0s autopkgtest [20:39:26]: starting date and time: 2024-11-26 20:39:26+0000 0s autopkgtest [20:39:26]: git checkout: 6f3be7a8 Fix armhf LXD image generation for plucky 0s autopkgtest [20:39:26]: host juju-7f2275-prod-proposed-migration-environment-20; command line: /home/ubuntu/autopkgtest/runner/autopkgtest --output-dir /tmp/autopkgtest-work.cmsz9r0v/out --timeout-copy=6000 --setup-commands /home/ubuntu/autopkgtest-cloud/worker-config-production/setup-canonical.sh --apt-pocket=proposed=src:binutils,src:python-apt --apt-upgrade chkrootkit --timeout-short=300 --timeout-copy=20000 --timeout-build=20000 '--env=ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1' -- ssh -s /home/ubuntu/autopkgtest/ssh-setup/nova -- --flavor builder-cpu2-ram4-disk20 --security-groups autopkgtest-juju-7f2275-prod-proposed-migration-environment-20@bos03-27.secgroup --name adt-plucky-amd64-chkrootkit-20241126-203926-juju-7f2275-prod-proposed-migration-environment-20-e67a09b1-db68-44aa-94a0-edb0d6be0246 --image adt/ubuntu-plucky-amd64-server --keyname testbed-juju-7f2275-prod-proposed-migration-environment-20 --net-id=net_prod-proposed-migration-amd64 -e TERM=linux -e ''"'"'http_proxy=http://squid.internal:3128'"'"'' -e ''"'"'https_proxy=http://squid.internal:3128'"'"'' -e ''"'"'no_proxy=127.0.0.1,127.0.1.1,login.ubuntu.com,localhost,localdomain,novalocal,internal,archive.ubuntu.com,ports.ubuntu.com,security.ubuntu.com,ddebs.ubuntu.com,changelogs.ubuntu.com,keyserver.ubuntu.com,launchpadlibrarian.net,launchpadcontent.net,launchpad.net,10.24.0.0/24,keystone.ps5.canonical.com,objectstorage.prodstack5.canonical.com'"'"'' --mirror=http://ftpmaster.internal/ubuntu/ 65s autopkgtest [20:40:31]: testbed dpkg architecture: amd64 65s autopkgtest [20:40:31]: testbed apt version: 2.9.8 65s autopkgtest [20:40:31]: @@@@@@@@@@@@@@@@@@@@ test bed setup 66s Get:1 http://ftpmaster.internal/ubuntu plucky-proposed InRelease [73.9 kB] 66s Get:2 http://ftpmaster.internal/ubuntu plucky-proposed/restricted Sources [9708 B] 67s Get:3 http://ftpmaster.internal/ubuntu plucky-proposed/main Sources [54.5 kB] 67s Get:4 http://ftpmaster.internal/ubuntu plucky-proposed/multiverse Sources [14.1 kB] 67s Get:5 http://ftpmaster.internal/ubuntu plucky-proposed/universe Sources [821 kB] 67s Get:6 http://ftpmaster.internal/ubuntu plucky-proposed/main i386 Packages [56.2 kB] 67s Get:7 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 Packages [99.1 kB] 67s Get:8 http://ftpmaster.internal/ubuntu plucky-proposed/restricted amd64 Packages [40.6 kB] 67s Get:9 http://ftpmaster.internal/ubuntu plucky-proposed/restricted i386 Packages [2572 B] 67s Get:10 http://ftpmaster.internal/ubuntu plucky-proposed/universe i386 Packages [236 kB] 67s Get:11 http://ftpmaster.internal/ubuntu plucky-proposed/universe amd64 Packages [666 kB] 67s Get:12 http://ftpmaster.internal/ubuntu plucky-proposed/multiverse i386 Packages [6008 B] 67s Get:13 http://ftpmaster.internal/ubuntu plucky-proposed/multiverse amd64 Packages [20.5 kB] 67s Fetched 2100 kB in 1s (2559 kB/s) 67s Reading package lists... 69s Reading package lists... 69s Building dependency tree... 69s Reading state information... 70s Calculating upgrade... 70s The following package was automatically installed and is no longer required: 70s libsgutils2-1.46-2 70s Use 'sudo apt autoremove' to remove it. 70s The following NEW packages will be installed: 70s appstream cloud-init-base gir1.2-packagekitglib-1.0 libappstream5 70s libduktape207 libglib2.0-bin libgstreamer1.0-0 libpackagekit-glib2-18 70s libsgutils2-1.48 libstemmer0d packagekit packagekit-tools polkitd 70s python3-distro-info python3-software-properties sgml-base 70s software-properties-common unattended-upgrades xml-core 70s The following packages will be upgraded: 70s amd64-microcode apt apt-utils bash binutils binutils-common 70s binutils-x86-64-linux-gnu bpftrace cloud-init curl debconf debconf-i18n 70s distro-info dracut-install fwupd-signed gir1.2-girepository-2.0 70s gir1.2-glib-2.0 hostname init init-system-helpers intel-microcode 70s libapt-pkg6.0t64 libaudit-common libaudit1 libbinutils libctf-nobfd0 libctf0 70s libcurl3t64-gnutls libcurl4t64 libgirepository-1.0-1 libglib2.0-0t64 70s libglib2.0-data libgprofng0 liblzma5 libpam-modules libpam-modules-bin 70s libpam-runtime libpam0g libperl5.40 libplymouth5 libpolkit-agent-1-0 70s libpolkit-gobject-1-0 libselinux1 libsemanage-common libsemanage2 libsframe1 70s linux-base lto-disabled-list lxd-installer openssh-client openssh-server 70s openssh-sftp-server perl perl-base perl-modules-5.40 pinentry-curses 70s plymouth plymouth-theme-ubuntu-text python-apt-common python3-apt 70s python3-blinker python3-dbus python3-debconf python3-gi 70s python3-jsonschema-specifications python3-rpds-py python3-yaml sg3-utils 70s sg3-utils-udev ubuntu-kernel-accessories ubuntu-minimal ubuntu-standard 70s vim-common vim-tiny wget xxd xz-utils 70s 77 upgraded, 19 newly installed, 0 to remove and 0 not upgraded. 70s Need to get 41.9 MB of archives. 70s After this operation, 14.7 MB of additional disk space will be used. 70s Get:1 http://ftpmaster.internal/ubuntu plucky/main amd64 bash amd64 5.2.32-1ubuntu2 [918 kB] 70s Get:2 http://ftpmaster.internal/ubuntu plucky/main amd64 hostname amd64 3.25 [11.1 kB] 70s Get:3 http://ftpmaster.internal/ubuntu plucky/main amd64 libperl5.40 amd64 5.40.0-8 [4879 kB] 71s Get:4 http://ftpmaster.internal/ubuntu plucky/main amd64 perl amd64 5.40.0-8 [262 kB] 71s Get:5 http://ftpmaster.internal/ubuntu plucky/main amd64 perl-base amd64 5.40.0-8 [1850 kB] 71s Get:6 http://ftpmaster.internal/ubuntu plucky/main amd64 perl-modules-5.40 all 5.40.0-8 [3214 kB] 71s Get:7 http://ftpmaster.internal/ubuntu plucky/main amd64 init-system-helpers all 1.67ubuntu1 [39.1 kB] 71s Get:8 http://ftpmaster.internal/ubuntu plucky/main amd64 liblzma5 amd64 5.6.3-1 [156 kB] 71s Get:9 http://ftpmaster.internal/ubuntu plucky/main amd64 libapt-pkg6.0t64 amd64 2.9.14ubuntu1 [1122 kB] 71s Get:10 http://ftpmaster.internal/ubuntu plucky/main amd64 apt amd64 2.9.14ubuntu1 [1385 kB] 71s Get:11 http://ftpmaster.internal/ubuntu plucky/main amd64 apt-utils amd64 2.9.14ubuntu1 [224 kB] 71s Get:12 http://ftpmaster.internal/ubuntu plucky/main amd64 libaudit-common all 1:4.0.2-2ubuntu1 [6578 B] 71s Get:13 http://ftpmaster.internal/ubuntu plucky/main amd64 libaudit1 amd64 1:4.0.2-2ubuntu1 [53.9 kB] 71s Get:14 http://ftpmaster.internal/ubuntu plucky/main amd64 debconf-i18n all 1.5.87ubuntu1 [204 kB] 71s Get:15 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-debconf all 1.5.87ubuntu1 [4156 B] 71s Get:16 http://ftpmaster.internal/ubuntu plucky/main amd64 debconf all 1.5.87ubuntu1 [124 kB] 71s Get:17 http://ftpmaster.internal/ubuntu plucky/main amd64 libpam0g amd64 1.5.3-7ubuntu4 [69.6 kB] 71s Get:18 http://ftpmaster.internal/ubuntu plucky/main amd64 libselinux1 amd64 3.7-3ubuntu1 [86.9 kB] 71s Get:19 http://ftpmaster.internal/ubuntu plucky/main amd64 libpam-modules-bin amd64 1.5.3-7ubuntu4 [53.7 kB] 71s Get:20 http://ftpmaster.internal/ubuntu plucky/main amd64 libpam-modules amd64 1.5.3-7ubuntu4 [294 kB] 71s Get:21 http://ftpmaster.internal/ubuntu plucky/main amd64 init amd64 1.67ubuntu1 [6428 B] 71s Get:22 http://ftpmaster.internal/ubuntu plucky/main amd64 openssh-sftp-server amd64 1:9.9p1-3ubuntu2 [41.2 kB] 71s Get:23 http://ftpmaster.internal/ubuntu plucky/main amd64 openssh-server amd64 1:9.9p1-3ubuntu2 [625 kB] 71s Get:24 http://ftpmaster.internal/ubuntu plucky/main amd64 openssh-client amd64 1:9.9p1-3ubuntu2 [1080 kB] 71s Get:25 http://ftpmaster.internal/ubuntu plucky/main amd64 libpam-runtime all 1.5.3-7ubuntu4 [40.8 kB] 71s Get:26 http://ftpmaster.internal/ubuntu plucky/main amd64 sgml-base all 1.31 [11.4 kB] 71s Get:27 http://ftpmaster.internal/ubuntu plucky/main amd64 libsemanage-common all 3.7-2build1 [7186 B] 71s Get:28 http://ftpmaster.internal/ubuntu plucky/main amd64 libsemanage2 amd64 3.7-2build1 [105 kB] 71s Get:29 http://ftpmaster.internal/ubuntu plucky/main amd64 distro-info amd64 1.12 [20.0 kB] 71s Get:30 http://ftpmaster.internal/ubuntu plucky/main amd64 gir1.2-girepository-2.0 amd64 1.82.0-2 [25.3 kB] 71s Get:31 http://ftpmaster.internal/ubuntu plucky/main amd64 gir1.2-glib-2.0 amd64 2.82.2-3 [182 kB] 71s Get:32 http://ftpmaster.internal/ubuntu plucky/main amd64 libglib2.0-0t64 amd64 2.82.2-3 [1655 kB] 71s Get:33 http://ftpmaster.internal/ubuntu plucky/main amd64 libgirepository-1.0-1 amd64 1.82.0-2 [88.7 kB] 71s Get:34 http://ftpmaster.internal/ubuntu plucky/main amd64 libglib2.0-data all 2.82.2-3 [51.7 kB] 71s Get:35 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 python-apt-common all 2.9.1 [20.5 kB] 71s Get:36 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 python3-apt amd64 2.9.1 [179 kB] 71s Get:37 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-dbus amd64 1.3.2-5build4 [110 kB] 71s Get:38 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-gi amd64 3.50.0-3build1 [293 kB] 71s Get:39 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-yaml amd64 6.0.2-1build1 [187 kB] 71s Get:40 http://ftpmaster.internal/ubuntu plucky/main amd64 vim-tiny amd64 2:9.1.0861-1ubuntu1 [1037 kB] 71s Get:41 http://ftpmaster.internal/ubuntu plucky/main amd64 vim-common all 2:9.1.0861-1ubuntu1 [395 kB] 71s Get:42 http://ftpmaster.internal/ubuntu plucky/main amd64 ubuntu-minimal amd64 1.544 [11.3 kB] 71s Get:43 http://ftpmaster.internal/ubuntu plucky/main amd64 xxd amd64 2:9.1.0861-1ubuntu1 [67.8 kB] 71s Get:44 http://ftpmaster.internal/ubuntu plucky/main amd64 libplymouth5 amd64 24.004.60-2ubuntu4 [145 kB] 71s Get:45 http://ftpmaster.internal/ubuntu plucky/main amd64 plymouth-theme-ubuntu-text amd64 24.004.60-2ubuntu4 [10.2 kB] 71s Get:46 http://ftpmaster.internal/ubuntu plucky/main amd64 plymouth amd64 24.004.60-2ubuntu4 [139 kB] 71s Get:47 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-distro-info all 1.12 [7754 B] 71s Get:48 http://ftpmaster.internal/ubuntu plucky/main amd64 wget amd64 1.24.5-2ubuntu1 [376 kB] 71s Get:49 http://ftpmaster.internal/ubuntu plucky/main amd64 xz-utils amd64 5.6.3-1 [276 kB] 71s Get:50 http://ftpmaster.internal/ubuntu plucky/main amd64 ubuntu-standard amd64 1.544 [11.3 kB] 71s Get:51 http://ftpmaster.internal/ubuntu plucky/main amd64 libcurl3t64-gnutls amd64 8.11.0-1ubuntu2 [423 kB] 71s Get:52 http://ftpmaster.internal/ubuntu plucky/main amd64 libstemmer0d amd64 2.2.0-4build1 [161 kB] 71s Get:53 http://ftpmaster.internal/ubuntu plucky/main amd64 libappstream5 amd64 1.0.3-1 [240 kB] 71s Get:54 http://ftpmaster.internal/ubuntu plucky/main amd64 appstream amd64 1.0.3-1 [69.4 kB] 71s Get:55 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 libgprofng0 amd64 2.43.50.20241126-2ubuntu1 [884 kB] 71s Get:56 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 libctf0 amd64 2.43.50.20241126-2ubuntu1 [96.3 kB] 71s Get:57 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 libctf-nobfd0 amd64 2.43.50.20241126-2ubuntu1 [98.5 kB] 71s Get:58 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 binutils-x86-64-linux-gnu amd64 2.43.50.20241126-2ubuntu1 [2485 kB] 72s Get:59 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 libbinutils amd64 2.43.50.20241126-2ubuntu1 [583 kB] 72s Get:60 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 binutils amd64 2.43.50.20241126-2ubuntu1 [11.7 kB] 72s Get:61 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 binutils-common amd64 2.43.50.20241126-2ubuntu1 [244 kB] 72s Get:62 http://ftpmaster.internal/ubuntu plucky-proposed/main amd64 libsframe1 