chkrootkit shows “tcpd” as INFECTED. Is it a false positive?












25















Scan by chkrootkit shows "tcpd" as being INFECTED.
Although a scan by rkhunter shows ok,(except for regular false positives)



Shall I be worried?
(I'm on Ubuntu 16.10 with 4.8.0-37-generic)










share|improve this question


















  • 2





    ubuntuforums.org/showthread.php?t=2346505

    – muru
    Feb 15 '17 at 6:05











  • muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

    – mariner
    Feb 15 '17 at 6:16













  • That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

    – muru
    Feb 15 '17 at 6:16











  • Does direct scan sudo chkrootkit tcpd returns infected?

    – naXa
    Jul 17 '17 at 2:10






  • 1





    Mine came up as INFECTED also and it isn't installed.

    – Jason
    Sep 6 '18 at 22:46
















25















Scan by chkrootkit shows "tcpd" as being INFECTED.
Although a scan by rkhunter shows ok,(except for regular false positives)



Shall I be worried?
(I'm on Ubuntu 16.10 with 4.8.0-37-generic)










share|improve this question


















  • 2





    ubuntuforums.org/showthread.php?t=2346505

    – muru
    Feb 15 '17 at 6:05











  • muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

    – mariner
    Feb 15 '17 at 6:16













  • That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

    – muru
    Feb 15 '17 at 6:16











  • Does direct scan sudo chkrootkit tcpd returns infected?

    – naXa
    Jul 17 '17 at 2:10






  • 1





    Mine came up as INFECTED also and it isn't installed.

    – Jason
    Sep 6 '18 at 22:46














25












25








25


4






Scan by chkrootkit shows "tcpd" as being INFECTED.
Although a scan by rkhunter shows ok,(except for regular false positives)



Shall I be worried?
(I'm on Ubuntu 16.10 with 4.8.0-37-generic)










share|improve this question














Scan by chkrootkit shows "tcpd" as being INFECTED.
Although a scan by rkhunter shows ok,(except for regular false positives)



Shall I be worried?
(I'm on Ubuntu 16.10 with 4.8.0-37-generic)







security malware rootkit tcpdump chkrootkit






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Feb 15 '17 at 5:59









marinermariner

128124




128124








  • 2





    ubuntuforums.org/showthread.php?t=2346505

    – muru
    Feb 15 '17 at 6:05











  • muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

    – mariner
    Feb 15 '17 at 6:16













  • That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

    – muru
    Feb 15 '17 at 6:16











  • Does direct scan sudo chkrootkit tcpd returns infected?

    – naXa
    Jul 17 '17 at 2:10






  • 1





    Mine came up as INFECTED also and it isn't installed.

    – Jason
    Sep 6 '18 at 22:46














  • 2





    ubuntuforums.org/showthread.php?t=2346505

    – muru
    Feb 15 '17 at 6:05











  • muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

    – mariner
    Feb 15 '17 at 6:16













  • That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

    – muru
    Feb 15 '17 at 6:16











  • Does direct scan sudo chkrootkit tcpd returns infected?

    – naXa
    Jul 17 '17 at 2:10






  • 1





    Mine came up as INFECTED also and it isn't installed.

    – Jason
    Sep 6 '18 at 22:46








2




2





ubuntuforums.org/showthread.php?t=2346505

– muru
Feb 15 '17 at 6:05





ubuntuforums.org/showthread.php?t=2346505

– muru
Feb 15 '17 at 6:05













muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

– mariner
Feb 15 '17 at 6:16







muru, thanks! It helped! p.s. How do i vote for reputation of a user? (you in this case)

– mariner
Feb 15 '17 at 6:16















That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

– muru
Feb 15 '17 at 6:16





That was just a comment. I'll post an answer in a moment, which you can accept, if you like.

– muru
Feb 15 '17 at 6:16













Does direct scan sudo chkrootkit tcpd returns infected?

– naXa
Jul 17 '17 at 2:10





Does direct scan sudo chkrootkit tcpd returns infected?

– naXa
Jul 17 '17 at 2:10




1




1





Mine came up as INFECTED also and it isn't installed.

– Jason
Sep 6 '18 at 22:46





Mine came up as INFECTED also and it isn't installed.

