2001-04-06 20:48:49 -04:00
|
|
|
Chkrootkit is a tool to locally check for signs of a rootkit. It
|
|
|
|
|
contains:
|
|
|
|
|
|
|
|
|
|
* chkrootkit: a shell script that checks system binaries for
|
|
|
|
|
rootkit modification.
|
|
|
|
|
* ifpromisc.c: checks if the network interface is in promiscuous
|
|
|
|
|
mode.
|
|
|
|
|
* chklastlog.c: checks for lastlog deletions.
|
|
|
|
|
* chkwtmp.c: checks for wtmp deletions.
|
2001-05-11 10:34:07 -04:00
|
|
|
|
|
|
|
|
The following rootkits, worms and LKMs are currently detected:
|
|
|
|
|
Solaris rootkit, FreeBSD rootkit, lrk3, lrk4, lrk5, lrk6, t0rn (and
|
|
|
|
|
t0rn v8), some lrk variants, Ambient's Rootkit for Linux (ARK), Ramen
|
|
|
|
|
Worm, rh[67]-shaper, RSHA, Romanian rootkit, RK17, Lion Worm, Adore
|
|
|
|
|
Worm, LPD Worm, kenny-rk and Adore LKM.
|
2001-04-06 20:48:49 -04:00
|
|
|
|
|
|
|
|
Nelson Murilo <nelson@pangeia.com.br>
|
|
|
|
|
|
2001-04-27 08:01:58 -04:00
|
|
|
WWW: http://www.chkrootkit.org/
|
