I couldn't understand the output of chkrootkit command:$ chkrootkit -q -r //usr/lib/.libssl.so.10.hmac/usr/lib/.libfipscheck.so.1.hmac/usr/lib/firefox-3.6/.autoreg/usr/lib/.libfipscheck.so.1.1.0.hmac/usr/lib/.libssl.so.1.0.0d.hmac/lib/.libcrypto.so.1.0.0d.hmac/lib/.libgcrypt.so.11.hmac/lib/.libcrypto.so.10.hmac/proc/2980/fd/129: No such file or directoryWhat does this mean?
Cannot understand chkrootkit's result
linux;security;chkrootkit
The .*.hmac files are signature files for some cryptographic software, created by fipscheck. Their presence is not suspicious at all. They seem to be common false positives from chkrootkit on Fedora.As for the firefox-3.6/.autoreg file, which is a normal part of Firefox, you're not the first to see chkrootkit complain about it. The non-existent /proc/2980/fd/129 is probably because process 2980 closed the file (or even exited) just while chkrootkit was reaching it.You would get more information without -q.Chances are that these are false positives. On the other hand, an attacker aware of chkrootkit might deliberately plant her malware inside one of these known common false positives. On the gripping hand, running chkrootkit from within the system you're checking is pretty much useless: a well-written malware would hack into the kernel and arrange to make everything look normal to chkrootkit and other intrusion or malware detection tools.