amd64 2.43.50.20241126-2ubuntu1 [14.5 kB] 72s Get:63 http://ftpmaster.internal/ubuntu plucky/main amd64 bpftrace amd64 0.21.2-2ubuntu3 [1787 kB] 72s Get:64 http://ftpmaster.internal/ubuntu plucky/main amd64 cloud-init all 24.4-0ubuntu1 [2088 B] 72s Get:65 http://ftpmaster.internal/ubuntu plucky/main amd64 cloud-init-base all 24.4-0ubuntu1 [612 kB] 72s Get:66 http://ftpmaster.internal/ubuntu plucky/main amd64 curl amd64 8.11.0-1ubuntu2 [250 kB] 72s Get:67 http://ftpmaster.internal/ubuntu plucky/main amd64 libcurl4t64 amd64 8.11.0-1ubuntu2 [429 kB] 72s Get:68 http://ftpmaster.internal/ubuntu plucky/main amd64 dracut-install amd64 105-2ubuntu3 [35.8 kB] 72s Get:69 http://ftpmaster.internal/ubuntu plucky/main amd64 fwupd-signed amd64 1.55+1.7-1 [30.6 kB] 72s Get:70 http://ftpmaster.internal/ubuntu plucky/main amd64 libpackagekit-glib2-18 amd64 1.3.0-2 [120 kB] 72s Get:71 http://ftpmaster.internal/ubuntu plucky/main amd64 gir1.2-packagekitglib-1.0 amd64 1.3.0-2 [25.5 kB] 72s Get:72 http://ftpmaster.internal/ubuntu plucky/main amd64 libduktape207 amd64 2.7.0+tests-0ubuntu3 [143 kB] 72s Get:73 http://ftpmaster.internal/ubuntu plucky/main amd64 libglib2.0-bin amd64 2.82.2-3 [103 kB] 72s Get:74 http://ftpmaster.internal/ubuntu plucky/main amd64 libgstreamer1.0-0 amd64 1.24.9-1 [1197 kB] 72s Get:75 http://ftpmaster.internal/ubuntu plucky/main amd64 libpolkit-agent-1-0 amd64 125-2ubuntu1 [18.2 kB] 72s Get:76 http://ftpmaster.internal/ubuntu plucky/main amd64 libpolkit-gobject-1-0 amd64 125-2ubuntu1 [49.8 kB] 72s Get:77 http://ftpmaster.internal/ubuntu plucky/main amd64 libsgutils2-1.48 amd64 1.48-0ubuntu1 [124 kB] 72s Get:78 http://ftpmaster.internal/ubuntu plucky/main amd64 linux-base all 4.10.1ubuntu1 [34.8 kB] 72s Get:79 http://ftpmaster.internal/ubuntu plucky/main amd64 lto-disabled-list all 54 [12.2 kB] 72s Get:80 http://ftpmaster.internal/ubuntu plucky/main amd64 lxd-installer all 10 [5264 B] 72s Get:81 http://ftpmaster.internal/ubuntu plucky/main amd64 xml-core all 0.19 [20.3 kB] 72s Get:82 http://ftpmaster.internal/ubuntu plucky/main amd64 polkitd amd64 125-2ubuntu1 [97.3 kB] 72s Get:83 http://ftpmaster.internal/ubuntu plucky/main amd64 packagekit amd64 1.3.0-2 [471 kB] 72s Get:84 http://ftpmaster.internal/ubuntu plucky/main amd64 packagekit-tools amd64 1.3.0-2 [28.6 kB] 72s Get:85 http://ftpmaster.internal/ubuntu plucky/main amd64 pinentry-curses amd64 1.3.1-0ubuntu2 [41.6 kB] 72s Get:86 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-blinker all 1.9.0-1 [10.7 kB] 72s Get:87 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-rpds-py amd64 0.21.0-2ubuntu1 [323 kB] 72s Get:88 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-jsonschema-specifications all 2023.12.1-2 [9116 B] 72s Get:89 http://ftpmaster.internal/ubuntu plucky/main amd64 python3-software-properties all 0.105 [30.3 kB] 72s Get:90 http://ftpmaster.internal/ubuntu plucky/main amd64 sg3-utils amd64 1.48-0ubuntu1 [1042 kB] 72s Get:91 http://ftpmaster.internal/ubuntu plucky/main amd64 sg3-utils-udev all 1.48-0ubuntu1 [6608 B] 72s Get:92 http://ftpmaster.internal/ubuntu plucky/main amd64 software-properties-common all 0.105 [16.5 kB] 72s Get:93 http://ftpmaster.internal/ubuntu plucky/main amd64 ubuntu-kernel-accessories amd64 1.544 [11.0 kB] 72s Get:94 http://ftpmaster.internal/ubuntu plucky/main amd64 unattended-upgrades all 2.9.1+nmu4ubuntu1 [51.2 kB] 72s Get:95 http://ftpmaster.internal/ubuntu plucky/main amd64 amd64-microcode amd64 3.20240820.1ubuntu1 [187 kB] 72s Get:96 http://ftpmaster.internal/ubuntu plucky/main amd64 intel-microcode amd64 3.20241112.1ubuntu2 [7055 kB] 73s Preconfiguring packages ... 73s Fetched 41.9 MB in 2s (16.9 MB/s) 73s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 73s Preparing to unpack .../bash_5.2.32-1ubuntu2_amd64.deb ... 73s Unpacking bash (5.2.32-1ubuntu2) over (5.2.32-1ubuntu1) ... 73s Setting up bash (5.2.32-1ubuntu2) ... 73s update-alternatives: using /usr/share/man/man7/bash-builtins.7.gz to provide /usr/share/man/man7/builtins.7.gz (builtins.7.gz) in auto mode 73s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 73s Preparing to unpack .../hostname_3.25_amd64.deb ... 73s Unpacking hostname (3.25) over (3.23+nmu2ubuntu2) ... 73s Setting up hostname (3.25) ... 73s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 73s Preparing to unpack .../libperl5.40_5.40.0-8_amd64.deb ... 73s Unpacking libperl5.40:amd64 (5.40.0-8) over (5.40.0-7) ... 74s Preparing to unpack .../perl_5.40.0-8_amd64.deb ... 74s Unpacking perl (5.40.0-8) over (5.40.0-7) ... 74s Preparing to unpack .../perl-base_5.40.0-8_amd64.deb ... 74s Unpacking perl-base (5.40.0-8) over (5.40.0-7) ... 74s Setting up perl-base (5.40.0-8) ... 74s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 74s Preparing to unpack .../perl-modules-5.40_5.40.0-8_all.deb ... 74s Unpacking perl-modules-5.40 (5.40.0-8) over (5.40.0-7) ... 74s Preparing to unpack .../init-system-helpers_1.67ubuntu1_all.deb ... 74s Unpacking init-system-helpers (1.67ubuntu1) over (1.66ubuntu1) ... 74s Setting up init-system-helpers (1.67ubuntu1) ... 74s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 74s Preparing to unpack .../liblzma5_5.6.3-1_amd64.deb ... 74s Unpacking liblzma5:amd64 (5.6.3-1) over (5.6.2-2) ... 75s Setting up liblzma5:amd64 (5.6.3-1) ... 75s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 75s Preparing to unpack .../libapt-pkg6.0t64_2.9.14ubuntu1_amd64.deb ... 75s Unpacking libapt-pkg6.0t64:amd64 (2.9.14ubuntu1) over (2.9.8) ... 75s Setting up libapt-pkg6.0t64:amd64 (2.9.14ubuntu1) ... 75s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75620 files and directories currently installed.) 75s Preparing to unpack .../apt_2.9.14ubuntu1_amd64.deb ... 75s Unpacking apt (2.9.14ubuntu1) over (2.9.8) ... 75s Setting up apt (2.9.14ubuntu1) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../apt-utils_2.9.14ubuntu1_amd64.deb ... 76s Unpacking apt-utils (2.9.14ubuntu1) over (2.9.8) ... 76s Preparing to unpack .../libaudit-common_1%3a4.0.2-2ubuntu1_all.deb ... 76s Unpacking libaudit-common (1:4.0.2-2ubuntu1) over (1:4.0.1-1ubuntu2) ... 76s Setting up libaudit-common (1:4.0.2-2ubuntu1) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../libaudit1_1%3a4.0.2-2ubuntu1_amd64.deb ... 76s Unpacking libaudit1:amd64 (1:4.0.2-2ubuntu1) over (1:4.0.1-1ubuntu2) ... 76s Setting up libaudit1:amd64 (1:4.0.2-2ubuntu1) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../debconf-i18n_1.5.87ubuntu1_all.deb ... 76s Unpacking debconf-i18n (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 76s Preparing to unpack .../python3-debconf_1.5.87ubuntu1_all.deb ... 76s Unpacking python3-debconf (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 76s Preparing to unpack .../debconf_1.5.87ubuntu1_all.deb ... 76s Unpacking debconf (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 76s Setting up debconf (1.5.87ubuntu1) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../libpam0g_1.5.3-7ubuntu4_amd64.deb ... 76s Unpacking libpam0g:amd64 (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 76s Setting up libpam0g:amd64 (1.5.3-7ubuntu4) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../libselinux1_3.7-3ubuntu1_amd64.deb ... 76s Unpacking libselinux1:amd64 (3.7-3ubuntu1) over (3.5-2ubuntu5) ... 76s Setting up libselinux1:amd64 (3.7-3ubuntu1) ... 76s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 76s Preparing to unpack .../libpam-modules-bin_1.5.3-7ubuntu4_amd64.deb ... 76s Unpacking libpam-modules-bin (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 76s Setting up libpam-modules-bin (1.5.3-7ubuntu4) ... 77s pam_namespace.service is a disabled or a static unit not running, not starting it. 77s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 77s Preparing to unpack .../libpam-modules_1.5.3-7ubuntu4_amd64.deb ... 77s Unpacking libpam-modules:amd64 (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 77s Setting up libpam-modules:amd64 (1.5.3-7ubuntu4) ... 77s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75612 files and directories currently installed.) 77s Preparing to unpack .../init_1.67ubuntu1_amd64.deb ... 77s Unpacking init (1.67ubuntu1) over (1.66ubuntu1) ... 77s Preparing to unpack .../openssh-sftp-server_1%3a9.9p1-3ubuntu2_amd64.deb ... 77s Unpacking openssh-sftp-server (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 77s Preparing to unpack .../openssh-server_1%3a9.9p1-3ubuntu2_amd64.deb ... 77s Unpacking openssh-server (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 77s Preparing to unpack .../openssh-client_1%3a9.9p1-3ubuntu2_amd64.deb ... 77s Unpacking openssh-client (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 77s Preparing to unpack .../libpam-runtime_1.5.3-7ubuntu4_all.deb ... 77s Unpacking libpam-runtime (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 77s Setting up libpam-runtime (1.5.3-7ubuntu4) ... 78s Selecting previously unselected package sgml-base. 78s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75614 files and directories currently installed.) 78s Preparing to unpack .../sgml-base_1.31_all.deb ... 78s Unpacking sgml-base (1.31) ... 78s Preparing to unpack .../libsemanage-common_3.7-2build1_all.deb ... 78s Unpacking libsemanage-common (3.7-2build1) over (3.5-1build6) ... 78s Setting up libsemanage-common (3.7-2build1) ... 78s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75640 files and directories currently installed.) 78s Preparing to unpack .../libsemanage2_3.7-2build1_amd64.deb ... 78s Unpacking libsemanage2:amd64 (3.7-2build1) over (3.5-1build6) ... 78s Setting up libsemanage2:amd64 (3.7-2build1) ... 78s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75640 files and directories currently installed.) 78s Preparing to unpack .../00-distro-info_1.12_amd64.deb ... 78s Unpacking distro-info (1.12) over (1.9) ... 78s Preparing to unpack .../01-gir1.2-girepository-2.0_1.82.0-2_amd64.deb ... 78s Unpacking gir1.2-girepository-2.0:amd64 (1.82.0-2) over (1.80.1-4) ... 78s Preparing to unpack .../02-gir1.2-glib-2.0_2.82.2-3_amd64.deb ... 78s Unpacking gir1.2-glib-2.0:amd64 (2.82.2-3) over (2.82.1-0ubuntu1) ... 78s Preparing to unpack .../03-libglib2.0-0t64_2.82.2-3_amd64.deb ... 78s Unpacking libglib2.0-0t64:amd64 (2.82.2-3) over (2.82.1-0ubuntu1) ... 78s Preparing to unpack .../04-libgirepository-1.0-1_1.82.0-2_amd64.deb ... 78s Unpacking libgirepository-1.0-1:amd64 (1.82.0-2) over (1.80.1-4) ... 78s Preparing to unpack .../05-libglib2.0-data_2.82.2-3_all.deb ... 78s Unpacking libglib2.0-data (2.82.2-3) over (2.82.1-0ubuntu1) ... 78s Preparing to unpack .../06-python-apt-common_2.9.1_all.deb ... 78s Unpacking python-apt-common (2.9.1) over (2.9.0ubuntu1) ... 78s Preparing to unpack .../07-python3-apt_2.9.1_amd64.deb ... 78s Unpacking python3-apt (2.9.1) over (2.9.0ubuntu1) ... 78s Preparing to unpack .../08-python3-dbus_1.3.2-5build4_amd64.deb ... 78s Unpacking python3-dbus (1.3.2-5build4) over (1.3.2-5build3) ... 78s Preparing to unpack .../09-python3-gi_3.50.0-3build1_amd64.deb ... 78s Unpacking python3-gi (3.50.0-3build1) over (3.50.0-3) ... 79s Preparing to unpack .../10-python3-yaml_6.0.2-1build1_amd64.deb ... 79s Unpacking python3-yaml (6.0.2-1build1) over (6.0.2-1) ... 79s Preparing to unpack .../11-vim-tiny_2%3a9.1.0861-1ubuntu1_amd64.deb ... 79s Unpacking vim-tiny (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 79s Preparing to unpack .../12-vim-common_2%3a9.1.0861-1ubuntu1_all.deb ... 