current inode: 85018322    Stored inode: 54214661
(14:05:23) /bin/readlink                                     ( Warning )
(14:05:23) Warning: The file properties have changed:
(14:05:23)          File: /bin/readlink
(14:05:23)          Current inode: 85018323    Stored inode: 54214676
(14:05:23) /bin/sed                                          ( Warning )
(14:05:23) Warning: The file properties have changed:
(14:05:23)          File: /bin/sed
(14:05:23)          Current inode: 85018327    Stored inode: 54214700
(14:05:23) /bin/sh                                           ( Warning )
(14:05:23) Warning: The file properties have changed:
(14:05:23)          File: /bin/sh
(14:05:23)          Current inode: 85016588    Stored inode: 54214678
(14:05:24) /bin/su                                           ( Warning )
(14:05:24) Warning: The file properties have changed:
(14:05:24)          File: /bin/su
(14:05:24)          Current inode: 85018330    Stored inode: 54215172
(14:05:24) /bin/touch                                        ( Warning )
(14:05:24) Warning: The file properties have changed:
(14:05:24)          File: /bin/touch
(14:05:24)          Current inode: 85018334    Stored inode: 54214726
(14:05:24) /bin/uname                                        ( Warning )
(14:05:24) Warning: The file properties have changed:
(14:05:24)          File: /bin/uname
(14:05:24)          Current inode: 85018337    Stored inode: 54214699
(14:05:24) /bin/which                                        ( Warning )
(14:05:24) Warning: The file properties have changed:
(14:05:24)          File: /bin/which
(14:05:24)          Current inode: 85018339    Stored inode: 54214690
(14:05:24) Warning: The command '/bin/which' has been replaced by a script: /bin/which: Bourne shell script text executable
(14:05:25) /usr/bin/awk                                      ( Warning )
(14:05:25) Warning: The file properties have changed:
(14:05:25)          File: /usr/bin/awk
(14:05:25)          Current inode: 86033381    Stored inode: 54247802
(14:05:25) /usr/bin/basename                                 ( Warning )
(14:05:25) Warning: The file properties have changed:
(14:05:25)          File: /usr/bin/basename
(14:05:25)          Current inode: 86036890    Stored inode: 54247714
(14:05:25) /usr/bin/chattr                                   ( Warning )
(14:05:25) Warning: The file properties have changed:
(14:05:25)          File: /usr/bin/chattr
(14:05:25)          Current inode: 86036904    Stored inode: 54247703
(14:05:25) /usr/bin/cut                                      ( Warning )
(14:05:25) Warning: The file properties have changed:
(14:05:25)          File: /usr/bin/cut
(14:05:25)          Current inode: 86036930    Stored inode: 54247669
(14:05:26) /usr/bin/diff                                     ( Warning )
(14:05:26) Warning: The file properties have changed:
(14:05:26)          File: /usr/bin/diff
(14:05:26)          Current inode: 86036958    Stored inode: 54247922
(14:05:26) /usr/bin/dirname                                  ( Warning )
(14:05:26) Warning: The file properties have changed:
(14:05:26)          File: /usr/bin/dirname
(14:05:26)          Current inode: 86036962    Stored inode: 54247768
(14:05:26) /usr/bin/dpkg                                     ( Warning )
(14:05:26) Warning: The file properties have changed:
(14:05:26)          File: /usr/bin/dpkg
(14:05:26)          Current inode: 86036964    Stored inode: 54248313
(14:05:26) /usr/bin/dpkg-query                               ( Warning )
(14:05:26) Warning: The file properties have changed:
(14:05:26)          File: /usr/bin/dpkg-query
(14:05:26)          Current inode: 86036966    Stored inode: 54248315
(14:05:26) /usr/bin/du                                       ( Warning )
(14:05:26) Warning: The file properties have changed:
(14:05:26)          File: /usr/bin/du
(14:05:26)          Current inode: 86036970    Stored inode: 54247793
(14:05:27) /usr/bin/env                                      ( Warning )
(14:05:27) Warning: The file properties have changed:
(14:05:27)          File: /usr/bin/env
(14:05:27)          Current inode: 86036972    Stored inode: 54247849
(14:05:27) /usr/bin/file                                     ( Warning )
(14:05:27) Warning: The file properties have changed:
(14:05:27)          File: /usr/bin/file
(14:05:27)          Current inode: 86036981    Stored inode: 54248083
(14:05:27) /usr/bin/find                                     ( Warning )
(14:05:27) Warning: The file properties have changed:
(14:05:27)          File: /usr/bin/find
(14:05:27)          Current inode: 86036982    Stored inode: 54247872
(14:05:27) /usr/bin/GET                                      ( Warning )
(14:05:27) Warning: The file '/usr/bin/GET' exists on the system, but it is not present in the rkhunter.dat file.
