Award: Creata pagina con "'''Zeppoo Software''' Zeppoo - Zeppoo allows you to detect rootkits on i386 and x86_64 architecture under Linux, by using /dev/kmem and /dev/mem. Moreover it can also detec..."

2017-08-16T22:20:49Z

Creata pagina con "'''Zeppoo Software''' Zeppoo - Zeppoo allows you to detect rootkits on i386 and x86_64 architecture under Linux, by using /dev/kmem and /dev/mem. Moreover it can also detec..."

Nuova pagina

'''Zeppoo Software'''

Zeppoo - Zeppoo allows you to detect rootkits on i386 and x86_64 architecture under Linux,

by using /dev/kmem and /dev/mem.

Moreover it can also detect hidden tasks, connections, corrupted symbols, system calls and so many other things.
Download source code [http://sourceforge.net/projects/zeppoo]

'''Chkrootkit Software'''

Chkrootkit - chkrootkit is a tool to locally check for signs of a rootkit. Type the following command to install chkrootkit

$ sudo apt-get install chkrootkit

Start looking for rootkits, enter:

$ sudo chkrootkit

Look for suspicious strings, enter:

$ sudo chkrootkit -x | less

You need to specify the path for the external commands used by chkrootkit such as awk, grep and others.

Mount /mnt/safe using nfs in read-only mode and set /mnt/safe binaries PATH as trusted one, enter:

$ sudo chkrootkit -p /mnt/safe

'''rkhunter software'''

rkhunter - rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits.

rkhunter is a shell script which carries out various checks on the local system to try and detect known rootkits and malware.

It also performs checks to see if commands have been modified, if the system startup files have been modified,

and various checks on the network interfaces, including checks for listening applications.

Type the following command to install rkhunter:

$ sudo apt-get install rkhunter

The following command option tells rkhunter to perform various checks on the local system:

$ sudo rkhunter --check

The following command option causes rkhunter to check if there is a later version of any of its text data files:

$ sudo rkhunter --update

The following option tells rkhunter which directories to look in to find the various commands it requires:
$ sudo rkhunter --check --bindir /mnt/safe

'''Recommended readings:'''
man pages - rkhunter and chkrootkit
[http://rkhunter.sourceforge.net/] Rkhunter Project home page
[http://www.chkrootkit.org/] chkrootkit Project home page

Antivirus / RootKit - Cronologia

Award: Creata pagina con "'''Zeppoo Software''' Zeppoo - Zeppoo allows you to detect rootkits on i386 and x86_64 architecture under Linux, by using /dev/kmem and /dev/mem. Moreover it can also detec..."