# [SOLVED]Knark Rootkit

## aia

Hi all,

Just finished the rkhunter installation 

I scanned my system and i found one possible Rootkit with name : Knark Rootkit.

I have to worry about this?

I tried to find if there is a way to delete this rootkit but  i didn't find something.Last edited by aia on Tue Nov 27, 2012 10:35 pm; edited 1 time in total

----------

## Fitzcarraldo

It's a false positive: https://forums.gentoo.org/viewtopic-t-691008-start-0.html

----------

## aCOSwt

 *aia wrote:*   

> I scanned my system and i found one possible Rootkit with name : Knark Rootkit.
> 
> I have to worry about this?

 

What did rkhunter say about this in details ?

Did it say it found a knark directory in /proc ?

----------

## aia

@ Fitzcarraldo

I've just already see this post

https://forums.gentoo.org/viewtopic-t-691008-start-0.html

but my output is different.

@ aCOSwt

No it doesn't just only 

Rootkit checks...

    Rootkits checked : 308

    Possible rootkits: 1

    Rootkit names    : Knark Rootkit

and also i have some warnings.It is important this rootkit?

----------

## aCOSwt

You should get a logfile somewhere. In /var/log I think.

Fetch it and search for Knark.

----------

## aia

Yes the log file is here 

```

/var/log/rkhunter.log

```

but there isn't referred for knark.

Strange.Also i have written that Knark is a rootkit for the Linux kernels 2.2 and 2.4 and i have newest kernel in my system.

I tried to find if there is a way to delete this rootkit and i didn' find something in google.

----------

## aia

Also i scanned with chkrootkit

and i didn't see something wrong in the output.

Which from both rootkit software I  should trust?

----------

## aCOSwt

Please do look closely into your log.

I just cannot trust rkhunter would report such a conclusion without logging any detail.

----------

## aia

Yes you have right!

```

 Checking system startup files for malware       [ Warning ]

[00:23:32] Warning: Found string 'hidef' in file '/etc/init.d/net.lo'. Possible rootkit: Knark Rootkit

```

@ Fitzcarraldo had also rightLast edited by aia on Tue Nov 27, 2012 10:29 pm; edited 1 time in total

----------

## aCOSwt

So you are in the false positive case Fitzcarraldo had told you about.

----------

## aia

sorry guys but when i checked the first time this log it was look liked half uncompleted.

Then i cleaned the /var/log/rkhunter.log and i run it again the command rkhunter -c and i got the newest log and i realized that it didn't the same with the initial.

Thank you!

----------

