What to do if rkhunter finds a possible rootkit?

Question

ran rkhunter tonight, and I got this for the results:

[04:17:34] System checks summary
[04:17:34] =====================
[04:17:34]
[04:17:34] File properties checks...
[04:17:34] Files checked: 133
[04:17:34] Suspect files: 16
[04:17:34]
[04:17:34] Rootkit checks...
[04:17:34] Rootkits checked : 245
[04:17:34] Possible rootkits: 1
[04:17:34] Rootkit names    : Slapper Worm
[04:17:34]
[04:17:34] Applications checks...
[04:17:34] All checks skipped
[04:17:34]
[04:17:34] The system checks took: 2 minutes and 27 seconds
[04:17:34]
[04:17:34] Info: End date is Sat Jul 12 04:17:34 UTC 2014

Says possible rootkit "Slapper Worm", and it points to this file:

[04:16:42] Checking for Slapper Worm...
[04:16:42]   Checking for file '/tmp/.bugtraq'               [ Not found ]
[04:16:42]   Checking for file '/tmp/.uubugtraq'             [ Not found ]
[04:16:42]   Checking for file '/tmp/.bugtraq.c'             [ Not found ]
[04:16:42]   Checking for file '/tmp/httpd'                  [ Not found ]
[04:16:42]   Checking for file '/tmp/.unlock'                [ Not found ]
[04:16:42]   Checking for file '/tmp/update'                 [ Found ]
[04:16:42]   Checking for file '/tmp/.cinik'                 [ Not found ]
[04:16:43]   Checking for file '/tmp/.b'                     [ Not found ]
[04:16:43] Warning: Slapper Worm                             [ Warning ]
[04:16:43]          File '/tmp/update' found

I removed this file, but it didn't appear to be anything to serious? Should I be worried that I may have a rootkit? Will removing this file fix the issue?

score 4 · Accepted Answer · answered Jul 12 '14 at 08:06

In this case, I wouldn't be too worried as it only detected a filename to be present that is not unlikely to be created by something completely unrelated due the common nature of the word update. The more important files like /tmp/.bugtraq are missing. Also, Slapper is 12 years old and used a vulnerability that has long been closed.

If you run rkhunter because you suspected an infection, you could investigate further, but if it was a routine operation, close the matter.

What to do if rkhunter finds a possible rootkit?

1 Answers1