79s Unpacking vim-common (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 79s Preparing to unpack .../13-ubuntu-minimal_1.544_amd64.deb ... 79s Unpacking ubuntu-minimal (1.544) over (1.543) ... 79s Preparing to unpack .../14-xxd_2%3a9.1.0861-1ubuntu1_amd64.deb ... 79s Unpacking xxd (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 79s Preparing to unpack .../15-libplymouth5_24.004.60-2ubuntu4_amd64.deb ... 79s Unpacking libplymouth5:amd64 (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 79s Preparing to unpack .../16-plymouth-theme-ubuntu-text_24.004.60-2ubuntu4_amd64.deb ... 79s Unpacking plymouth-theme-ubuntu-text (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 79s Preparing to unpack .../17-plymouth_24.004.60-2ubuntu4_amd64.deb ... 79s Unpacking plymouth (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 79s Selecting previously unselected package python3-distro-info. 79s Preparing to unpack .../18-python3-distro-info_1.12_all.deb ... 79s Unpacking python3-distro-info (1.12) ... 79s Preparing to unpack .../19-wget_1.24.5-2ubuntu1_amd64.deb ... 79s Unpacking wget (1.24.5-2ubuntu1) over (1.24.5-1ubuntu2) ... 79s Preparing to unpack .../20-xz-utils_5.6.3-1_amd64.deb ... 79s Unpacking xz-utils (5.6.3-1) over (5.6.2-2) ... 79s Preparing to unpack .../21-ubuntu-standard_1.544_amd64.deb ... 79s Unpacking ubuntu-standard (1.544) over (1.543) ... 79s Preparing to unpack .../22-libcurl3t64-gnutls_8.11.0-1ubuntu2_amd64.deb ... 79s Unpacking libcurl3t64-gnutls:amd64 (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 79s Selecting previously unselected package libstemmer0d:amd64. 79s Preparing to unpack .../23-libstemmer0d_2.2.0-4build1_amd64.deb ... 79s Unpacking libstemmer0d:amd64 (2.2.0-4build1) ... 79s Selecting previously unselected package libappstream5:amd64. 79s Preparing to unpack .../24-libappstream5_1.0.3-1_amd64.deb ... 79s Unpacking libappstream5:amd64 (1.0.3-1) ... 79s Selecting previously unselected package appstream. 79s Preparing to unpack .../25-appstream_1.0.3-1_amd64.deb ... 79s Unpacking appstream (1.0.3-1) ... 79s Preparing to unpack .../26-libgprofng0_2.43.50.20241126-2ubuntu1_amd64.deb ... 79s Unpacking libgprofng0:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 79s Preparing to unpack .../27-libctf0_2.43.50.20241126-2ubuntu1_amd64.deb ... 79s Unpacking libctf0:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 79s Preparing to unpack .../28-libctf-nobfd0_2.43.50.20241126-2ubuntu1_amd64.deb ... 79s Unpacking libctf-nobfd0:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 79s Preparing to unpack .../29-binutils-x86-64-linux-gnu_2.43.50.20241126-2ubuntu1_amd64.deb ... 79s Unpacking binutils-x86-64-linux-gnu (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 80s Preparing to unpack .../30-libbinutils_2.43.50.20241126-2ubuntu1_amd64.deb ... 80s Unpacking libbinutils:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 80s Preparing to unpack .../31-binutils_2.43.50.20241126-2ubuntu1_amd64.deb ... 80s Unpacking binutils (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 80s Preparing to unpack .../32-binutils-common_2.43.50.20241126-2ubuntu1_amd64.deb ... 80s Unpacking binutils-common:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 80s Preparing to unpack .../33-libsframe1_2.43.50.20241126-2ubuntu1_amd64.deb ... 80s Unpacking libsframe1:amd64 (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 80s Preparing to unpack .../34-bpftrace_0.21.2-2ubuntu3_amd64.deb ... 80s Unpacking bpftrace (0.21.2-2ubuntu3) over (0.21.2-2ubuntu2) ... 80s Preparing to unpack .../35-cloud-init_24.4-0ubuntu1_all.deb ... 80s Unpacking cloud-init (24.4-0ubuntu1) over (24.4~3+really24.3.1-0ubuntu4) ... 80s dpkg: warning: unable to delete old directory '/etc/cloud/templates': Directory not empty 80s dpkg: warning: unable to delete old directory '/etc/cloud/cloud.cfg.d': Directory not empty 80s dpkg: warning: unable to delete old directory '/etc/cloud': Directory not empty 80s Selecting previously unselected package cloud-init-base. 80s Preparing to unpack .../36-cloud-init-base_24.4-0ubuntu1_all.deb ... 80s Unpacking cloud-init-base (24.4-0ubuntu1) ... 80s Preparing to unpack .../37-curl_8.11.0-1ubuntu2_amd64.deb ... 80s Unpacking curl (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 81s Preparing to unpack .../38-libcurl4t64_8.11.0-1ubuntu2_amd64.deb ... 81s Unpacking libcurl4t64:amd64 (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 81s Preparing to unpack .../39-dracut-install_105-2ubuntu3_amd64.deb ... 81s Unpacking dracut-install (105-2ubuntu3) over (105-1ubuntu1) ... 81s Preparing to unpack .../40-fwupd-signed_1.55+1.7-1_amd64.deb ... 81s Unpacking fwupd-signed (1.55+1.7-1) over (1.54+1.6-1build1) ... 81s Selecting previously unselected package libpackagekit-glib2-18:amd64. 81s Preparing to unpack .../41-libpackagekit-glib2-18_1.3.0-2_amd64.deb ... 81s Unpacking libpackagekit-glib2-18:amd64 (1.3.0-2) ... 81s Selecting previously unselected package gir1.2-packagekitglib-1.0. 81s Preparing to unpack .../42-gir1.2-packagekitglib-1.0_1.3.0-2_amd64.deb ... 81s Unpacking gir1.2-packagekitglib-1.0 (1.3.0-2) ... 81s Selecting previously unselected package libduktape207:amd64. 81s Preparing to unpack .../43-libduktape207_2.7.0+tests-0ubuntu3_amd64.deb ... 81s Unpacking libduktape207:amd64 (2.7.0+tests-0ubuntu3) ... 81s Selecting previously unselected package libglib2.0-bin. 81s Preparing to unpack .../44-libglib2.0-bin_2.82.2-3_amd64.deb ... 81s Unpacking libglib2.0-bin (2.82.2-3) ... 81s Selecting previously unselected package libgstreamer1.0-0:amd64. 81s Preparing to unpack .../45-libgstreamer1.0-0_1.24.9-1_amd64.deb ... 81s Unpacking libgstreamer1.0-0:amd64 (1.24.9-1) ... 81s Preparing to unpack .../46-libpolkit-agent-1-0_125-2ubuntu1_amd64.deb ... 81s Unpacking libpolkit-agent-1-0:amd64 (125-2ubuntu1) over (124-2ubuntu1) ... 81s Preparing to unpack .../47-libpolkit-gobject-1-0_125-2ubuntu1_amd64.deb ... 81s Unpacking libpolkit-gobject-1-0:amd64 (125-2ubuntu1) over (124-2ubuntu1) ... 81s Selecting previously unselected package libsgutils2-1.48:amd64. 81s Preparing to unpack .../48-libsgutils2-1.48_1.48-0ubuntu1_amd64.deb ... 81s Unpacking libsgutils2-1.48:amd64 (1.48-0ubuntu1) ... 81s Preparing to unpack .../49-linux-base_4.10.1ubuntu1_all.deb ... 81s Unpacking linux-base (4.10.1ubuntu1) over (4.5ubuntu9) ... 81s Preparing to unpack .../50-lto-disabled-list_54_all.deb ... 81s Unpacking lto-disabled-list (54) over (53) ... 81s Preparing to unpack .../51-lxd-installer_10_all.deb ... 81s Unpacking lxd-installer (10) over (9) ... 81s Selecting previously unselected package xml-core. 81s Preparing to unpack .../52-xml-core_0.19_all.deb ... 81s Unpacking xml-core (0.19) ... 81s Selecting previously unselected package polkitd. 81s Preparing to unpack .../53-polkitd_125-2ubuntu1_amd64.deb ... 81s Unpacking polkitd (125-2ubuntu1) ... 81s Selecting previously unselected package packagekit. 81s Preparing to unpack .../54-packagekit_1.3.0-2_amd64.deb ... 81s Unpacking packagekit (1.3.0-2) ... 81s Selecting previously unselected package packagekit-tools. 81s Preparing to unpack .../55-packagekit-tools_1.3.0-2_amd64.deb ... 81s Unpacking packagekit-tools (1.3.0-2) ... 81s Preparing to unpack .../56-pinentry-curses_1.3.1-0ubuntu2_amd64.deb ... 81s Unpacking pinentry-curses (1.3.1-0ubuntu2) over (1.2.1-3ubuntu5) ... 81s Preparing to unpack .../57-python3-blinker_1.9.0-1_all.deb ... 81s Unpacking python3-blinker (1.9.0-1) over (1.8.2-1) ... 81s Preparing to unpack .../58-python3-rpds-py_0.21.0-2ubuntu1_amd64.deb ... 81s Unpacking python3-rpds-py (0.21.0-2ubuntu1) over (0.20.0-0ubuntu3) ... 81s Preparing to unpack .../59-python3-jsonschema-specifications_2023.12.1-2_all.deb ... 81s Unpacking python3-jsonschema-specifications (2023.12.1-2) over (2023.12.1-1ubuntu1) ... 81s Selecting previously unselected package python3-software-properties. 81s Preparing to unpack .../60-python3-software-properties_0.105_all.deb ... 81s Unpacking python3-software-properties (0.105) ... 81s Preparing to unpack .../61-sg3-utils_1.48-0ubuntu1_amd64.deb ... 81s Unpacking sg3-utils (1.48-0ubuntu1) over (1.46-3ubuntu5) ... 82s Preparing to unpack .../62-sg3-utils-udev_1.48-0ubuntu1_all.deb ... 82s Unpacking sg3-utils-udev (1.48-0ubuntu1) over (1.46-3ubuntu5) ... 82s Selecting previously unselected package software-properties-common. 82s Preparing to unpack .../63-software-properties-common_0.105_all.deb ... 82s Unpacking software-properties-common (0.105) ... 82s Preparing to unpack .../64-ubuntu-kernel-accessories_1.544_amd64.deb ... 82s Unpacking ubuntu-kernel-accessories (1.544) over (1.543) ... 82s Selecting previously unselected package unattended-upgrades. 82s Preparing to unpack .../65-unattended-upgrades_2.9.1+nmu4ubuntu1_all.deb ... 82s Unpacking unattended-upgrades (2.9.1+nmu4ubuntu1) ... 82s Preparing to unpack .../66-amd64-microcode_3.20240820.1ubuntu1_amd64.deb ... 82s Unpacking amd64-microcode (3.20240820.1ubuntu1) over (3.20240116.2+nmu1ubuntu1.1) ... 82s Preparing to unpack .../67-intel-microcode_3.20241112.1ubuntu2_amd64.deb ... 82s Unpacking intel-microcode (3.20241112.1ubuntu2) over (3.20240910.0ubuntu1) ... 82s Setting up pinentry-curses (1.3.1-0ubuntu2) ... 82s Setting up distro-info (1.12) ... 82s Setting up lto-disabled-list (54) ... 82s Setting up ubuntu-kernel-accessories (1.544) ... 82s Setting up apt-utils (2.9.14ubuntu1) ... 82s Setting up linux-base (4.10.1ubuntu1) ... 82s Setting up wget (1.24.5-2ubuntu1) ... 82s Setting up init (1.67ubuntu1) ... 82s Setting up libcurl4t64:amd64 (8.11.0-1ubuntu2) ... 82s Setting up openssh-client (1:9.9p1-3ubuntu2) ... 82s Setting up intel-microcode (3.20241112.1ubuntu2) ... 82s intel-microcode: microcode will be updated at next boot 82s Setting up python3-debconf (1.5.87ubuntu1) ... 82s Setting up binutils-common:amd64 (2.43.50.20241126-2ubuntu1) ... 82s Setting up libcurl3t64-gnutls:amd64 (8.11.0-1ubuntu2) ... 82s Setting up libctf-nobfd0:amd64 (2.43.50.20241126-2ubuntu1) ... 82s Setting up fwupd-signed (1.55+1.7-1) ... 82s Setting up libsgutils2-1.48:amd64 (1.48-0ubuntu1) ... 82s Setting up python3-yaml (6.0.2-1build1) ... 82s Setting up debconf-i18n (1.5.87ubuntu1) ... 82s Setting up amd64-microcode (3.20240820.1ubuntu1) ... 82s amd64-microcode: microcode will be updated at next boot 82s Setting up cloud-init-base (24.4-0ubuntu1) ... 84s Setting up xxd (2:9.1.0861-1ubuntu1) ... 84s Setting up libsframe1:amd64 (2.43.50.20241126-2ubuntu1) ... 84s Setting up libglib2.0-0t64:amd64 (2.82.2-3) ... 84s No schema files found: doing nothing. 84s Setting up libglib2.0-data (2.82.2-3) ... 84s Setting up vim-common (2:9.1.0861-1ubuntu1) ... 84s Setting up xz-utils (5.6.3-1) ... 84s Setting up gir1.2-glib-2.0:amd64 (2.82.2-3) ... 84s Setting up lxd-installer (10) ... 84s Setting up python3-rpds-py (0.21.0-2ubuntu1) ... 84s Setting up python-apt-common (2.9.1) ... 84s Setting up dracut-install (105-2ubuntu3) ... 84s Setting up perl-modules-5.40 (5.40.0-8) ... 84s Setting up libduktape207:amd64 (2.7.0+tests-0ubuntu3) ... 84s Setting up libplymouth5:amd64 (24.004.60-2ubuntu4) ... 84s Setting up libgirepository-1.0-1:amd64 (1.82.0-2) ... 84s Setting up sgml-base (1.31) ... 84s Setting up curl (8.11.0-1ubuntu2) ... 84s Setting up libstemmer0d:amd64 (2.2.0-4build1) ... 84s Setting up libbinutils:amd64 (2.43.50.20241126-2ubuntu1) ... 84s Setting up python3-jsonschema-specifications (2023.12.1-2) ... 84s Setting up python3-distro-info (1.12) ... 84s Setting up libpolkit-gobject-1-0:amd64 (125-2ubuntu1) ... 