(14:05:27) /usr/bin/groups                                   ( Warning )
(14:05:27) Warning: The file properties have changed:
(14:05:27)          File: /usr/bin/groups
(14:05:27)          Current inode: 86037016    Stored inode: 54247814
(14:05:27) Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable
(14:05:28) /usr/bin/head                                     ( Warning )
(14:05:28) Warning: The file properties have changed:
(14:05:28)          File: /usr/bin/head
(14:05:28)          Current inode: 86037019    Stored inode: 54247782
(14:05:28) /usr/bin/id                                       ( Warning )
(14:05:28) Warning: The file properties have changed:
(14:05:28)          File: /usr/bin/id
(14:05:28)          Current inode: 86037028    Stored inode: 54247710
(14:05:28) /usr/bin/killall                                  ( Warning )
(14:05:28) Warning: The file properties have changed:
(14:05:28)          File: /usr/bin/killall
(14:05:28)          Current inode: 86037042    Stored inode: 54248781
(14:05:28) /usr/bin/last                                     ( Warning )
(14:05:28) Warning: The file properties have changed:
(14:05:28)          File: /usr/bin/last
(14:05:28)          Current inode: 86037043    Stored inode: 54247612
(14:05:28) /usr/bin/lastlog                                  ( Warning )
(14:05:29) Warning: The file properties have changed:
(14:05:29)          File: /usr/bin/lastlog
(14:05:29)          Current inode: 86037044    Stored inode: 54247488
(14:05:29) /usr/bin/ldd                                      ( Warning )
(14:05:29) Warning: The file properties have changed:
(14:05:29)          File: /usr/bin/ldd
(14:05:29)          Current inode: 57835567    Stored inode: 54248508
(14:05:29)          Current file modification time: 1264097118
(14:05:29)          Stored file modification time : 1232193522
(14:05:29) Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne-Again shell script text executable
(14:05:29) /usr/bin/locate                                   ( Warning )
(14:05:29) Warning: The file properties have changed:
(14:05:29)          File: /usr/bin/locate
(14:05:29)          Current inode: 86037057    Stored inode: 54247731
(14:05:29) /usr/bin/logger                                   ( Warning )
(14:05:29) Warning: The file properties have changed:
(14:05:29)          File: /usr/bin/logger
(14:05:29)          Current inode: 86037059    Stored inode: 54247865
(14:05:29) /usr/bin/lsattr                                   ( Warning )
(14:05:29) Warning: The file properties have changed:
(14:05:30)          File: /usr/bin/lsattr
(14:05:30)          Current inode: 86037063    Stored inode: 54247753
(14:05:30) /usr/bin/lynx                                     ( Warning )
(14:05:30) Warning: The file properties have changed:
(14:05:30)          File: /usr/bin/lynx
(14:05:30)          Current inode: 86033419    Stored inode: 54248732
(14:05:30) /usr/bin/md5sum                                   ( Warning )
(14:05:30) Warning: The file properties have changed:
(14:05:30)          File: /usr/bin/md5sum
(14:05:30)          Current inode: 86037075    Stored inode: 54247797
(14:05:30) /usr/bin/newgrp                                   ( Warning )
(14:05:30) Warning: The file properties have changed:
(14:05:30)          File: /usr/bin/newgrp
(14:05:30)          Current inode: 86037150    Stored inode: 54247465
(14:05:30) /usr/bin/passwd                                   ( Warning )
