Hi I just ran rkhunters and got a lot of warnings which are not the first ones I found the first time a I ran it.
I'll drop here the results to see if someone can help me and tell tell me if they are rootkits.
It say's there is a possible rootkit but it does not say which warning might be.
[ Rootkit Hunter version 1.4.6 ]
Checking system commands...
Performing 'strings' command checks
/usr/sbin/groupadd [ Warning ]
/usr/sbin/groupdel [ Warning ]
/usr/sbin/groupmod [ Warning ]
/usr/sbin/grpck [ Warning ]
/usr/sbin/ifdown [ Warning ]
/usr/sbin/ifup [ Warning ]
/usr/sbin/nologin [ Warning ]
/usr/sbin/pwck [ Warning ]
/usr/sbin/useradd [ Warning ]
/usr/sbin/userdel [ Warning ]
/usr/sbin/usermod [ Warning ]
/usr/sbin/vipw [ Warning ]
/usr/bin/lastlog [ Warning ]
/usr/bin/login [ Warning ]
/usr/bin/newgrp [ Warning ]
/usr/bin/passwd [ Warning ]
/usr/bin/size [ Warning ]
/usr/bin/strings [ Warning ]
/usr/bin/lwp-request [ Warning ]
/usr/bin/x86_64-linux-gnu-size [ Warning ]
/usr/bin/x86_64-linux-gnu-strings [ Warning ]
Performing additional rootkit checks
Checking for suspicious (large) shared memory segments [ Warning ]
Checking for passwd file changes [ Warning ]
Checking for group file changes [ Warning ]
Checking for hidden files and directories [ Warning ]
System checks summary
=====================
File properties checks...
Files checked: 145
Suspect files: 21
Rootkit checks...
Rootkits checked : 477
Possible rootkits: 1
Applications checks...
All checks skipped
The system checks took: 54 seconds
All results have been written to the log file: /var/log/rkhunter.log
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
==========================================================================
/var/log/rkhunter.log
[18:38:13] Checking for enabled inetd services [ Skipped ]
[18:38:13] Checking for enabled xinetd services [ Skipped ]
Checking for local host name [ Found ]
[18:38:19]
[18:38:19] Info: Starting test name 'startup_malware'
[18:38:19] Checking for system startup files [ Found ]
[18:38:21] Checking system startup files for malware [ None found ]
[18:38:21]
[18:38:21] Info: Starting test name 'group_accounts'
[18:38:21] Performing group and account checks
[18:38:21] Checking for passwd file [ Found ]
[18:38:21] Info: Found password file: /etc/passwd
[18:38:21] Checking for root equivalent (UID 0) accounts [ None found ]
[18:38:21] Info: Found shadow file: /etc/shadow
[18:38:21] Checking for passwordless accounts [ None found ]
[18:38:21]
[18:38:21] Info: Starting test name 'passwd_changes'
[18:38:21] Checking for passwd file changes [ Warning ]
[18:38:21] Warning: User 'snapd-range-524288-root' has been added to the passwd file.
[18:38:21] Warning: User 'snap_daemon' has been added to the passwd file.
[18:38:21] Warning: User 'lightdm' has been added to the passwd file.
[18:38:21]
[18:38:21] Info: Starting test name 'group_changes'
[18:38:21] Checking for group file changes [ Warning ]
[18:38:21] Warning: Group 'vboxusers' has been removed from the group file.
[18:38:21] Warning: Group 'snapd-range-524288-root' has been added to the group file.
[18:38:21] Warning: Group 'snap_daemon' has been added to the group file.
[18:38:21] Warning: Group 'lightdm' has been added to the group file.
[18:38:21] Warning: Group 'nopasswdlogin' has been added to the group file.
[18:38:21] Checking root account shell history files [ OK ]
[18:38:21] Info: Starting test name 'filesystem'
[18:38:21] Performing filesystem checks
[18:38:21] Info: SCAN_MODE_DEV set to 'THOROUGH'
[18:38:22] Checking /dev for suspicious file types [ None found ]
[18:38:22] Checking for hidden files and directories [ Warning ]
[18:38:22] Warning: Hidden directory found: /etc/.java
[18:38:22] Checking for missing log files [ Skipped ]
[18:38:22] Info: No missing log file names configured.
[18:38:22] Checking for empty log files [ Skipped ]
[18:38:22] Info: No empty log file names configured.
[18:38:35]
[18:38:35] Info: Test 'apps' disabled at users request.
[18:38:35]
[18:38:35] System checks summary
[18:38:35] =====================
[18:38:35]
[18:38:35] File properties checks...
[18:38:35] Files checked: 145
[18:38:35] Suspect files: 21
[18:38:35]
[18:38:35] Rootkit checks...
[18:38:35] Rootkits checked : 477
[18:38:35] Possible rootkits: 1
[18:38:35]
[18:38:35] Applications checks...
[18:38:35] All checks skipped
[18:38:35]
[18:38:35] The system checks took: 54 seconds
[18:38:35]
[18:38:35] Info: End date is mar 13 dic 2022 18:38:35 CET