84s Setting up libgstreamer1.0-0:amd64 (1.24.9-1) ... 84s Setcap worked! gst-ptp-helper is not suid! 84s Setting up sg3-utils (1.48-0ubuntu1) ... 84s Setting up python3-blinker (1.9.0-1) ... 84s Setting up libctf0:amd64 (2.43.50.20241126-2ubuntu1) ... 84s Setting up openssh-sftp-server (1:9.9p1-3ubuntu2) ... 84s Setting up python3-dbus (1.3.2-5build4) ... 85s Setting up cloud-init (24.4-0ubuntu1) ... 85s Setting up openssh-server (1:9.9p1-3ubuntu2) ... 85s Installing new version of config file /etc/ssh/moduli ... 85s Replacing config file /etc/ssh/sshd_config with new version 86s Setting up bpftrace (0.21.2-2ubuntu3) ... 86s Setting up plymouth (24.004.60-2ubuntu4) ... 86s update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults 86s update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults 86s Setting up python3-apt (2.9.1) ... 86s Setting up libglib2.0-bin (2.82.2-3) ... 86s Setting up libpackagekit-glib2-18:amd64 (1.3.0-2) ... 86s Setting up libappstream5:amd64 (1.0.3-1) ... 86s Setting up vim-tiny (2:9.1.0861-1ubuntu1) ... 87s Setting up ubuntu-standard (1.544) ... 87s Setting up sg3-utils-udev (1.48-0ubuntu1) ... 87s update-initramfs: deferring update (trigger activated) 87s Setting up libperl5.40:amd64 (5.40.0-8) ... 87s Setting up gir1.2-packagekitglib-1.0 (1.3.0-2) ... 87s Setting up unattended-upgrades (2.9.1+nmu4ubuntu1) ... 87s 87s Creating config file /etc/apt/apt.conf.d/20auto-upgrades with new version 87s 87s Creating config file /etc/apt/apt.conf.d/50unattended-upgrades with new version 87s Created symlink '/etc/systemd/system/multi-user.target.wants/unattended-upgrades.service' → '/usr/lib/systemd/system/unattended-upgrades.service'. 87s Synchronizing state of unattended-upgrades.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. 87s Executing: /usr/lib/systemd/systemd-sysv-install enable unattended-upgrades 88s Setting up perl (5.40.0-8) ... 88s Setting up libgprofng0:amd64 (2.43.50.20241126-2ubuntu1) ... 88s Setting up appstream (1.0.3-1) ... 88s ✔ Metadata cache was updated successfully. 88s Setting up gir1.2-girepository-2.0:amd64 (1.82.0-2) ... 88s Setting up python3-gi (3.50.0-3build1) ... 88s Setting up xml-core (0.19) ... 89s Setting up libpolkit-agent-1-0:amd64 (125-2ubuntu1) ... 89s Setting up binutils-x86-64-linux-gnu (2.43.50.20241126-2ubuntu1) ... 89s Setting up ubuntu-minimal (1.544) ... 89s Setting up binutils (2.43.50.20241126-2ubuntu1) ... 89s Setting up python3-software-properties (0.105) ... 89s Processing triggers for debianutils (5.21) ... 89s Processing triggers for install-info (7.1.1-1) ... 89s Processing triggers for initramfs-tools (0.142ubuntu35) ... 89s update-initramfs: Generating /boot/initrd.img-6.11.0-8-generic 89s W: No lz4 in /usr/bin:/sbin:/bin, using gzip 98s Processing triggers for libc-bin (2.40-1ubuntu3) ... 98s Processing triggers for rsyslog (8.2406.0-1ubuntu2) ... 99s Processing triggers for ufw (0.36.2-8) ... 99s Processing triggers for man-db (2.13.0-1) ... 100s Setting up plymouth-theme-ubuntu-text (24.004.60-2ubuntu4) ... 100s Processing triggers for dbus (1.14.10-4ubuntu5) ... 100s Processing triggers for sgml-base (1.31) ... 100s Setting up polkitd (125-2ubuntu1) ... 101s Setting up packagekit (1.3.0-2) ... 101s Created symlink '/etc/systemd/user/sockets.target.wants/pk-debconf-helper.socket' → '/usr/lib/systemd/user/pk-debconf-helper.socket'. 101s Setting up packagekit-tools (1.3.0-2) ... 101s Setting up software-properties-common (0.105) ... 101s Processing triggers for initramfs-tools (0.142ubuntu35) ... 101s update-initramfs: Generating /boot/initrd.img-6.11.0-8-generic 101s W: No lz4 in /usr/bin:/sbin:/bin, using gzip 109s Processing triggers for dbus (1.14.10-4ubuntu5) ... 110s Reading package lists... 110s Building dependency tree... 110s Reading state information... 111s The following packages will be REMOVED: 111s libsgutils2-1.46-2* 111s 0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded. 111s After this operation, 294 kB disk space will be freed. 111s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75996 files and directories currently installed.) 111s Removing libsgutils2-1.46-2:amd64 (1.46-3ubuntu5) ... 111s Processing triggers for libc-bin (2.40-1ubuntu3) ... 111s Reading package lists... 112s Building dependency tree... 112s Reading state information... 112s The following packages will be REMOVED: 112s python3-distro-info* unattended-upgrades* 112s 0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded. 112s After this operation, 465 kB disk space will be freed. 112s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75991 files and directories currently installed.) 112s Removing unattended-upgrades (2.9.1+nmu4ubuntu1) ... 112s Removing python3-distro-info (1.12) ... 112s Processing triggers for man-db (2.13.0-1) ... 113s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75954 files and directories currently installed.) 113s Purging configuration files for unattended-upgrades (2.9.1+nmu4ubuntu1) ... 114s dpkg: warning: while removing unattended-upgrades, directory '/var/log/unattended-upgrades' not empty so not removed 114s dpkg: warning: while removing unattended-upgrades, directory '/lib/systemd/system-sleep' not empty so not removed 114s Hit:1 http://ftpmaster.internal/ubuntu plucky-proposed InRelease 114s Hit:2 http://ftpmaster.internal/ubuntu plucky InRelease 114s Hit:3 http://ftpmaster.internal/ubuntu plucky-updates InRelease 115s Hit:4 http://ftpmaster.internal/ubuntu plucky-security InRelease 115s Reading package lists... 115s Reading package lists... 116s Building dependency tree... 116s Reading state information... 116s Calculating upgrade... 116s 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 116s Reading package lists... 116s Building dependency tree... 116s Reading state information... 116s 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 116s autopkgtest [20:41:22]: rebooting testbed after setup commands that affected boot 134s autopkgtest [20:41:40]: testbed running kernel: Linux 6.11.0-8-generic #8-Ubuntu SMP PREEMPT_DYNAMIC Mon Sep 16 13:41:20 UTC 2024 137s autopkgtest [20:41:43]: @@@@@@@@@@@@@@@@@@@@ apt-source chkrootkit 139s Get:1 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (dsc) [1407 B] 139s Get:2 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (tar) [43.0 kB] 139s Get:3 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (diff) [97.1 kB] 139s gpgv: Signature made Mon Sep 30 14:15:58 2024 UTC 139s gpgv: using EDDSA key A3CC9C870B9D310ABAD4CF2F51722B08FE4745A2 139s gpgv: Can't check signature: No public key 139s dpkg-source: warning: cannot verify inline signature for ./chkrootkit_0.58b-3.dsc: no acceptable signature found 139s autopkgtest [20:41:45]: testing package chkrootkit version 0.58b-3 140s autopkgtest [20:41:46]: build not needed 140s autopkgtest [20:41:46]: test test-chkrootkit: preparing testbed 141s Reading package lists... 142s Building dependency tree... 142s Reading state information... 142s Starting pkgProblemResolver with broken count: 0 142s Starting 2 pkgProblemResolver with broken count: 0 142s Done 143s The following additional packages will be installed: 143s chkrootkit net-tools 143s Recommended packages: 143s default-mta | mail-transport-agent mailx 143s The following NEW packages will be installed: 143s autopkgtest-satdep chkrootkit net-tools 143s 0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded. 143s Need to get 564 kB/564 kB of archives. 143s After this operation, 1854 kB of additional disk space will be used. 143s Get:1 /tmp/autopkgtest.fRYZGo/1-autopkgtest-satdep.deb autopkgtest-satdep amd64 0 [736 B] 143s Get:2 http://ftpmaster.internal/ubuntu plucky/universe amd64 chkrootkit amd64 0.58b-3 [360 kB] 143s Get:3 http://ftpmaster.internal/ubuntu plucky/main amd64 net-tools amd64 2.10-1.1ubuntu1 [204 kB] 144s Fetched 564 kB in 0s (1157 kB/s) 144s Selecting previously unselected package chkrootkit. 144s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 75947 files and directories currently installed.) 144s Preparing to unpack .../chkrootkit_0.58b-3_amd64.deb ... 144s Unpacking chkrootkit (0.58b-3) ... 144s Selecting previously unselected package net-tools. 144s Preparing to unpack .../net-tools_2.10-1.1ubuntu1_amd64.deb ... 144s Unpacking net-tools (2.10-1.1ubuntu1) ... 144s Selecting previously unselected package autopkgtest-satdep. 144s Preparing to unpack .../1-autopkgtest-satdep.deb ... 144s Unpacking autopkgtest-satdep (0) ... 144s Setting up net-tools (2.10-1.1ubuntu1) ... 144s Setting up chkrootkit (0.58b-3) ... 144s Created symlink '/etc/systemd/system/timers.target.wants/chkrootkit.timer' → '/usr/lib/systemd/system/chkrootkit.timer'. 144s Setting up autopkgtest-satdep (0) ... 144s Processing triggers for man-db (2.13.0-1) ... 148s (Reading database ... 76031 files and directories currently installed.) 148s Removing autopkgtest-satdep (0) ... 148s autopkgtest [20:41:54]: test test-chkrootkit: [----------------------- 149s copy: awk from /usr/bin/gawk to /tmp/clean 149s copy: cut from /usr/bin/cut to /tmp/clean 149s copy: echo from /usr/bin/echo to /tmp/clean 149s copy: grep from /usr/bin/grep to /tmp/clean 149s copy: find from /usr/bin/find to /tmp/clean 149s copy: head from /usr/bin/head to /tmp/clean 149s copy: id from /usr/bin/id to /tmp/clean 149s copy: ls from /usr/bin/ls to /tmp/clean 149s copy: ps from /usr/bin/ps to /tmp/clean 149s copy: sed from /usr/bin/sed to /tmp/clean 149s copy: strings from /usr/bin/x86_64-linux-gnu-strings to /tmp/clean 149s copy: uname from /usr/bin/uname to /tmp/clean 149s copy: ss from /usr/bin/ss to /tmp/clean 149s copy: netstat from /usr/bin/netstat to /tmp/clean 149s copy: dirname from /usr/bin/dirname to /tmp/clean 149s copy: xargs from /usr/bin/xargs to /tmp/clean 149s copy: dpkg-query from /usr/bin/dpkg-query to /tmp/clean 149s total 2316 149s drwxr-xr-x 2 root root 4096 Nov 26 20:41 . 149s drwxrwxrwt 13 root root 4096 Nov 26 20:41 .. 149s -rwxr-xr-x 1 root root 739840 Mar 31 2024 awk 149s -rwxr-xr-x 1 root root 43608 Jul 31 15:24 cut 149s -rwxr-xr-x 1 root root 35288 Jul 31 15:24 dirname 149s -rwxr-xr-x 1 root root 158552 Oct 29 08:03 dpkg-query 149s -rwxr-xr-x 1 root root 35288 Jul 31 15:24 echo 149s -rwxr-xr-x 1 root root 212536 Aug 10 08:47 find 149s -rwxr-xr-x 1 root root 186824 Apr 8 2024 grep 149s -rwxr-xr-x 1 root root 43608 Jul 31 15:24 head 149s -rwxr-xr-x 1 root root 43608 Jul 31 15:24 id 149s -rwxr-xr-x 1 root root 146488 Jul 31 15:24 ls 149s -rwxr-xr-x 1 root root 158304 May 22 2024 netstat 149s -rwxr-xr-x 1 root root 146504 Sep 12 12:34 ps 149s -rwxr-xr-x 1 root root 113224 Apr 8 2024 sed 149s -rwxr-xr-x 1 root root 136120 Oct 10 13:19 ss 149s -rwxr-xr-x 1 root root 35520 Nov 26 15:44 strings 149s -rwxr-xr-x 1 root root 35416 Jul 31 15:24 uname 149s -rwxr-xr-x 1 root root 68088 Aug 10 08:47 xargs 149s * Running test-chkrootkit (from: /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests)... 