Blogger Indonesia SetyaPutra.Org

One tool that important for linux server to locally checks for signs of a rootkit is CHKROOTKIT.  It  contains chkrootkit: a shell script that checks system binaries for  rootkit modification;  ifpromisc.c: checks if the network interface is in promiscuous  mode; chklastlog.c: checks for lastlog deletions; chkwtmp.c: checks for wtmp deletions; check_wtmpx.c: checks for wtmpx deletions (Solaris only);  chkproc.c: checks for signs of LKM trojans;  chkdirs.c: checks for signs of LKM trojans;  strings.c: quick and dirty strings replacement;  chkutmp.c: checks for utmp deletions.

Chkwtmp and chklastlog *try* to check for deleted entries in the wtmp and lastlog files, but it is *not* guaranteed that any modification  will be detected. Aliens tries to find sniffer logs and rootkit config files. It looks  for some default file locations — so it is also not guaranteed it  will succeed in all cases.

Chkproc checks if /proc entries are hidden from ps and the readdir system call. This could be the indication of a LKM trojan. You can  also run this command with the -v option (verbose).

How to Install

1. Login to your server as root. (SSH)
2. Down load the chkrootkit.
3. Type: wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
4. Unpack the chkrootkit you just downloaded.
5. Type: tar xvzf chkrootkit.tar.gz
6. Change to new directory
7. Type: cd chkrootkit*
8. Compile chkrootkit
9. Type: make sense
10. Run chkrootkit
11. Type: ./chkrootkit

If it says “Checking `bindshell’… INFECTED (PORTS: 465)”
This is normal and it is NOT really a virus.