– Jason
Sep 6 '18 at 22:46










4 Answers
4






active

oldest

votes


















36














In this Ubuntu Forums post, user kpatz tested this in a fresh 16.10 VM and chkrootkit still complained, making this a false positive. You can always check if a file has been tampered by comparing the md5sum from the package:



$ dpkg -S /usr/sbin/tcpd
tcpd: /usr/sbin/tcpd
$ (cd /; md5sum -c /var/lib/dpkg/info/tcpd.md5sums)
usr/sbin/safe_finger: OK
usr/sbin/tcpd: OK
usr/sbin/tcpdchk: OK
usr/sbin/tcpdmatch: OK
usr/sbin/try-from: OK
usr/share/man/man8/safe_finger.8.gz: OK
usr/share/man/man8/tcpd.8.gz: OK
usr/share/man/man8/tcpdchk.8.gz: OK
usr/share/man/man8/tcpdmatch.8.gz: OK
usr/share/man/man8/try-from.8.gz: OK


Of course, the md5sums file itself maybe tampered, (and so could md5sum itself and so on...).






share|improve this answer



















  • 1





    Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

    – mariner
    Feb 15 '17 at 6:38











  • When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

    – user364819
    Feb 17 '17 at 16:18






  • 2





    In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

    – Philippe Delteil
    May 30 '18 at 14:34



















7














This is a false positive caused by a bug in the main chkrootkit script. I tried to post the fix here, but was downvoted. I reported the issue to the chkrootkit devs, but if you'd like to fix the issue so that it actually works, you might want to check out: https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-tcpd-521683/page2.html#post5788733






share|improve this answer































    0














    Mine was also listed as "INFECTED" (Ubuntu 18.10)... so I cross checked tcpd using the debsums utility ie:



    sudo debsums | grep tcpd


    It was listed as "OK".






    share|improve this answer































      0














      You can try uploading them to sites for testing like virustotal and I believe BitDefender has a one minute rootkit scanner program available (unsure of multi OS support).



      If you have a rootkit, there's no way to know if it's a false positive without solid documentation as was posted above, considering that a malicious program with root access can hide itself. You seem to be concerned, or are just following the syntax of CAPS LOCKS, but in the future I would recommend vaulting and backing up essential files (either through a cloud or an external that you must take care to not cross infect) such as databases, family photos, work, unsavory videos, etc.



      check the md5 sum for inconsistencies for the important junk. Which is mostly anything that can be given root access or the distro itself. And if you are running a fresh install or don't mind doing one, you could always wipe and check it once more.



      Quick edit:
      BitDefender does not actually offer support for anything other than Windows. Sidenote, all antivirus programs are datamining you and your internet usage. Open source ftw.



      tl;dr on the insidious nature of rootkits and how easily they propagate.






      share|improve this answer

























        Your Answer








        StackExchange.ready(function() {
        var channelOptions = {
        tags: "".split(" "),
        id: "89"
        };
        initTagRenderer("".split(" "), "".split(" "), channelOptions);

        StackExchange.using("externalEditor", function() {
        // Have to fire editor after snippets, if snippets enabled
        if (StackExchange.settings.snippets.snippetsEnabled) {
        StackExchange.using("snippets", function() {
        createEditor();
        });
        }
        else {
        createEditor();
        }
        });

        function createEditor() {
        StackExchange.prepareEditor({
        heartbeatType: 'answer',
        autoActivateHeartbeat: false,
        convertImagesToLinks: true,
        noModals: true,
        showLowRepImageUploadWarning: true,
        reputationToPostImages: 10,
        bindNavPrevention: true,
        postfix: "",
        imageUploader: {
        brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
        contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
        allowUrls: true
        },
        onDemand: true,
        discardSelector: ".discard-answer"
        ,immediatelyShowMarkdownHelp:true
        });


        }
        });














        draft saved

        draft discarded


















        StackExchange.ready(
        function () {
        StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f883495%2fchkrootkit-shows-tcpd-as-infected-is-it-a-false-positive%23new-answer', 'question_page');
        }
        );

        Post as a guest















        Required, but never shown

























        4 Answers
        4






        active

        oldest

        votes








        4 Answers
        4






        active

        oldest

        votes









        active

        oldest

        votes






        active

        oldest

        votes









        36














        In this Ubuntu Forums post, user kpatz tested this in a fresh 16.10 VM and chkrootkit still complained, making this a false positive. You can always check if a file has been tampered by comparing the md5sum from the package:



