Checking for infected files.

[4402734]

Hello.
I installed chrootkit and checked my system for infected files .then saw the following lines between checking log.

Checking `ldsopreload'... can't exec ./strings-static, not tested

Checking `tcpdump'... warning, got duplicate tcp line.
not infected


Checking `bindshell'... warning, got duplicate tcp line.
warning, got duplicate tcp line.
INFECTED (PORTS: 465)


Checking `sniffer'... not tested: can't exec ./ifpromisc

Checking `wted'... not tested: can't exec ./chkwtmp

Checking `scalper'... warning, got duplicate tcp line.
not infected

Checking `z2'... not tested: can't exec ./chklastlog

Checking `chkutmp'... not tested: can't exec ./chkutmp


.
Has my Server infected with worms or viruses?
Please, some explain about this lines.

thanks

[chirpy]

That doesn't look as though you have compiled chkrootkit correctly.

As an alternative try rkhunter instead.

[chris74108]

Originally Posted by 4402734

Hello.
I installed chrootkit and checked my system for infected files .then saw the following lines between checking log.

Checking `ldsopreload'... can't exec ./strings-static, not tested

Checking `tcpdump'... warning, got duplicate tcp line.
not infected


Checking `bindshell'... warning, got duplicate tcp line.
warning, got duplicate tcp line.
INFECTED (PORTS: 465)


Checking `sniffer'... not tested: can't exec ./ifpromisc

Checking `wted'... not tested: can't exec ./chkwtmp

Checking `scalper'... warning, got duplicate tcp line.
not infected

Checking `z2'... not tested: can't exec ./chklastlog

Checking `chkutmp'... not tested: can't exec ./chkutmp


.
Has my Server infected with worms or viruses?
Please, some explain about this lines.

thanks

I simple search with google or using the search feature here shows that
INFECTED (PORTS: 465)
is normal.

rkhunter is better so give it a try.

[4402734]

Where can I find the rkhunter and how to install it?

thanks

[chirpy]

You only need a little initiative - search these forums or use your favourtite web browser.

[gupi]

well, if you still have'n found it, here's the homepage: http://www.rootkit.nl/
(nice name for a domain, isn't it ?)