149s ** env 149s SHELL=/bin/bash 149s SUDO_GID=1000 149s AUTOPKGTEST_TESTBED_ARCH=amd64 149s no_proxy=127.0.0.1,127.0.1.1,login.ubuntu.com,localhost,localdomain,novalocal,internal,archive.ubuntu.com,ports.ubuntu.com,security.ubuntu.com,ddebs.ubuntu.com,changelogs.ubuntu.com,keyserver.ubuntu.com,launchpadlibrarian.net,launchpadcontent.net,launchpad.net,10.24.0.0/24,keystone.ps5.canonical.com,objectstorage.prodstack5.canonical.com 149s AUTOPKGTEST_NORMAL_USER=ubuntu 149s AUTOPKGTEST_TMP=/tmp/autopkgtest.fRYZGo/autopkgtest_tmp 149s SUDO_COMMAND=/var/tmp/autopkgtest-run-wrapper su -s /bin/bash root -c set -e; exec /tmp/autopkgtest.fRYZGo/wrapper.sh --artifacts=/tmp/autopkgtest.fRYZGo/test-chkrootkit-artifacts --chdir=/tmp/autopkgtest.fRYZGo/build.TMx/src --env=AUTOPKGTEST_TESTBED_ARCH=amd64 --env=AUTOPKGTEST_TEST_ARCH=amd64 --env=DEB_BUILD_OPTIONS=parallel=2 --env=DEBIAN_FRONTEND=noninteractive --env=LANG=C.UTF-8 --unset-env=LANGUAGE --unset-env=LC_ADDRESS --unset-env=LC_ALL --unset-env=LC_COLLATE --unset-env=LC_CTYPE --unset-env=LC_IDENTIFICATION --unset-env=LC_MEASUREMENT --unset-env=LC_MESSAGES --unset-env=LC_MONETARY --unset-env=LC_NAME --unset-env=LC_NUMERIC --unset-env=LC_PAPER --unset-env=LC_TELEPHONE --unset-env=LC_TIME --script-pid-file=/tmp/autopkgtest_script_pid --source-profile --stderr=/tmp/autopkgtest.fRYZGo/test-chkrootkit-stderr --stdout=/tmp/autopkgtest.fRYZGo/test-chkrootkit-stdout --tmp=/tmp/autopkgtest.fRYZGo/autopkgtest_tmp --env=AUTOPKGTEST_NORMAL_USER=ubuntu --env=ADT_NORMAL_USER=ubuntu '--env=ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1' --make-executable=/tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit -- /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit 149s SUDO_USER=ubuntu 149s PWD=/tmp/autopkgtest.fRYZGo/build.TMx/src 149s ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1 149s LOGNAME=root 149s HOME=/root 149s LANG=C.UTF-8 149s ADTTMP=/tmp/autopkgtest.fRYZGo/autopkgtest_tmp 149s https_proxy=http://squid.internal:3128 149s AUTOPKGTEST_ARTIFACTS=/tmp/autopkgtest.fRYZGo/test-chkrootkit-artifacts 149s TERM=linux 149s USER=root 149s AUTOPKGTEST_TEST_ARCH=amd64 149s DEB_BUILD_OPTIONS=parallel=2 149s SHLVL=2 149s ADT_NORMAL_USER=ubuntu 149s http_proxy=http://squid.internal:3128 149s ADT_ARTIFACTS=/tmp/autopkgtest.fRYZGo/test-chkrootkit-artifacts 149s PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin 149s SUDO_UID=1000 149s MAIL=/var/mail/root 149s DEBIAN_FRONTEND=noninteractive 149s OLDPWD=/home/ubuntu 149s _=/usr/bin/env 149s MY_BUILD_DIR=/tmp/autopkgtest.fRYZGo 149s ** other info 149s ls /var/run/utmp 149s -rw-rw-r-- 1 root utmp 1536 Nov 26 20:41 /var/run/utmp 149s ls /var/log/wtmp 149s -rw-rw-r-- 1 root utmp 102528 Nov 26 20:41 /var/log/wtmp 149s ls /var/log/lastlog 149s -rw-rw-r-- 1 root utmp 0 Oct 29 18:44 /var/log/lastlog 149s * Setting up the testsuite 149s ** README 149s The purpose of this tests is to check that the actual output is as we expect. 149s 149s This tests that both chkrootkit (directly invoked) and its chkrootkit-daily 149s (systemd timer/cronjob) work with various combinations of options. 149s 149s - Each test has a file listing regexps: each listed regexp must match 149s against the output or the test will fail: the 'fix' will often be 149s to update the .expected file 149s - (these are in debian/test/*.expected) 149s - Output not matched by any such regexp is listed (with some known 149s exceptions removed), but does not cause failure 149s - This testsuite is designed to run in a sbuild schroot or via the CI 149s pipeline on salsa.debian.org: you might need to adjust the 149s debian/test/*.expected files if running in some other way. 149s 149s ** Ensuring chkrootkit finds as much to test as we can 149s Making /usr/sbin/amd 149s Making /etc/amd.conf 149s Making /usr/sbin/biff 149s Making /etc/biff.conf 149s /usr/sbin/cron: exists; mv to .orig 149s Making /etc/cron.conf 149s /usr/bin/crontab: exists; mv to .orig 149s Making /etc/crontab.conf 149s Making /usr/sbin/fingerd 149s Making /etc/fingerd.conf 149s Making /usr/sbin/in.fingerd 149s Making /etc/in.fingerd.conf 149s Making /usr/sbin/gpm 149s Making /etc/gpm.conf 149s /usr/sbin/hdparm: exists; mv to .orig 149s /etc/hdparm.conf: exists; mv to .orig 149s Making /usr/sbin/inetd 149s Making /etc/inetd.conf 149s Making /usr/sbin/in.identd 149s Making /etc/in.identd.conf 149s Making /usr/sbin/inetdconf 149s Making /etc/inetdconf.conf 149s /usr/lib/systemd/systemd: exists; mv to .orig 149s Making /etc/init.conf 149s /usr/bin/killall: exists; mv to .orig 149s Making /etc/killall.conf 149s /usr/bin/lsof: exists; mv to .orig 149s Making /etc/lsof.conf 149s Making /usr/sbin/mail 149s Making /etc/mail.conf 149s Making /usr/sbin/mingetty 149s Making /etc/mingetty.conf 149s Making /usr/sbin/named 149s Making /etc/named.conf 149s Making /usr/sbin/in.pop2d 149s Making /etc/in.pop2d.conf 149s Making /usr/sbin/in.pop3d 149s Making /etc/in.pop3d.conf 149s /usr/bin/write: exists; mv to .orig 149s Making /etc/write.conf 149s /usr/bin/pstree: exists; mv to .orig 149s Making /etc/pstree.conf 149s Making /usr/sbin/rpcinfo 149s Making /etc/rpcinfo.conf 149s Making /usr/sbin/rlogind 149s Making /etc/rlogind.conf 149s Making /usr/sbin/in.rshd 149s Making /etc/in.rshd.conf 149s /usr/bin/ssh: exists; mv to .orig 149s Making /etc/slogin.conf 149s Making /usr/sbin/sendmail 149s Making /etc/sendmail.conf 149s /usr/sbin/sshd: exists; mv to .orig 149s Making /etc/sshd.conf 149s Making /usr/sbin/syslogd 149s Making /etc/syslogd.conf 149s Making /usr/sbin/tcpd 149s Making /etc/tcpd.conf 149s /usr/bin/tcpdump: exists; mv to .orig 149s Making /etc/tcpdump.conf 149s Making /usr/sbin/telnetd 149s Making /etc/telnetd.conf 149s Making /usr/sbin/timed 149s Making /etc/timed.conf 149s Making /usr/sbin/traceroute 149s Making /etc/traceroute.conf 149s MADE: /usr/sbin/amd /etc/amd.conf /usr/sbin/biff /etc/biff.conf /etc/cron.conf /etc/crontab.conf /usr/sbin/fingerd /etc/fingerd.conf /usr/sbin/in.fingerd /etc/in.fingerd.conf /usr/sbin/gpm /etc/gpm.conf /usr/sbin/inetd /etc/inetd.conf /usr/sbin/in.identd /etc/in.identd.conf /usr/sbin/inetdconf /etc/inetdconf.conf /etc/init.conf /etc/killall.conf /etc/lsof.conf /usr/sbin/mail /etc/mail.conf /usr/sbin/mingetty /etc/mingetty.conf /usr/sbin/named /etc/named.conf /usr/sbin/in.pop2d /etc/in.pop2d.conf /usr/sbin/in.pop3d /etc/in.pop3d.conf /etc/write.conf /etc/pstree.conf /usr/sbin/rpcinfo /etc/rpcinfo.conf /usr/sbin/rlogind /etc/rlogind.conf /usr/sbin/in.rshd /etc/in.rshd.conf /etc/slogin.conf /usr/sbin/sendmail /etc/sendmail.conf /etc/sshd.conf /usr/sbin/syslogd /etc/syslogd.conf /usr/sbin/tcpd /etc/tcpd.conf /etc/tcpdump.conf /usr/sbin/telnetd /etc/telnetd.conf /usr/sbin/timed /etc/timed.conf /usr/sbin/traceroute /etc/traceroute.conf 149s MOVED to .orig: /usr/sbin/amd /etc/amd.conf /usr/sbin/biff /etc/biff.conf /etc/cron.conf /etc/crontab.conf /usr/sbin/fingerd /etc/fingerd.conf /usr/sbin/in.fingerd /etc/in.fingerd.conf /usr/sbin/gpm /etc/gpm.conf /usr/sbin/inetd /etc/inetd.conf /usr/sbin/in.identd /etc/in.identd.conf /usr/sbin/inetdconf /etc/inetdconf.conf /etc/init.conf /etc/killall.conf /etc/lsof.conf /usr/sbin/mail /etc/mail.conf /usr/sbin/mingetty /etc/mingetty.conf /usr/sbin/named /etc/named.conf /usr/sbin/in.pop2d /etc/in.pop2d.conf /usr/sbin/in.pop3d /etc/in.pop3d.conf /etc/write.conf /etc/pstree.conf /usr/sbin/rpcinfo /etc/rpcinfo.conf /usr/sbin/rlogind /etc/rlogind.conf /usr/sbin/in.rshd /etc/in.rshd.conf /etc/slogin.conf /usr/sbin/sendmail /etc/sendmail.conf /etc/sshd.conf /usr/sbin/syslogd /etc/syslogd.conf /usr/sbin/tcpd /etc/tcpd.conf /etc/tcpdump.conf /usr/sbin/telnetd /etc/telnetd.conf /usr/sbin/timed /etc/timed.conf /usr/sbin/traceroute /etc/traceroute.conf 149s Done 149s Preserving existing /etc/chkrootkit/chkrootkit.conf as /etc/chkrootkit/chkrootkit.conf.orig 149s Preserving existing /etc/chkrootkit/chkrootkit.ignore as /etc/chkrootkit/chkrootkit.ignore.orig 149s * Testing: the main binary 149s ** Testing: chkrootkit-0-full (/usr/sbin/chkrootkit) ... 149s *** Output 149s ROOTDIR is `/' 149s Checking `amd'... not infected 149s Checking `basename'... not infected 149s Checking `biff'... not infected 149s Checking `chfn'... not infected 149s Checking `chsh'... not infected 149s Checking `cron'... not infected 149s Checking `crontab'... not infected 149s Checking `date'... not infected 149s Checking `du'... not infected 149s Checking `dirname'... not infected 149s Checking `echo'... not infected 149s Checking `egrep'... not infected 149s Checking `env'... not infected 149s Checking `find'... not infected 149s Checking `fingerd'... not infected 149s Checking `gpm'... not infected 149s Checking `grep'... not infected 149s Checking `hdparm'... not infected 149s Checking `su'... not infected 149s Checking `ifconfig'... not infected 149s Checking `inetd'... not infected 149s Checking `inetdconf'... not infected 149s Checking `identd'... not infected 149s Checking `init'... not infected 149s Checking `killall'... not infected 149s Checking `ldsopreload'... not infected 149s Checking `login'... not infected 149s Checking `ls'... not infected 149s Checking `lsof'... not infected 149s Checking `mail'... not infected 149s Checking `mingetty'... not infected 149s Checking `netstat'... not infected 149s Checking `named'... not infected 149s Checking `passwd'... not infected 149s Checking `pidof'... not infected 149s Checking `pop2'... not infected 149s Checking `pop3'... not infected 149s Checking `ps'... not infected 149s Checking `pstree'... not infected 149s Checking `rpcinfo'... not infected 149s Checking `rlogind'... not infected 149s Checking `rshd'... not infected 149s Checking `slogin'... not infected 149s Checking `sendmail'... not infected 149s Checking `sshd'... not infected 149s Checking `syslogd'... not infected 149s Checking `tar'... not infected 149s Checking `tcpd'... not infected 149s Checking `tcpdump'... not infected 149s Checking `top'... not infected 149s Checking `telnetd'... not infected 149s Checking `timed'... not infected 149s Checking `traceroute'... not infected 149s Checking `vdir'... not infected 149s Checking `w'... not infected 149s Checking `write'... not infected 150s Checking `aliens'... started 150s Searching for suspicious files in /dev... not found 150s Searching for known suspicious directories... not found 150s Searching for known suspicious files... not found 150s Searching for sniffer's logs... not found 150s Searching for HiDrootkit rootkit... not found 150s Searching for t0rn rootkit... not found 150s Searching for t0rn v8 (or variation)... not found 150s Searching for Lion rootkit... not found 150s Searching for RSHA rootkit... not found 150s Searching for RH-Sharpe rootkit... not found 150s Searching for Ambient (ark) rootkit... not found 150s Searching for suspicious files and dirs... WARNING 150s 150s WARNING: The following suspicious files and directories were found: 150s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 150s 150s Searching for LPD Worm... not found 150s Searching for Ramen Worm rootkit... not found 150s Searching for Maniac rootkit... not found 150s Searching for RK17 rootkit... not found 151s Searching for Ducoci rootkit... not found 151s Searching for Adore Worm... not found 151s Searching for ShitC Worm... not found 151s Searching for Omega Worm... not found 151s Searching for Sadmind/IIS Worm... not found 151s Searching for MonKit... not found 151s Searching for Showtee rootkit... not found 151s Searching for OpticKit... not found 151s Searching for T.R.K... not found 151s Searching for Mithra rootkit... not found 151s Searching for OBSD rootkit v1... not tested 151s Searching for LOC rootkit... not found 151s Searching for Romanian rootkit... not found 151s Searching for HKRK rootkit... not found 151s Searching for Suckit rootkit... not found 151s Searching for Volc rootkit... not found 151s Searching for Gold2 rootkit... not found 151s Searching for TC2 rootkit... not found 151s Searching for Anonoying rootkit... not found 151s Searching for