Detecting Rootkits on a Linux machine



Rootkits are a piece (or pieces) of software that someone can be used once a system is compromised to a) regain access to a system and b) remove traces of a compromise and c) many times hide itself. There are some tools for linux based systems that can be run to detect traces of rootkits and probably the best known is a tool called chkrootkit. I’ve know of it for what seems like years now and it can run a relatively quick test for traces of a wide range of KNOWN linux rootkits.


There is a good tutorial on how to install and use it here what’s probably the best to point out is that you should not install and then just run it occasionally, it should be put either on read-only media, or removable media so that an attacker could not discover it’s presence and alter it to ignore the attackers rootkit. (Or you could keep a local copy just to give them something else to do and do your REAL scanning from a read-only/removable… )

I did find a referral to another rootkit detectorrkhunter which I haven’t yet tested, but looks promising… a more direct link is here.

Happy rootkit hunting?

Related Posts

Blog Traffic Exchange Related Posts
  • How to Remove DefendAPC | DefendAPC Removal Guide DefendAPC is the latest variation on the Wini family of rogue antivirus. It is typically promoted via the use of trojans, malware and aggressive advertising. Once installed on the system it will run supposed scans of the system claiming that you have viruses on your system and that you have......
  • How to Remove AntiMalware | Antimalware Removal Guide Antimalware is the name of a particularly interesting rogue antivirus and rogue antimalware application. One tip off that it is a rogue application is that one of it's first actions is the attempted removal of the following trusted and legitimate antivirus, security and antimalware applications: AVG, Nod32, Agnitum, Sophos, Avira,......
  • Microsoft's quick response to network worms.... This is an ironic title because frankly, Microsoft has seemed to be slow in solutions for the recent zotob worm. Of course, they announced the vulnerability and accompanying update to solve the issue to begin with, but after the virus started propagating what do we see from Microsoft? They have......
Blog Traffic Exchange Related Websites
  • Goldfish And Marine Aquariums I’ve been involved with aquariums for 40 years or more and no, I’m not going to try advising the secret of keeping goldfish in salt water! What I’m going to do is remember, if I may. Over 40 years ago I had nothing to do with fish. What did......
  • Restaurant Solutions: Making Your Online Presence Known In today’s market every business needs to have an online presence. The Internet is the great leveler of players in a world market where anything can be bought or sold at competitive prices. The Internet has been an incredible tool for small businesses, especially because it allows smaller retailers and......
  • FAQ about computer security Q: The virus blocked the registry access and how to get rid of it?A: You can deal with like this: 1. Click on Start -> Run (or Start Search in Windows Vista). 2. Enter GPEdit.msc and then press Enter. 3. Navigate to the following location: User Configuration -> Administrative Templates......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site