Tuesday, 10 February 2015

[ubuntu] Worried about rootkit hunter results topic






Hi, my VPS was recently compromised and infected. The hosting company told me that they've cleaned the server of the infection, however I've ran a rootkit hunter scan and seen a few worrying things. Here is the full scan, the things I'm not sure about are highlighted in bold..


Code:


root@badbox:~# sudo rkhunter -c --enable all --disable none --rwo
Warning: The following processes are using deleted files:
        Process: /usr/bin/tgfvvtxvse    PID: 1608    File: /usr/bin/tgfvvtxvse
        Process: /usr/bin/tgfvvtxvse    PID: 1611    File: /usr/bin/tgfvvtxvse
        Process: /usr/bin/tgfvvtxvse    PID: 1612    File: /usr/bin/tgfvvtxvse
        Process: /usr/bin/tgfvvtxvse    PID: 1615    File: /usr/bin/tgfvvtxvse
        Process: /usr/bin/tgfvvtxvse    PID: 1621    File: /usr/bin/tgfvvtxvse
        Process: /usr/bin/sudo    PID: 3809    File: /dev/pts/0
        Process: /bin/dash    PID: 3810    File: /dev/pts/0
        Process: /usr/bin/xinit    PID: 4044    File: /dev/pts/0
        Process: /usr/bin/xfce4-session    PID: 4061    File: /dev/pts/0
        Process: /usr/bin/dbus-launch    PID: 4092    File: /dev/pts/0
Warning: File '/tmp/gvxddrshkl' (score: 206) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-1068.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-26937.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-4536.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-1073.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-27797.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-4291.log' (score: 221) contains some suspicious content and should be checked.
Warning: File '/tmp/vmware-root/vmware-apploader-28589.log' (score: 221) contains some suspicious content and should be checked.
Warning: Checking for files with suspicious contents [ Warning ]



Does anybody have any idea about what these randomly named files/processes I highlighted could be? Right click -> properties says it's an executable. I can try to upload the contents of the file onto pastebin however I'm not sure if that is against the forum rules or not - so if it's allowed and needed then ask.

I really don't know much about this kind of thing so if there is any information I was meant to provide please ask for it and I'll do my best to provide it.

Best regards

..Also, how can I whitelist .log files?






No comments:

Post a Comment