(14:05:30) Warning: The file properties have changed:
(14:05:30)          File: /usr/bin/passwd
(14:05:30)          Current inode: 86037169    Stored inode: 54247590
(14:05:31) /usr/bin/perl                                     ( Warning )
(14:05:31) Warning: The file properties have changed:
(14:05:31)          File: /usr/bin/perl
(14:05:31)          Current inode: 86037177    Stored inode: 54248353
(14:05:31) /usr/bin/pstree                                   ( Warning )
(14:05:31) Warning: The file properties have changed:
(14:05:31)          File: /usr/bin/pstree
(14:05:31)          Current inode: 86037206    Stored inode: 54248782
(14:05:31) /usr/bin/runcon                                   ( Warning )
(14:05:31) Warning: The file properties have changed:
(14:05:31)          File: /usr/bin/runcon
(14:05:31)          Current inode: 86037226    Stored inode: 54247798
(14:05:31) /usr/bin/sha1sum                                  ( Warning )
(14:05:31) Warning: The file properties have changed:
(14:05:31)          File: /usr/bin/sha1sum
(14:05:31)          Current inode: 86037242    Stored inode: 54247916
(14:05:32) /usr/bin/size                                     ( Warning )
(14:05:32) Warning: The file properties have changed:
(14:05:32)          File: /usr/bin/size
(14:05:32)          Current inode: 86037250    Stored inode: 54248586
(14:05:32) /usr/bin/sort                                     ( Warning )
(14:05:32) Warning: The file properties have changed:
(14:05:32)          File: /usr/bin/sort
(14:05:32)          Current inode: 86037254    Stored inode: 54247826
(14:05:32) /usr/bin/stat                                     ( Warning )
(14:05:32) Warning: The file properties have changed:
(14:05:32)          File: /usr/bin/stat
(14:05:32)          Current inode: 86037266    Stored inode: 54247795
(14:05:32) /usr/bin/strace                                   ( Warning )
(14:05:32) Warning: The file '/usr/bin/strace' exists on the system, but it is not present in the rkhunter.dat file.
(14:05:32) /usr/bin/strings                                  ( Warning )
(14:05:32) Warning: The file properties have changed:
(14:05:32)          File: /usr/bin/strings
(14:05:32)          Current inode: 86037267    Stored inode: 54248589
(14:05:33) /usr/bin/tail                                     ( Warning )
(14:05:33) Warning: The file properties have changed:
(14:05:33)          File: /usr/bin/tail
(14:05:33)          Current inode: 86037272    Stored inode: 54247841
(14:05:33) /usr/bin/test                                     ( Warning )
(14:05:33) Warning: The file properties have changed:
(14:05:33)          File: /usr/bin/test
(14:05:33)          Current inode: 86037276    Stored inode: 54247698
(14:05:33) /usr/bin/top                                      ( Warning )
(14:05:33) Warning: The file properties have changed:
(14:05:33)          File: /usr/bin/top
(14:05:33)          Current inode: 86037281    Stored inode: 54247840
(14:05:33) /usr/bin/touch                                    ( Warning )
(14:05:33) Warning: The file properties have changed:
(14:05:33)          File: /usr/bin/touch
(14:05:33)          Current inode: 86033462    Stored inode: 54247885
(14:05:33) /usr/bin/tr                                       ( Warning )
(14:05:33) Warning: The file properties have changed:
(14:05:33)          File: /usr/bin/tr
(14:05:33)          Current inode: 86037283    Stored inode: 54247876
(14:05:34) /usr/bin/uniq                                     ( Warning )