ZK rootkit... not found 151s Searching for ShKit rootkit... not found 151s Searching for AjaKit rootkit... not found 151s Searching for zaRwT rootkit... not found 151s Searching for Madalin rootkit... not found 151s Searching for Fu rootkit... not found 151s Searching for Kenga3 rootkit... not found 151s Searching for ESRK rootkit... not found 151s Searching for rootedoor... not found 151s Searching for ENYELKM rootkit... not found 151s Searching for common ssh-scanners... not found 151s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 151s Searching for Linux/Ebury 1.6... not found 151s Searching for 64-bit Linux Rootkit... not found 151s Searching for 64-bit Linux Rootkit modules... not found 151s Searching for Mumblehard... not found 151s Searching for Backdoor.Linux.Mokes.a... not found 151s Searching for Malicious TinyDNS... not found 154s Searching for Linux.Xor.DDoS... WARNING 154s 154s WARNING: Possible Linux.Xor.DDoS installed: 154s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 154s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 154s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 154s /tmp/clean/sed [Not from a Debian package] 154s /tmp/clean/ls [Not from a Debian package] 154s /tmp/clean/id [Not from a Debian package] 154s /tmp/clean/uname [Not from a Debian package] 154s /tmp/clean/awk [Not from a Debian package] 154s /tmp/clean/head [Not from a Debian package] 154s /tmp/clean/strings [Not from a Debian package] 154s /tmp/clean/cut [Not from a Debian package] 154s /tmp/clean/netstat [Not from a Debian package] 154s /tmp/clean/ss [Not from a Debian package] 154s /tmp/clean/find [Not from a Debian package] 154s /tmp/clean/ps [Not from a Debian package] 154s /tmp/clean/xargs [Not from a Debian package] 154s /tmp/clean/dpkg-query [Not from a Debian package] 154s /tmp/clean/dirname [Not from a Debian package] 154s /tmp/clean/echo [Not from a Debian package] 154s /tmp/clean/grep [Not from a Debian package] 154s 154s Searching for Linux.Proxy.1.0... not found 154s Searching for CrossRAT... not found 154s Searching for Hidden Cobra... not found 154s Searching for Rocke Miner rootkit... not found 154s Searching for PWNLNX4 lkm rootkit... not found 154s Searching for PWNLNX6 lkm rootkit... not found 154s Searching for Umbreon lrk... not found 154s Searching for Kinsing.a backdoor rootkit... not found 154s Searching for RotaJakiro backdoor rootkit... not found 154s Searching for Syslogk LKM rootkit... not found 154s Searching for Kovid LKM rootkit... not tested 154s Searching for Tsunami DDoS Malware rootkit... not found 154s Searching for Linux BPF Door... not found 155s Searching for suspect PHP files... not found 155s Searching for zero-size shell history files in /root... not found 155s Searching for hardlinked shell history files in /root... not found 155s Checking `aliens'... finished 155s Checking `asp'... not infected 155s Checking `bindshell'... not found 155s Checking `lkm'... started 155s Searching for Adore LKM... not tested 155s Searching for sebek LKM (Adore based)... not tested 155s Searching for knark LKM rootkit... not found 167s Searching for for hidden processes with chkproc... not found 167s Searching for for hidden directories using chkdirs... not found 167s Checking `lkm'... finished 167s Checking `rexedcs'... not found 167s Checking `sniffer'... WARNING 167s 167s WARNING: Output from ifpromisc: 167s lo: not promisc and no packet sniffer sockets 167s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 167s 167s Checking `w55808'... not found 167s Checking `wted'... not found 167s Checking `scalper'... not found 167s Checking `slapper'... not found 167s Checking `z2'... not found 167s Checking `chkutmp'... not found 167s Checking `OSX_RSPLUG'... not tested 167s **** Files in log 167s total 8.0K 167s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 167s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 167s *** Test of content of output follows... 167s **** Test for '^ROOTDIR is `/'$' 167s ROOTDIR is `/' 167s OK 167s **** Test for '^Checking `amd'\.\.\. not infected$' 167s Checking `amd'... not infected 167s OK 167s **** Test for '^Checking `basename'\.\.\. not infected$' 167s Checking `basename'... not infected 167s OK 167s **** Test for '^Checking `biff'\.\.\. not infected$' 167s Checking `biff'... not infected 167s OK 167s **** Test for '^Checking `chfn'\.\.\. not infected$' 167s Checking `chfn'... not infected 167s OK 167s **** Test for '^Checking `chsh'\.\.\. not infected$' 167s Checking `chsh'... not infected 167s OK 167s **** Test for '^Checking `cron'\.\.\. not infected$' 167s Checking `cron'... not infected 167s OK 167s **** Test for '^Checking `crontab'\.\.\. not infected$' 167s Checking `crontab'... not infected 167s OK 167s **** Test for '^Checking `date'\.\.\. not infected$' 167s Checking `date'... not infected 167s OK 167s **** Test for '^Checking `du'\.\.\. not infected$' 167s Checking `du'... not infected 167s OK 167s **** Test for '^Checking `dirname'\.\.\. not infected$' 167s Checking `dirname'... not infected 167s OK 167s **** Test for '^Checking `echo'\.\.\. not infected$' 167s Checking `echo'... not infected 167s OK 167s **** Test for '^Checking `egrep'\.\.\. not infected$' 167s Checking `egrep'... not infected 167s OK 167s **** Test for '^Checking `env'\.\.\. not infected$' 167s Checking `env'... not infected 167s OK 167s **** Test for '^Checking `find'\.\.\. not infected$' 167s Checking `find'... not infected 167s OK 167s **** Test for '^Checking `fingerd'\.\.\. not infected$' 167s Checking `fingerd'... not infected 167s OK 167s **** Test for '^Checking `gpm'\.\.\. not infected$' 167s Checking `gpm'... not infected 167s OK 167s **** Test for '^Checking `grep'\.\.\. not infected$' 167s Checking `grep'... not infected 167s OK 167s **** Test for '^Checking `hdparm'\.\.\. not infected$' 167s Checking `hdparm'... not infected 167s OK 167s **** Test for '^Checking `su'\.\.\. not infected$' 167s Checking `su'... not infected 167s OK 167s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 167s Checking `ifconfig'... not infected 167s OK 167s **** Test for '^Checking `inetd'\.\.\. not infected$' 167s Checking `inetd'... not infected 167s OK 167s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 167s Checking `inetdconf'... not infected 167s OK 167s **** Test for '^Checking `identd'\.\.\. not infected$' 167s Checking `identd'... not infected 167s OK 167s **** Test for '^Checking `init'\.\.\. not infected$' 167s Checking `init'... not infected 167s OK 167s **** Test for '^Checking `killall'\.\.\. not infected$' 167s Checking `killall'... not infected 167s OK 167s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 167s Checking `ldsopreload'... not infected 167s OK 167s **** Test for '^Checking `login'\.\.\. not infected$' 167s Checking `login'... not infected 167s OK 167s **** Test for '^Checking `ls'\.\.\. not infected$' 167s Checking `ls'... not infected 167s OK 167s **** Test for '^Checking `lsof'\.\.\. not infected$' 167s Checking `lsof'... not infected 167s OK 167s **** Test for '^Checking `mail'\.\.\. not infected$' 167s Checking `mail'... not infected 167s OK 167s **** Test for '^Checking `mingetty'\.\.\. not infected$' 167s Checking `mingetty'... not infected 167s OK 167s **** Test for '^Checking `netstat'\.\.\. not infected$' 167s Checking `netstat'... not infected 167s OK 167s **** Test for '^Checking `named'\.\.\. not infected$' 167s Checking `named'... not infected 167s OK 167s **** Test for '^Checking `passwd'\.\.\. not infected$' 167s Checking `passwd'... not infected 167s OK 167s **** Test for '^Checking `pidof'\.\.\. not infected$' 167s Checking `pidof'... not infected 167s OK 167s **** Test for '^Checking `pop2'\.\.\. not infected$' 167s Checking `pop2'... not infected 167s OK 167s **** Test for '^Checking `pop3'\.\.\. not infected$' 167s Checking `pop3'... not infected 167s OK 167s **** Test for '^Checking `ps'\.\.\. not infected$' 167s Checking `ps'... not infected 167s OK 167s **** Test for '^Checking `pstree'\.\.\. not infected$' 167s Checking `pstree'... not infected 167s OK 167s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 167s Checking `rpcinfo'... not infected 167s OK 167s **** Test for '^Checking `rlogind'\.\.\. not infected$' 167s Checking `rlogind'... not infected 167s OK 167s **** Test for '^Checking `rshd'\.\.\. not infected$' 167s Checking `rshd'... not infected 167s OK 167s **** Test for '^Checking `slogin'\.\.\. not infected$' 167s Checking `slogin'... not infected 167s OK 167s **** Test for '^Checking `sendmail'\.\.\. not infected$' 167s Checking `sendmail'... not infected 167s OK 167s **** Test for '^Checking `sshd'\.\.\. not infected$' 167s Checking `sshd'... not infected 167s OK 167s **** Test for '^Checking `syslogd'\.\.\. not infected$' 167s Checking `syslogd'... not infected 167s OK 167s **** Test for '^Checking `tar'\.\.\. not infected$' 167s Checking `tar'... not infected 167s OK 167s **** Test for '^Checking `tcpd'\.\.\. not infected$' 167s Checking `tcpd'... not infected 167s OK 167s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 167s Checking `tcpdump'... not infected 167s OK 167s **** Test for '^Checking `top'\.\.\. not infected$' 167s Checking `top'... not infected 167s OK 167s **** Test for '^Checking `telnetd'\.\.\. not infected$' 167s Checking `telnetd'... not infected 167s OK 167s **** Test for '^Checking `timed'\.\.\. not infected$' 167s Checking `timed'... not infected 167s OK 167s **** Test for '^Checking `traceroute'\.\.\. not infected$' 167s Checking `traceroute'... not infected 167s OK 167s **** Test for '^Checking `vdir'\.\.\. not infected$' 167s Checking `vdir'... not infected 167s OK 167s **** Test for '^Checking `w'\.\.\. not infected$' 167s Checking `w'... not infected 167s OK 167s **** Test for '^Checking `write'\.\.\. not infected$' 167s Checking `write'... not infected 167s OK 167s **** Test for '^Checking `aliens'\.\.\. started$' 167s Checking `aliens'... started 167s OK 167s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 167s Searching for suspicious files in /dev... not found 167s OK 167s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 167s Searching for known suspicious directories... not found 167s OK 167s **** Test for '^Searching for known suspicious files\.\.\. not found$' 167s Searching for known suspicious files... not found 167s OK 167s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 167s Searching for sniffer's logs... not found 167s OK 167s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 167s Searching for HiDrootkit rootkit... not found 167s OK 167s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 167s Searching for t0rn rootkit... not found 167s OK 167s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 167s Searching for t0rn v8 (or variation)... not found 167s OK 167s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 167s Searching for Lion rootkit... not found 167s OK 167s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 167s Searching for RSHA rootkit... not found 167s OK 167s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 167s Searching for RH-Sharpe rootkit... not found 167s OK 167s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 167s Searching for Ambient (ark) rootkit... not found 167s OK 167s **** Test for '^Searching for suspicious files and dirs\.\.\. not found$' 167s 167s 167s **** Test for '^Searching for LPD Worm\.\.