Questions about rootkits with chkrootkit and rkhunter

[Priest_Apostate]

I'm working with Debian version 12, and trying out both applications above - but they don't seem to be very helpful in narrowing down where they are seeing their particular alerts. Because both are giving different locations for alerts, I am thinking that they are pulling up false positives. However, I was curious about something: if I am getting alerts under one kernel version, wouldn't it be possible to just roll back the version to an uncorrupted kernel, delete/reinstall the updated kernel version, in order to easily circumvent confirmed rootkits?
I don't think I have one now - I was just curious as to whether this was a viable way to resolve rootkit issues (if one had multiple kernel versions available, that is).

 

[bob466]

These are not needed or wanted...remove them and enjoy Linux as we say...this is Linux not windoze.

 

[Alexzee]

When I was running rkhunter it continued to kick out false positives. Over time I removed it because it proved unreliable.
Yes, you can roll back to a later kernel. Be careful not to remove your current kernel and don't remove your fallback kernel.
Are you suspicious or have evidence that your current kernel is problematic?

 

[Priest_Apostate]

These are not needed or wanted...remove them and enjoy Linux as we say...this is Linux not windoze.

I am not understanding your response. I edited to add that I am using Debian version 12.

 

[Priest_Apostate]

When I was running rkhunter it continued to kick out false positives. Over time I removed it because it proved unreliable.
Yes, you can roll back to a later kernel. Be careful not to remove your current kernel and don't remove your fallback kernel.
Are you suspicious or have evidence that your current kernel is problematic?

I don't think that it is problematic: checking the rkhunter.log file seemed to indicate a false positive - especially when coupled with the fact that chkrootkit didn't alert to the same issues (chkrootkit didn't like the Ruby support files).

Also, there didn't seem to be any excessive memory requests/utilization when I checked with the "free" command.

The main issue for my laptop was that the /var directory was at max - which took some effort to resolve, as the logrotate didn't seem to be working.

I was just asking to satisfy my curiosity, as I thought that the logic seemed sound - but wondered if I was missing/overlooking something.

 

[osprey]

Also asked here: https://forums.debian.net/viewtopic.php?p=789601&hilit=rootkit#p789601

 

[bob466]

I am not understanding your response. I edited to add that I am using Debian version 12.

You don't need antivirus in Linux...it's that simple...
https://easylinuxtipsproject.blogspot.com/p/security.html#ID1.1

a. Antivirus is useless
A virus or rootkit can't install itself in Linux unless you let it. In order to install itself on your computer, a virus or rootkit needs your password. And that it doesn't have.

 

[KGIII]

I wrote an article about rkroothunter and the feedback was that it has been supplanted by chkrootkit.

So, there's that.