(14:05:34) Warning: The file properties have changed:
(14:05:34)          File: /usr/bin/uniq
(14:05:34)          Current inode: 86037295    Stored inode: 54247766
(14:05:34) /usr/bin/users                                    ( Warning )
(14:05:34) Warning: The file properties have changed:
(14:05:34)          File: /usr/bin/users
(14:05:34)          Current inode: 86037300    Stored inode: 54247827
(14:05:34) /usr/bin/vmstat                                   ( Warning )
(14:05:34) Warning: The file properties have changed:
(14:05:34)          File: /usr/bin/vmstat
(14:05:34)          Current inode: 86037303    Stored inode: 54247878
(14:05:34) /usr/bin/w                                        ( Warning )
(14:05:34) Warning: The file properties have changed:
(14:05:34)          File: /usr/bin/w
(14:05:34)          Current inode: 86033469    Stored inode: 54247756
(14:05:34) /usr/bin/watch                                    ( Warning )
(14:05:34) Warning: The file properties have changed:
(14:05:35)          File: /usr/bin/watch
(14:05:35)          Current inode: 86037306    Stored inode: 54247794
(14:05:35) /usr/bin/wc                                       ( Warning )
(14:05:35) Warning: The file properties have changed:
(14:05:35)          File: /usr/bin/wc
(14:05:35)          Current inode: 86037307    Stored inode: 54247880
(14:05:35) /usr/bin/wget                                     ( Warning )
(14:05:35) Warning: The file properties have changed:
(14:05:35)          File: /usr/bin/wget
(14:05:35)          Current hash: 8f12c9c7acef809ee696878a754f31c8034bc58b
(14:05:35)          Stored hash : 1cf6b29d4276337be8d03083373f399a280df7ae
(14:05:35)          Current inode: 86048159    Stored inode: 54247727
(14:05:35)          Current file modification time: 1255002588
(14:05:35)          Stored file modification time : 1151512894
(14:05:35) /usr/bin/whatis                                   ( Warning )
(14:05:35) Warning: The file properties have changed:
(14:05:35)          File: /usr/bin/whatis
(14:05:35)          Current inode: 86037310    Stored inode: 54247747
(14:05:35) /usr/bin/whereis                                  ( Warning )
(14:05:35) Warning: The file properties have changed:
(14:05:35)          File: /usr/bin/whereis
(14:05:35)          Current inode: 86037311    Stored inode: 54247696
(14:05:36) /usr/bin/which                                    ( Warning )
(14:05:36) Warning: The file properties have changed:
(14:05:36)          File: /usr/bin/which
(14:05:36)          Current inode: 86033471    Stored inode: 54247755
(14:05:36) /usr/bin/who                                      ( Warning )
(14:05:36) Warning: The file properties have changed:
(14:05:36)          File: /usr/bin/who
(14:05:36)          Current inode: 86037313    Stored inode: 54247728
(14:05:36) /usr/bin/whoami                                   ( Warning )
(14:05:36) Warning: The file properties have changed:
(14:05:36)          File: /usr/bin/whoami
(14:05:36)          Current inode: 86037314    Stored inode: 54247775
(14:05:36) /usr/bin/mawk                                     ( Warning )
(14:05:36) Warning: The file properties have changed:
(14:05:36)          File: /usr/bin/mawk
(14:05:36)          Current inode: 86037073    Stored inode: 54247905
(14:05:36) /usr/bin/lwp-request                              ( Warning )
(14:05:36) Warning: The file '/usr/bin/lwp-request' exists on the system, but it is not present in the rkhunter.dat file.