\. not found$' 167s Searching for LPD Worm... not found 167s OK 167s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 167s Searching for Ramen Worm rootkit... not found 167s OK 167s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 167s Searching for Maniac rootkit... not found 167s OK 167s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 167s Searching for RK17 rootkit... not found 167s OK 167s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 167s Searching for Ducoci rootkit... not found 167s OK 167s **** Test for '^Searching for Adore Worm\.\.\. not found$' 167s Searching for Adore Worm... not found 167s OK 167s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 167s Searching for ShitC Worm... not found 167s OK 167s **** Test for '^Searching for Omega Worm\.\.\. not found$' 167s Searching for Omega Worm... not found 167s OK 167s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 167s Searching for Sadmind/IIS Worm... not found 167s OK 167s **** Test for '^Searching for MonKit\.\.\. not found$' 167s Searching for MonKit... not found 167s OK 167s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 167s Searching for Showtee rootkit... not found 167s OK 167s **** Test for '^Searching for OpticKit\.\.\. not found$' 167s Searching for OpticKit... not found 167s OK 167s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 167s Searching for T.R.K... not found 167s OK 167s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 167s Searching for Mithra rootkit... not found 167s OK 167s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 167s Searching for OBSD rootkit v1... not tested 167s OK 167s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 167s Searching for LOC rootkit... not found 167s OK 167s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 167s Searching for Romanian rootkit... not found 167s OK 167s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 167s Searching for HKRK rootkit... not found 167s OK 167s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 167s Searching for Suckit rootkit... not found 167s OK 167s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 167s Searching for Volc rootkit... not found 167s OK 167s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 167s Searching for Gold2 rootkit... not found 167s OK 167s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 167s Searching for TC2 rootkit... not found 167s OK 167s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 167s Searching for Anonoying rootkit... not found 167s OK 167s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 167s Searching for ZK rootkit... not found 167s OK 167s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 167s Searching for ShKit rootkit... not found 167s OK 167s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 167s Searching for AjaKit rootkit... not found 167s OK 167s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 167s Searching for zaRwT rootkit... not found 167s OK 167s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 167s Searching for Madalin rootkit... not found 167s OK 167s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 167s Searching for Fu rootkit... not found 167s OK 167s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 167s Searching for Kenga3 rootkit... not found 167s OK 167s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 167s Searching for ESRK rootkit... not found 167s OK 167s **** Test for '^Searching for rootedoor\.\.\. not found$' 167s Searching for rootedoor... not found 167s OK 167s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 167s Searching for ENYELKM rootkit... not found 167s OK 167s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 167s Searching for common ssh-scanners... not found 167s OK 167s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 167s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 167s OK 167s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 167s Searching for Linux/Ebury 1.6... not found 167s OK 167s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 167s Searching for 64-bit Linux Rootkit... not found 167s OK 167s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 167s Searching for 64-bit Linux Rootkit modules... not found 167s OK 167s **** Test for '^Searching for Mumblehard\.\.\. not found$' 167s Searching for Mumblehard... not found 167s OK 167s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 167s Searching for Backdoor.Linux.Mokes.a... not found 167s OK 167s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 167s Searching for Malicious TinyDNS... not found 167s OK 167s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 167s Searching for Linux.Xor.DDoS... WARNING 167s OK 167s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 167s WARNING: Possible Linux.Xor.DDoS installed: 167s OK 167s **** Test for '^$' 167s 167s 167s 167s 167s 167s 167s OK 167s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 167s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 167s OK 167s **** Test for '^/tmp/clean/.+$' 167s /tmp/clean/sed [Not from a Debian package] 167s /tmp/clean/ls [Not from a Debian package] 167s /tmp/clean/id [Not from a Debian package] 167s /tmp/clean/uname [Not from a Debian package] 167s /tmp/clean/awk [Not from a Debian package] 167s /tmp/clean/head [Not from a Debian package] 167s /tmp/clean/strings [Not from a Debian package] 167s /tmp/clean/cut [Not from a Debian package] 167s /tmp/clean/netstat [Not from a Debian package] 167s /tmp/clean/ss [Not from a Debian package] 167s /tmp/clean/find [Not from a Debian package] 167s /tmp/clean/ps [Not from a Debian package] 167s /tmp/clean/xargs [Not from a Debian package] 167s /tmp/clean/dpkg-query [Not from a Debian package] 167s /tmp/clean/dirname [Not from a Debian package] 167s /tmp/clean/echo [Not from a Debian package] 167s /tmp/clean/grep [Not from a Debian package] 167s OK 167s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 167s Searching for Linux.Proxy.1.0... not found 167s OK 167s **** Test for '^Searching for CrossRAT\.\.\. not found$' 167s Searching for CrossRAT... not found 167s OK 167s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 167s Searching for Hidden Cobra... not found 167s OK 167s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 167s Searching for Rocke Miner rootkit... not found 167s OK 167s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 167s Searching for PWNLNX4 lkm rootkit... not found 167s OK 167s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 167s Searching for PWNLNX6 lkm rootkit... not found 167s OK 167s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 167s Searching for Umbreon lrk... not found 167s OK 167s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 167s Searching for Kinsing.a backdoor rootkit... not found 167s OK 167s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 167s Searching for RotaJakiro backdoor rootkit... not found 167s OK 167s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 167s Searching for Syslogk LKM rootkit... not found 167s OK 167s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 167s Searching for Kovid LKM rootkit... not tested 167s OK 167s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 167s Searching for Tsunami DDoS Malware rootkit... not found 167s OK 167s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 167s Searching for Linux BPF Door... not found 167s OK 167s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 167s Searching for suspect PHP files... not found 167s OK 167s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 167s Searching for zero-size shell history files in /root... not found 167s OK 167s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 167s Searching for hardlinked shell history files in /root... not found 167s OK 167s **** Test for '^Checking `aliens'\.\.\. finished$' 167s Checking `aliens'... finished 167s OK 167s **** Test for '^Checking `asp'\.\.\. not infected$' 167s Checking `asp'... not infected 167s OK 167s **** Test for '^Checking `bindshell'\.\.\. not found$' 167s Checking `bindshell'... not found 167s OK 167s **** Test for '^Checking `lkm'\.\.\. started$' 167s Checking `lkm'... started 167s OK 167s **** Test for '^Searching for Adore LKM\.\.\. not (tested|found)$' 167s Searching for Adore LKM... not tested 167s OK 167s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not (tested|found)$' 167s Searching for sebek LKM (Adore based)... not tested 167s OK 167s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 167s Searching for knark LKM rootkit... not found 167s OK 167s **** Test for '^Checking `lkm'\.\.\. finished$' 167s Checking `lkm'... finished 167s OK 167s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 167s Searching for for hidden processes with chkproc... not found 167s OK 167s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 167s Searching for for hidden directories using chkdirs... not found 167s OK 167s **** Test for '^Checking `rexedcs'\.\.\. not found$' 167s Checking `rexedcs'... not found 167s OK 167s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 167s Checking `sniffer'... WARNING 167s OK 167s **** Test for '^WARNING: Output from ifpromisc:$' 167s WARNING: Output from ifpromisc: 167s OK 167s **** Test for '^lo: not promisc and no packet sniffer sockets$' 167s lo: not promisc and no packet sniffer sockets 167s OK 167s **** Test for '^Checking `w55808'\.\.\. not found$' 167s Checking `w55808'... not found 167s OK 167s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 167s Checking `wted'... not found 167s OK 167s **** Test for '^Checking `scalper'\.\.\. not found$' 167s Checking `scalper'... not found 167s OK 167s **** Test for '^Checking `slapper'\.\.\. not found$' 167s Checking `slapper'... not found 167s OK 167s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 167s Checking `z2'... not found 167s OK 167s **** Test for '^Checking `chkutmp'\.\.\.' 167s Checking `chkutmp'... not found 167s OK 167s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 167s Checking `OSX_RSPLUG'... not tested 167s OK 167s ** FAIL: Testing: chkrootkit-0-full (/usr/sbin/chkrootkit) done: FAIL 167s *** FAIL was with config set to: 167s cat: /etc/chkrootkit/chkrootkit.conf: No such file or directory 167s total 20 167s drwxr-xr-x 2 root root 4096 Nov 26 20:41 . 167s drwxr-xr-x 94 root root 12288 Nov 26 20:41 .. 167s -rw-r--r-- 1 root root 4074 Sep 26 06:10 chkrootkit.conf.orig 167s -rw-r--r-- 1 root root 0 Sep 26 06:10 chkrootkit.ignore.orig 167s *** Reason(s) for failure follows 167s Result: FAIL 167s 167s Missing: ^Searching for suspicious files and dirs\.\.\. not found$ 167s *** Unexpected (unmatched) lines follow (for info): 167s Searching for suspicious files and dirs... WARNING 167s WARNING: The following suspicious files and directories were found: 167s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 167s ** Testing: chkrootkit-1-full (/usr/sbin/chkrootkit) ... 