Description :
chkrootkit is a tool to locally check for signs of a rootkit.
It contains a chkrootkit shell script that checks system
binaries for rootkit modification. The following tests are
made: aliens, asp, bindshell, lkm, rexedcs, sniffer, wted, z2,
amd, basename, biff, chfn, chsh, cron, date, du, dirname, echo,
egrep, env, find, fingerd, gpm, grep, hdparm, su, ifconfig,
inetd, inetdconf, identd, killall, login, ls, mail, mingetty,
netstat, named, passwd, pidof, pop2, pop3, ps, pstree, rpcinfo,
rlogind, rshd, slogin, sendmail, sshd, syslogd, tar, tcpd, top,
telnetd, timed, traceroute, write and more. ifpromisc.c checks
whether the interface is in promiscuous mode, chklastlog.c
checks for lastlog deletions, chkwtmp.c checks for wtmp
deletions, check_wtmpx.c checks for wtmpx deletions (Solaris
only), and chkproc.c checks for signs of LKM trojans.
|
