Puppy Linux Discussion Forum

nooby · Joined: 29 Jun 2008 Posts: 9392 Location: SwedenEurope

so which anti rootkit program would show least such false positives?

I tested Rootkit Revealer and it showed 406xxx that is fourhundredsixthousand things that it did not like.

Too much to go through to know if there is something to look deeper into.

what about Gmer is that only a remover and not teller of what it wants to remove before it do it?

Maybe the easiest thing for a newbie is to look for activity on the port 55 or something. Not that I know how to do this but that program is built into puppy from scratch I guess so easy to use of somebody tells how to get it going.

tasmod · Posted: Fri 05 Mar 2010, 12:27 Post subject:

nooby,

If you visit this part of the forum be prepared to get paranoid about Puppy and security.

Ease off, it's never as bad as it seems. Wink

Pizzasgood · Posted: Sat 06 Mar 2010, 02:58 Post subject:

If you trust Puppy as provided by Barry to be initially free from malware, you could create md5sums of all the files, store them on a read-only medium, and then verify them from time to time to make sure nothing changed. That would help you notice if any files changed.

It won't help you notice if new things are added without changing existing stuff. For example, scripts placed into /etc/init.d/, /etc/profile.d/, and /root/Startup will be run automatically as Puppy boots (and also whenever you open a terminal, in the case of profile.d). Also, files in /etc/udev/rules.d/ can execute commands when hardware is detected or removed.

If you don't add files to Puppy very often, you could do a remaster after it's set up and start from a fresh pup_save.2fs file. Then you could look at the contents of the pup_save.2fs file from time to time to see if there's anything suspicious in it. (If you frequently install or modify things this won't work because it will quickly fill up with a bunch of stuff that's legit.)

nooby · Joined: 29 Jun 2008 Posts: 9392 Location: SwedenEurope

I found this interesting text today searching for puppy and rootkits detection.

http://www.prevx.com/blog/139/Tdss-rootkit-silently-owns-the-net.html

one of the commentators wrote

8-bit · Joined: 03 Apr 2007 Posts: 3018 Location: Oregon

dll files are Windows ones and the key word here is infected.
Randomly going through windows and deleting DLL files that are supposedly infected may kill windows.
If one is concerned, do a backup of things you want to keep and reinstall windows.
The only dll files you would find in Puppy would be from an installation of wine.