(14:05:36) Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: perl script text executable
(14:05:37) /usr/bin/lynx.stable                              ( Warning )
(14:05:37) Warning: The file properties have changed:
(14:05:37)          File: /usr/bin/lynx.stable
(14:05:37)          Current inode: 86037065    Stored inode: 54248690
(14:05:37) /usr/bin/w.procps                                 ( Warning )
(14:05:37) Warning: The file properties have changed:
(14:05:37)          File: /usr/bin/w.procps
(14:05:37)          Current inode: 86037304    Stored inode: 54247702
(14:05:37) /sbin/depmod                                      ( Warning )
(14:05:37) Warning: The file properties have changed:
(14:05:37)          File: /sbin/depmod
(14:05:37)          Current inode: 86036559    Stored inode: 54215606
(14:05:37) /sbin/ifconfig                                    ( Warning )
(14:05:37) Warning: The file properties have changed:
(14:05:37)          File: /sbin/ifconfig
(14:05:38)          Current inode: 86036571    Stored inode: 54215618
(14:05:38) /sbin/ifdown                                      ( Warning )
(14:05:38) Warning: The file properties have changed:
(14:05:38)          File: /sbin/ifdown
(14:05:38)          Current inode: 86036572    Stored inode: 54215611
(14:05:38) /sbin/ifup                                        ( Warning )
(14:05:38) Warning: The file properties have changed:
(14:05:38)          File: /sbin/ifup
(14:05:38)          Current inode: 86036572    Stored inode: 54215611
(14:05:38) /sbin/init                                        ( Warning )
(14:05:38) Warning: The file properties have changed:
(14:05:38)          File: /sbin/init
(14:05:38)          Current inode: 86036573    Stored inode: 54215254
(14:05:38) /sbin/insmod                                      ( Warning )
(14:05:38) Warning: The file properties have changed:
(14:05:38)          File: /sbin/insmod
(14:05:38)          Current inode: 86036575    Stored inode: 54215574
(14:05:39) /sbin/lsmod                                       ( Warning )
(14:05:39) Warning: The file properties have changed:
(14:05:39)          File: /sbin/lsmod
(14:05:39)          Current inode: 86033356    Stored inode: 54215579
(14:05:39) /sbin/modinfo                                     ( Warning )
(14:05:39) Warning: The file properties have changed:
(14:05:39)          File: /sbin/modinfo
(14:05:39)          Current inode: 86036597    Stored inode: 54215600
(14:05:39) /sbin/modprobe                                    ( Warning )
(14:05:39) Warning: The file properties have changed:
(14:05:39)          File: /sbin/modprobe
(14:05:39)          Current inode: 86036598    Stored inode: 54215581
(14:05:39) /sbin/rmmod                                       ( Warning )
(14:05:39) Warning: The file properties have changed:
(14:05:39)          File: /sbin/rmmod
(14:05:39)          Current inode: 86036607    Stored inode: 54215619
(14:05:40) /sbin/runlevel                                    ( Warning )
(14:05:40) Warning: The file properties have changed:
(14:05:40)          File: /sbin/runlevel
(14:05:40)          Current inode: 86036609    Stored inode: 54215259
(14:05:40) /sbin/sulogin                                     ( Warning )
(14:05:40) Warning: The file properties have changed:
(14:05:40)          File: /sbin/sulogin
(14:05:40)          Current inode: 86036616    Stored inode: 54215308
(14:05:40) /sbin/sysctl                                      ( Warning )
(14:05:40) Warning: The file properties have changed:
(14:05:40)          File: /sbin/sysctl
(14:05:40)          Current inode: 86036618    Stored inode: 54215573
(14:05:40) /sbin/syslogd                                     ( Warning )
(14:05:40) Warning: The file properties have changed:
(14:05:40)          File: /sbin/syslogd
(14:05:40)          Current inode: 86036619    Stored inode: 54215597
(14:05:41) /usr/sbin/adduser                                 ( Warning )
