2002-02-01 05:06:34 +01:00
|
|
|
Chkrootkit is a tool to locally check for signs of a rootkit.
|
|
|
|
|
-------------------------------------------------------------
|
|
|
|
|
|
2003-06-25 18:40:08 +02:00
|
|
|
It contains:
|
2003-02-02 14:40:13 +01:00
|
|
|
|
2003-06-25 18:40:08 +02:00
|
|
|
* chkrootkit: a shell script that checks system binaries for
|
|
|
|
|
rootkit modification.
|
|
|
|
|
* ifpromisc.c: checks if the network interface is in promiscuous
|
|
|
|
|
mode.
|
|
|
|
|
* chklastlog.c: checks for lastlog deletions.
|
|
|
|
|
* chkwtmp.c: checks for wtmp deletions.
|
|
|
|
|
* check_wtmpx.c: checks for wtmpx deletions. (Solaris only)
|
|
|
|
|
* chkproc.c: checks for signs of LKM trojans.
|
|
|
|
|
* chkdirs.c: checks for signs of LKM trojans.
|
|
|
|
|
* strings.c: quick and dirty strings replacement.
|
2005-04-14 20:42:15 +02:00
|
|
|
* chkutmp.c: checks for utmp deletions.
|
2003-06-25 18:40:08 +02:00
|
|
|
|
|
|
|
|
For an updated list of rootkits, worms and LKMs detected by
|
|
|
|
|
chkrootkit please visit: http://www.chkrootkit.org/
|
2002-02-01 05:06:34 +01:00
|
|
|
|
2001-04-07 02:48:49 +02:00
|
|
|
Nelson Murilo <nelson@pangeia.com.br>
|
2003-01-11 04:18:51 +01:00
|
|
|
Klaus Steding-Jessen <jessen@nic.br>
|
2001-04-07 02:48:49 +02:00
|
|
|
|
2001-04-27 14:01:58 +02:00
|
|
|
WWW: http://www.chkrootkit.org/
|
