# suckit rootkit

## christoffer32

Can you tell me if I have the rootkit, and if I have it how to remove it.

Searching for Suckit rootkit... Warning: /sbin/init INFECTED

[root@localhost sbin]# ls -l init

lrwxrwxrwx. 1 root root 22 Dec 11 19:10 init -> ../lib/systemd/systemd

----------

## ulenrich

I only know the Sabayon distro to have means to alter the init as a symlink.

This output signifies not a rootkit:

# equery check sys-apps/systemd

!!! /etc/udev/udev.conf has incorrect MD5sum

!!! /etc/systemd/system.conf has incorrect MD5sum

!!! /etc/systemd/journald.conf has incorrect MD5sum

* Checking sys-apps/systemd-208-r3 ...

   814 out of 817 files passed

----------

## secretcorporation

 *ulenrich wrote:*   

> I only know the Sabayon distro to have means to alter the init as a symlink.
> 
> This output signifies not a rootkit:
> 
> # equery check sys-apps/systemd
> ...

 

Can you elaborate on this?

I'm seeing the same issue with chrootkit on a Sabayon system, I installed a fresh copy on different hardware and I can't replicate the issue with chrootkit, I'm wondering if this is something new....

----------

## i92guboj

You probably want to check this:

https://forums.gentoo.org/viewtopic-t-326062-highlight-suckit.html

----------

