Rootkit Detection

From Wiki

Revision as of 16:29, 27 February 2007 by Admin (Talk | contribs)
(diff) ← Older revision | Current revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Chkrootkit - Check for signs of a rootkit 

apt-get install rootkit
//configure yes for run daily

//options are in /etc/chkrootkit.conf
RUN_DAILY="true"
RUN_DAILY_OPTS="-q"
DIFF_MODE="false"  //note - this line may/maynot be in Debian Sarge.

//check in /etc/cron.daily/chkrootkit for the cron daily entry.

Links:

http://softice.lakeland.usf.edu/wiki/index.php/ELSA:lab-08

http://www.chkrootkit.org/README

http://www.chkrootkit.org/#tests


Further rootkit reasoning and detection is discussed here:

http://linuxhelp.blogspot.com/2006/12/various-ways-of-detecting-rootkits-in.html

Retrieved from "http://wiki.kartbuilding.net/index.php/Rootkit_Detection"
Personal tools