(14:05:41) Warning: The file properties have changed:
(14:05:41)          File: /usr/sbin/adduser
(14:05:41)          Current inode: 86043333    Stored inode: 54218263
(14:05:41) Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: perl script text executable
(14:05:41) /usr/sbin/chroot                                  ( Warning )
(14:05:41) Warning: The file properties have changed:
(14:05:41)          File: /usr/sbin/chroot
(14:05:41)          Current inode: 86043346    Stored inode: 54218255
(14:05:41) /usr/sbin/cron                                    ( Warning )
(14:05:41) Warning: The file properties have changed:
(14:05:41)          File: /usr/sbin/cron
(14:05:41)          Current inode: 86043352    Stored inode: 54218287
(14:05:42) /usr/sbin/groupadd                                ( Warning )
(14:05:42) Warning: The file properties have changed:
(14:05:42)          File: /usr/sbin/groupadd
(14:05:42)          Current inode: 86043370    Stored inode: 54215889
(14:05:42) /usr/sbin/groupdel                                ( Warning )
(14:05:42) Warning: The file properties have changed:
(14:05:42)          File: /usr/sbin/groupdel
(14:05:42)          Current inode: 86043371    Stored inode: 54215980
(14:05:42) /usr/sbin/groupmod                                ( Warning )
(14:05:42) Warning: The file properties have changed:
(14:05:42)          File: /usr/sbin/groupmod
(14:05:42)          Current inode: 86043372    Stored inode: 54215977
(14:05:42) /usr/sbin/grpck                                   ( Warning )
(14:05:42) Warning: The file properties have changed:
(14:05:42)          File: /usr/sbin/grpck
(14:05:42)          Current inode: 86043373    Stored inode: 54215968
(14:05:42) /usr/sbin/inetd                                   ( Warning )
(14:05:42) Warning: The file properties have changed:
(14:05:42)          File: /usr/sbin/inetd
(14:05:42)          Current inode: 86043380    Stored inode: 54218291
(14:05:43) /usr/sbin/nologin                                 ( Warning )
(14:05:43) Warning: The file properties have changed:
(14:05:43)          File: /usr/sbin/nologin
(14:05:43)          Current inode: 86043399    Stored inode: 54218046
(14:05:43) /usr/sbin/pwck                                    ( Warning )
(14:05:43) Warning: The file properties have changed:
(14:05:43)          File: /usr/sbin/pwck
(14:05:43)          Current inode: 86043422    Stored inode: 54215970
(14:05:43) /usr/sbin/tcpd                                    ( Warning )
(14:05:43) Warning: The file properties have changed:
(14:05:43)          File: /usr/sbin/tcpd
(14:05:44)          Current inode: 86043457    Stored inode: 54218309
(14:05:44) /usr/sbin/useradd                                 ( Warning )
(14:05:44) Warning: The file properties have changed:
(14:05:44)          File: /usr/sbin/useradd
(14:05:44)          Current inode: 86043472    Stored inode: 54215971
(14:05:44) /usr/sbin/userdel                                 ( Warning )
(14:05:44) Warning: The file properties have changed:
(14:05:44)          File: /usr/sbin/userdel
(14:05:44)          Current inode: 86043476    Stored inode: 54215887
(14:05:44) /usr/sbin/usermod                                 ( Warning )
(14:05:44) Warning: The file properties have changed:
(14:05:44)          File: /usr/sbin/usermod
(14:05:44)          Current inode: 86043477    Stored inode: 54215979
(14:05:44) /usr/sbin/vipw                                    ( Warning )
(14:05:44) Warning: The file properties have changed:
(14:05:44)          File: /usr/sbin/vipw
(14:05:44)          Current inode: 86043480    Stored inode: 54215975
(14:05:45) /usr/local/bin/rkhunter                           ( Warning )
(14:05:45) Warning: The file properties have changed:
(14:05:45)          File: /usr/local/bin/rkhunter
(14:05:45)          Current inode: 86043310    Stored inode: 54216814
(14:12:11)

Have I a rootkit?
Reply With Quote
Sponsored Links