        $ dpkg -S /usr/sbin/tcpd
        tcpd: /usr/sbin/tcpd
        $ (cd /; md5sum -c /var/lib/dpkg/info/tcpd.md5sums)
        usr/sbin/safe_finger: OK
        usr/sbin/tcpd: OK
        usr/sbin/tcpdchk: OK
        usr/sbin/tcpdmatch: OK
        usr/sbin/try-from: OK
        usr/share/man/man8/safe_finger.8.gz: OK
        usr/share/man/man8/tcpd.8.gz: OK
        usr/share/man/man8/tcpdchk.8.gz: OK
        usr/share/man/man8/tcpdmatch.8.gz: OK
        usr/share/man/man8/try-from.8.gz: OK


        Of course, the md5sums file itself maybe tampered, (and so could md5sum itself and so on...).






        share|improve this answer



















        • 1





          Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

          – mariner
          Feb 15 '17 at 6:38











        • When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

          – user364819
          Feb 17 '17 at 16:18






        • 2





          In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

          – Philippe Delteil
          May 30 '18 at 14:34
















        36














        In this Ubuntu Forums post, user kpatz tested this in a fresh 16.10 VM and chkrootkit still complained, making this a false positive. You can always check if a file has been tampered by comparing the md5sum from the package:



        $ dpkg -S /usr/sbin/tcpd
        tcpd: /usr/sbin/tcpd
        $ (cd /; md5sum -c /var/lib/dpkg/info/tcpd.md5sums)
        usr/sbin/safe_finger: OK
        usr/sbin/tcpd: OK
        usr/sbin/tcpdchk: OK
        usr/sbin/tcpdmatch: OK
        usr/sbin/try-from: OK
        usr/share/man/man8/safe_finger.8.gz: OK
        usr/share/man/man8/tcpd.8.gz: OK
        usr/share/man/man8/tcpdchk.8.gz: OK
        usr/share/man/man8/tcpdmatch.8.gz: OK
        usr/share/man/man8/try-from.8.gz: OK


        Of course, the md5sums file itself maybe tampered, (and so could md5sum itself and so on...).






        share|improve this answer



















        • 1





          Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

          – mariner
          Feb 15 '17 at 6:38











        • When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

          – user364819
          Feb 17 '17 at 16:18






        • 2





          In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

          – Philippe Delteil
          May 30 '18 at 14:34














        36












        36








        36







        In this Ubuntu Forums post, user kpatz tested this in a fresh 16.10 VM and chkrootkit still complained, making this a false positive. You can always check if a file has been tampered by comparing the md5sum from the package:



        $ dpkg -S /usr/sbin/tcpd
        tcpd: /usr/sbin/tcpd
        $ (cd /; md5sum -c /var/lib/dpkg/info/tcpd.md5sums)
        usr/sbin/safe_finger: OK
        usr/sbin/tcpd: OK
        usr/sbin/tcpdchk: OK
        usr/sbin/tcpdmatch: OK
        usr/sbin/try-from: OK
        usr/share/man/man8/safe_finger.8.gz: OK
        usr/share/man/man8/tcpd.8.gz: OK
        usr/share/man/man8/tcpdchk.8.gz: OK
        usr/share/man/man8/tcpdmatch.8.gz: OK
        usr/share/man/man8/try-from.8.gz: OK


        Of course, the md5sums file itself maybe tampered, (and so could md5sum itself and so on...).






        share|improve this answer













        In this Ubuntu Forums post, user kpatz tested this in a fresh 16.10 VM and chkrootkit still complained, making this a false positive. You can always check if a file has been tampered by comparing the md5sum from the package:



        $ dpkg -S /usr/sbin/tcpd
        tcpd: /usr/sbin/tcpd
        $ (cd /; md5sum -c /var/lib/dpkg/info/tcpd.md5sums)
        usr/sbin/safe_finger: OK
        usr/sbin/tcpd: OK
        usr/sbin/tcpdchk: OK
        usr/sbin/tcpdmatch: OK
        usr/sbin/try-from: OK
        usr/share/man/man8/safe_finger.8.gz: OK
        usr/share/man/man8/tcpd.8.gz: OK
        usr/share/man/man8/tcpdchk.8.gz: OK
        usr/share/man/man8/tcpdmatch.8.gz: OK
        usr/share/man/man8/try-from.8.gz: OK


        Of course, the md5sums file itself maybe tampered, (and so could md5sum itself and so on...).







