Puppy Linux Discussion Forum

aragon · Joined: 15 Oct 2007 Posts: 1698 Location: Germany

Homepage: http://www.rootkit.nl/projects/rootkit_hunter.html
Version: 1.3.4

runtt21 · Joined: 07 Jun 2008 Posts: 1651 Location: BigD Texas

WOW,Thank you very much!!!! How did you make it?

aragon · Joined: 15 Oct 2007 Posts: 1698 Location: Germany

uploaded actual version, see main post.

aragon

paradj · Joined: 09 Jun 2010 Posts: 8

in this distro most debian-targeted source installer shell scripts work Rolling Eyes

but some get this error"

"$DEB_BUILD_ROOT variable not found."

for rkhunter v1.3.8, this can be fixed using the information here:

http://www.mail-archive.com/rkhunter-users@lists.sourceforge.net/msg01806.html

in a nutshell for v1.3.8

line 176
if [ -n "${DEB_BUILD_ROOT}" ]; then

change to:

if [ -n "$DEB_BUILD_ROOT+x}" ]; then

nyunda · Joined: 12 Apr 2011 Posts: 5 Location: west java

im newbie, i use puppy 520, i run rkhunter -c on rkhunter 1.3.6 & find 1 possible rootkit Xzibit Rootkit.

Found string 'hdparm' in file '/etc/rc.d/rc.sysinit'. Possible rootkit: Xzibit Rootkit

its rootkit or false positive?

& command rkhunter -c is only for check or remove?

thanks

nooby · Joined: 29 Jun 2008 Posts: 10548 Location: SwedenEurope

You use it in Lupu 520 and it is " Compiled in Puppy 4.21"

Could that change something or are such programs immune to such differences?

DPUP5520 · Joined: 16 Feb 2011 Posts: 813

This was happening with another rootkit hunter that someone else had installed, i believe it was chrootkit, except the person was being shown about 10 positives instead of just your one. The best and easiet way to see if it is showing a false positive is to check rootkit it is showing and take a screenshot and then pop in a live cd and boot from that and install and run the program again from there, if it comes out showing the same rootkit than it is a false positive.