One of the blogs I read just had an article about finding rootkits in Linux.  While not worried about it, I thought it would be fun to check it out.  They talked about 3 commands; lsattr, chkrootkit, and rkhunter.<br><br>lsattr didn&#39;t find anything of interest the few directories I tried it on except that this line showed up for some files (I think they were all links):<br>
<blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">  lsattr: Operation not supported While reading flags on /bin/bzegrep<br></blockquote><br clear="all">
chkrootkit found<br><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">ROOTDIR is `/&#39;<br>Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:  <br>
/usr/lib/xulrunner-1.9.2.18/.autoreg <br>/usr/lib/firefox-3.6.18/.autoreg <br>/usr/lib/pymodules/python2.6/.path <br>/usr/lib/pymodules/python2.6/PyQt4/uic/widget-plugins/.noinit <br>/usr/lib/jvm/.java-6-openjdk.jinfo <br>
/usr/lib/thunderbird-3.1.11/.autoreg<br></blockquote><br>those are mainly empty files and the ones that were not seemed reasonable to an uneducated eye.  Problem is that they don&#39;t say what it is that is considered suspicious<br>
<br>rkhunter -c found<br><blockquote style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;" class="gmail_quote">[08:27:47]   Checking /dev for suspicious file types         [ Warning ]<br>
[08:27:47] Warning: Suspicious file types found in /dev:<br>[08:27:47]          /dev/shm/pulse-shm-3633543672: data<br>[08:27:47]          /dev/shm/pulse-shm-2330444361: data<br>[08:27:47]          /dev/shm/pulse-shm-2759599877: data<br>
[08:27:48]          /dev/shm/pulse-shm-2688255106: data<br>[08:27:48]          /dev/shm/pulse-shm-2964324177: data<br>[08:27:48]          /dev/shm/pulse-shm-878858236: data<br>[08:27:48]   Checking for hidden files and directories       [ Warning ]<br>
[08:27:48] Warning: Hidden directory found: /etc/.java<br>[08:27:48] Warning: Hidden directory found: /dev/.udev<br>[08:27:48] Warning: Hidden directory found: /dev/.initramfs<br></blockquote><br>Similar comment.  It is difficult to know what to check for.  Again I am not worried, just curious.<br>
-- <br>Dazed_75 a.k.a. Larry<br><br>The spirit of resistance to government is so valuable on certain occasions, that I wish it always to be kept alive.<br>  - Thomas Jefferson<br>