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Feb 15 '17 at 6:25









        murumuru

        1




        1








        • 1





          Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

          – mariner
          Feb 15 '17 at 6:38











        • When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

          – user364819
          Feb 17 '17 at 16:18






        • 2





          In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

          – Philippe Delteil
          May 30 '18 at 14:34














        • 1





          Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

          – mariner
          Feb 15 '17 at 6:38











        • When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

          – user364819
          Feb 17 '17 at 16:18






        • 2





          In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

          – Philippe Delteil
          May 30 '18 at 14:34








        1




        1





        Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

        – mariner
        Feb 15 '17 at 6:38





        Muru, thank you for such a prompt respond! It was really helpful. (unfortunately the system won't let me vote for your reputation. It says I am not yet allowed to to that :(((((

        – mariner
        Feb 15 '17 at 6:38













        When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

        – user364819
        Feb 17 '17 at 16:18





        When checking if something is malicious or not and checking it against a known good version MD5s are probably the worst hashsums to use due to collisions.

        – user364819
        Feb 17 '17 at 16:18




        2




        2





        In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

        – Philippe Delteil
        May 30 '18 at 14:34





        In my case, using Ubuntu 18.04 tcpd wasn't even installed and it was reported as infected!

        – Philippe Delteil
        May 30 '18 at 14:34













        7














        This is a false positive caused by a bug in the main chkrootkit script. I tried to post the fix here, but was downvoted. I reported the issue to the chkrootkit devs, but if you'd like to fix the issue so that it actually works, you might want to check out: https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-tcpd-521683/page2.html#post5788733






        share|improve this answer




























          7














          This is a false positive caused by a bug in the main chkrootkit script. I tried to post the fix here, but was downvoted. I reported the issue to the chkrootkit devs, but if you'd like to fix the issue so that it actually works, you might want to check out: https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-tcpd-521683/page2.html#post5788733






          share|improve this answer


























            7












            7








            7







            This is a false positive caused by a bug in the main chkrootkit script. I tried to post the fix here, but was downvoted. I reported the issue to the chkrootkit devs, but if you'd like to fix the issue so that it actually works, you might want to check out: https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-tcpd-521683/page2.html#post5788733






            share|improve this answer













            This is a false positive caused by a bug in the main chkrootkit script. I tried to post the fix here, but was downvoted. I reported the issue to the chkrootkit devs, but if you'd like to fix the issue so that it actually works, you might want to check out: https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-tcpd-521683/page2.html#post5788733







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Dec 4 '17 at 23:41







            user760856






























                0














                Mine was also listed as "INFECTED" (Ubuntu 18.10)... so I cross checked tcpd using the debsums utility ie:



                sudo debsums | grep tcpd


                It was listed as "OK".






                share|improve this answer




























                  0














                  Mine was also listed as "INFECTED" (Ubuntu 18.10)... so I cross checked tcpd using the debsums utility ie:



                  sudo debsums | grep tcpd


                  It was listed as "OK".






                  share|improve this answer


























                    0












                    0








                    0







                    Mine was also listed as "INFECTED" (Ubuntu 18.10)... so I cross checked tcpd using the debsums utility ie:



                    sudo debsums | grep tcpd


                    It was listed as "OK".






                    share|improve this answer













                    Mine was also listed as "INFECTED" (Ubuntu 18.10)... so I cross checked tcpd using the debsums utility ie:



                    sudo debsums | grep tcpd


                    It was listed as "OK".







                    share|improve this answer












                    share|improve this answer



                    share|improve this answer










                    answered Feb 12 at 2:05









                    Jay MarmJay Marm

                    1012




                    1012























                        0














                        You can try uploading them to sites for testing like virustotal and I believe BitDefender has a one minute rootkit scanner program available (unsure of multi OS support).



                        If you have a rootkit, there's no way to know if it's a false positive without solid documentation as was posted above, considering that a malicious program with root access can hide itself. You seem to be concerned, or are just following the syntax of CAPS LOCKS, but in the future I would recommend vaulting and backing up essential files (either through a cloud or an external that you must take care to not cross infect) such as databases, family photos, work, unsavory videos, etc.



                        check the md5 sum for inconsistencies for the important junk. Which is mostly anything that can be given root access or the distro itself. And if you are running a fresh install or don't mind doing one, you could always wipe and check it once more.



                        Quick edit:
                        BitDefender does not actually offer support for anything other than Windows. Sidenote, all antivirus programs are datamining you and your internet usage. Open source ftw.



                        tl;dr on the insidious nature of rootkits and how easily they propagate.






                        share|improve this answer






























                          0














                          You can try uploading them to sites for testing like virustotal and I believe BitDefender has a one minute rootkit scanner program available (unsure of multi OS support).



                          If you have a rootkit, there's no way to know if it's a false positive without solid documentation as was posted above, considering that a malicious program with root access can hide itself. You seem to be concerned, or are just following the syntax of CAPS LOCKS, but in the future I would recommend vaulting and backing up essential files (either through a cloud or an external that you must take care to not cross infect) such as databases, family photos, work, unsavory videos, etc.



                          check the md5 sum for inconsistencies for the important junk. Which is mostly anything that can be given root access or the distro itself. And if you are running a fresh install or don't mind doing one, you could always wipe and check it once more.



                          Quick edit:
                          BitDefender does not actually offer support for anything other than Windows. Sidenote, all antivirus programs are datamining you and your internet usage. Open source ftw.



                          tl;dr on the insidious nature of rootkits and how easily they propagate.






                          share|improve this answer




























                            0












                            0








                            0







                            You can try uploading them to sites for testing like virustotal and I believe BitDefender has a one minute rootkit scanner program available (unsure of multi OS support).



                            If you have a rootkit, there's no way to know if it's a false positive without solid documentation as was posted above, considering that a malicious program with root access can hide itself. You seem to be concerned, or are just following the syntax of CAPS LOCKS, but in the future I would recommend vaulting and backing up essential files (either through a cloud or an external that you must take care to not cross infect) such as databases, family photos, work, unsavory videos, etc.



                            check the md5 sum for inconsistencies for the important junk. Which is mostly anything that can be given root access or the distro itself. And if you are running a fresh install or don't mind doing one, you could always wipe and check it once more.



                            Quick edit:
                            BitDefender does not actually offer support for anything other than Windows. Sidenote, all antivirus programs are datamining you and your internet usage. Open source ftw.



                            tl;dr on the insidious nature of rootkits and how easily they propagate.






                            share|improve this answer















                            You can try uploading them to sites for testing like virustotal and I believe BitDefender has a one minute rootkit scanner program available (unsure of multi OS support).



                            If you have a rootkit, there's no way to know if it's a false positive without solid documentation as was posted above, considering that a malicious program with root access can hide itself. You seem to be concerned, or are just following the syntax of CAPS LOCKS, but in the future I would recommend vaulting and backing up essential files (either through a cloud or an external that you must take care to not cross infect) such as databases, family photos, work, unsavory videos, etc.



                            check the md5 sum for inconsistencies for the important junk. Which is mostly anything that can be given root access or the distro itself. And if you are running a fresh install or don't mind doing one, you could always wipe and check it once more.



                            Quick edit:
                            BitDefender does not actually offer support for anything other than Windows. Sidenote, all antivirus programs are datamining you and your internet usage. Open source ftw.



                            tl;dr on the insidious nature of rootkits and how easily they propagate.







                            share|improve this answer














                            share|improve this answer



                            share|improve this answer








                            edited Feb 12 at 2:21

























                            answered Feb 12 at 2:15









                            avisitoritseemsavisitoritseems

                            10110




                            10110






























                                draft saved

                                draft discarded




















































                                Thanks for contributing an answer to Ask Ubuntu!


                                • Please be sure to answer the question. Provide details and share your research!

                                But avoid



                                • Asking for help, clarification, or responding to other answers.

                                • Making statements based on opinion; back them up with references or personal experience.


                                To learn more, see our tips on writing great answers.




                                draft saved


                                draft discarded














                                StackExchange.ready(
                                function () {
                                StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f883495%2fchkrootkit-shows-tcpd-as-infected-is-it-a-false-positive%23new-answer', 'question_page');
                                }
                                );

                                Post as a guest















                                Required, but never shown





















































                                Required, but never shown














                                Required, but never shown












                                Required, but never shown







                                Required, but never shown

































                                Required, but never shown














                                Required, but never shown












                                Required, but never shown







                                Required, but never shown







                                Popular posts from this blog

                                How to make a Squid Proxy server?

                                Is this a new Fibonacci Identity?

                                Touch on Surface Book