167s *** Output 167s ROOTDIR is `/' 167s Checking `amd'... not infected 167s Checking `basename'... not infected 167s Checking `biff'... not infected 167s Checking `chfn'... not infected 167s Checking `chsh'... not infected 167s Checking `cron'... not infected 167s Checking `crontab'... not infected 167s Checking `date'... not infected 167s Checking `du'... not infected 167s Checking `dirname'... not infected 167s Checking `echo'... not infected 167s Checking `egrep'... not infected 167s Checking `env'... not infected 167s Checking `find'... not infected 167s Checking `fingerd'... not infected 167s Checking `gpm'... not infected 167s Checking `grep'... not infected 167s Checking `hdparm'... not infected 167s Checking `su'... not infected 167s Checking `ifconfig'... not infected 167s Checking `inetd'... not infected 167s Checking `inetdconf'... not infected 167s Checking `identd'... not infected 167s Checking `init'... not infected 167s Checking `killall'... not infected 167s Checking `ldsopreload'... not infected 168s Checking `login'... not infected 168s Checking `ls'... not infected 168s Checking `lsof'... not infected 168s Checking `mail'... not infected 168s Checking `mingetty'... not infected 168s Checking `netstat'... not infected 168s Checking `named'... not infected 168s Checking `passwd'... not infected 168s Checking `pidof'... not infected 168s Checking `pop2'... not infected 168s Checking `pop3'... not infected 168s Checking `ps'... not infected 168s Checking `pstree'... not infected 168s Checking `rpcinfo'... not infected 168s Checking `rlogind'... not infected 168s Checking `rshd'... not infected 168s Checking `slogin'... not infected 168s Checking `sendmail'... not infected 168s Checking `sshd'... not infected 168s Checking `syslogd'... not infected 168s Checking `tar'... not infected 168s Checking `tcpd'... not infected 168s Checking `tcpdump'... not infected 168s Checking `top'... not infected 168s Checking `telnetd'... not infected 168s Checking `timed'... not infected 168s Checking `traceroute'... not infected 168s Checking `vdir'... not infected 168s Checking `w'... not infected 168s Checking `write'... not infected 168s Checking `aliens'... started 168s Searching for suspicious files in /dev... not found 168s Searching for known suspicious directories... not found 168s Searching for known suspicious files... not found 168s Searching for sniffer's logs... not found 168s Searching for HiDrootkit rootkit... not found 168s Searching for t0rn rootkit... not found 168s Searching for t0rn v8 (or variation)... not found 168s Searching for Lion rootkit... not found 168s Searching for RSHA rootkit... not found 168s Searching for RH-Sharpe rootkit... not found 168s Searching for Ambient (ark) rootkit... not found 168s Searching for suspicious files and dirs... WARNING 168s 168s WARNING: The following suspicious files and directories were found: 168s /usr/lib/... [Not from a Debian package] 168s /usr/lib/.DIR-aaa [Not from a Debian package] 168s /usr/lib/.1DIR [Not from a Debian package] 168s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 168s /usr/lib/.bbb [Not from a Debian package] 168s /usr/lib/...DIR [Not from a Debian package] 168s /usr/lib/.aaa [Not from a Debian package] 168s /usr/lib/.1 [Not from a Debian package] 168s 168s Searching for LPD Worm... not found 168s Searching for Ramen Worm rootkit... not found 168s Searching for Maniac rootkit... not found 168s Searching for RK17 rootkit... not found 168s Searching for Ducoci rootkit... not found 169s Searching for Adore Worm... not found 169s Searching for ShitC Worm... not found 169s Searching for Omega Worm... not found 169s Searching for Sadmind/IIS Worm... not found 169s Searching for MonKit... not found 169s Searching for Showtee rootkit... not found 169s Searching for OpticKit... not found 169s Searching for T.R.K... not found 169s Searching for Mithra rootkit... not found 169s Searching for OBSD rootkit v1... not tested 169s Searching for LOC rootkit... not found 169s Searching for Romanian rootkit... not found 169s Searching for HKRK rootkit... not found 169s Searching for Suckit rootkit... not found 169s Searching for Volc rootkit... not found 169s Searching for Gold2 rootkit... not found 169s Searching for TC2 rootkit... not found 169s Searching for Anonoying rootkit... not found 169s Searching for ZK rootkit... not found 169s Searching for ShKit rootkit... not found 169s Searching for AjaKit rootkit... not found 169s Searching for zaRwT rootkit... not found 169s Searching for Madalin rootkit... not found 169s Searching for Fu rootkit... not found 169s Searching for Kenga3 rootkit... not found 169s Searching for ESRK rootkit... not found 169s Searching for rootedoor... not found 169s Searching for ENYELKM rootkit... not found 169s Searching for common ssh-scanners... not found 169s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 169s Searching for Linux/Ebury 1.6... not found 169s Searching for 64-bit Linux Rootkit... not found 169s Searching for 64-bit Linux Rootkit modules... not found 169s Searching for Mumblehard... not found 169s Searching for Backdoor.Linux.Mokes.a... not found 169s Searching for Malicious TinyDNS... not found 172s Searching for Linux.Xor.DDoS... WARNING 172s 172s WARNING: Possible Linux.Xor.DDoS installed: 172s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 172s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 172s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 172s /tmp/clean/sed [Not from a Debian package] 172s /tmp/clean/ls [Not from a Debian package] 172s /tmp/clean/id [Not from a Debian package] 172s /tmp/clean/uname [Not from a Debian package] 172s /tmp/clean/awk [Not from a Debian package] 172s /tmp/clean/head [Not from a Debian package] 172s /tmp/clean/strings [Not from a Debian package] 172s /tmp/clean/cut [Not from a Debian package] 172s /tmp/clean/netstat [Not from a Debian package] 172s /tmp/clean/ss [Not from a Debian package] 172s /tmp/clean/find [Not from a Debian package] 172s /tmp/clean/ps [Not from a Debian package] 172s /tmp/clean/xargs [Not from a Debian package] 172s /tmp/clean/dpkg-query [Not from a Debian package] 172s /tmp/clean/dirname [Not from a Debian package] 172s /tmp/clean/echo [Not from a Debian package] 172s /tmp/clean/grep [Not from a Debian package] 172s 172s Searching for Linux.Proxy.1.0... not found 172s Searching for CrossRAT... not found 172s Searching for Hidden Cobra... not found 172s Searching for Rocke Miner rootkit... not found 172s Searching for PWNLNX4 lkm rootkit... not found 172s Searching for PWNLNX6 lkm rootkit... not found 172s Searching for Umbreon lrk... not found 172s Searching for Kinsing.a backdoor rootkit... not found 172s Searching for RotaJakiro backdoor rootkit... not found 172s Searching for Syslogk LKM rootkit... not found 172s Searching for Kovid LKM rootkit... not tested 172s Searching for Tsunami DDoS Malware rootkit... not found 172s Searching for Linux BPF Door... not found 173s Searching for suspect PHP files... not found 173s Searching for zero-size shell history files in /root... not found 173s Searching for hardlinked shell history files in /root... not found 173s Checking `aliens'... finished 173s Checking `asp'... not infected 173s Checking `bindshell'... not found 173s Checking `lkm'... started 173s Searching for Adore LKM... not tested 173s Searching for sebek LKM (Adore based)... not tested 173s Searching for knark LKM rootkit... not found 185s Searching for for hidden processes with chkproc... not found 185s Searching for for hidden directories using chkdirs... not found 185s Checking `lkm'... finished 185s Checking `rexedcs'... not found 185s Checking `sniffer'... WARNING 185s 185s WARNING: Output from ifpromisc: 185s lo: not promisc and no packet sniffer sockets 185s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 185s 185s Checking `w55808'... not found 185s Checking `wted'... not found 185s Checking `scalper'... not found 185s Checking `slapper'... not found 185s Checking `z2'... not found 185s Checking `chkutmp'... not found 185s Checking `OSX_RSPLUG'... not tested 185s **** Files in log 185s total 8.0K 185s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 185s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 185s *** Test of content of output follows... 185s **** Test for '^ROOTDIR is `/'$' 185s ROOTDIR is `/' 185s OK 185s **** Test for '^Checking `amd'\.\.\. not infected$' 185s Checking `amd'... not infected 185s OK 185s **** Test for '^Checking `basename'\.\.\. not infected$' 185s Checking `basename'... not infected 185s OK 185s **** Test for '^Checking `biff'\.\.\. not infected$' 185s Checking `biff'... not infected 185s OK 185s **** Test for '^Checking `chfn'\.\.\. not infected$' 185s Checking `chfn'... not infected 185s OK 185s **** Test for '^Checking `chsh'\.\.\. not infected$' 185s Checking `chsh'... not infected 185s OK 185s **** Test for '^Checking `cron'\.\.\. not infected$' 185s Checking `cron'... not infected 185s OK 185s **** Test for '^Checking `crontab'\.\.\. not infected$' 185s Checking `crontab'... not infected 185s OK 185s **** Test for '^Checking `date'\.\.\. not infected$' 185s Checking `date'... not infected 185s OK 185s **** Test for '^Checking `du'\.\.\. not infected$' 185s Checking `du'... not infected 185s OK 185s **** Test for '^Checking `dirname'\.\.\. not infected$' 185s Checking `dirname'... not infected 185s OK 185s **** Test for '^Checking `echo'\.\.\. not infected$' 185s Checking `echo'... not infected 185s OK 185s **** Test for '^Checking `egrep'\.\.\. not infected$' 185s Checking `egrep'... not infected 185s OK 185s **** Test for '^Checking `env'\.\.\. not infected$' 185s Checking `env'... not infected 185s OK 185s **** Test for '^Checking `find'\.\.\. not infected$' 185s Checking `find'... not infected 185s OK 185s **** Test for '^Checking `fingerd'\.\.\. not infected$' 185s Checking `fingerd'... not infected 185s OK 185s **** Test for '^Checking `gpm'\.\.\. not infected$' 185s Checking `gpm'... not infected 185s OK 185s **** Test for '^Checking `grep'\.\.\. not infected$' 185s Checking `grep'... not infected 185s OK 185s **** Test for '^Checking `hdparm'\.\.\. not infected$' 185s Checking `hdparm'... not infected 185s OK 185s **** Test for '^Checking `su'\.\.\. not infected$' 185s Checking `su'... not infected 185s OK 185s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 185s Checking `ifconfig'... not infected 185s OK 185s **** Test for '^Checking `inetd'\.\.\. not infected$' 185s Checking `inetd'... not infected 185s OK 185s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 185s Checking `inetdconf'... not infected 185s OK 185s **** Test for '^Checking `identd'\.\.\. not infected$' 185s Checking `identd'... not infected 185s OK 185s **** Test for '^Checking `init'\.\.\. not infected$' 185s Checking `init'... not infected 185s OK 185s **** Test for '^Checking `killall'\.\.\. not infected$' 185s Checking `killall'... not infected 185s OK 185s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 185s Checking `ldsopreload'... not infected 185s OK 185s **** Test for '^Checking `login'\.\.\. not infected$' 185s Checking `login'... not infected 185s OK 185s **** Test for '^Checking `ls'\.\.\. not infected$' 185s Checking `ls'... not infected 185s OK 185s **** Test for '^Checking `lsof'\.\.\. not infected$' 185s Checking `lsof'... not infected 185s OK 185s **** Test for '^Checking `mail'\.\.\. not infected$' 185s Checking `mail'... not infected 185s OK 185s **** Test for '^Checking `mingetty'\.\.\. not infected$' 185s Checking `mingetty'... not infected 185s OK 185s **** Test for '^Checking `netstat'\.\.\. not infected$' 185s Checking `netstat'... not infected 185s OK 185s **** Test for '^Checking `named'\.\.\. not infected$' 185s Checking `named'... not infected 185s OK 185s **** Test for '^Checking `passwd'\.\.\. not infected$' 185s Checking `passwd'... not infected 185s OK 185s **** Test for '^Checking `pidof'\.\.\. not infected$' 185s Checking `pidof'... not infected 185s OK 185s **** Test for '^Checking `pop2'\.\.\. not infected$' 185s Checking `pop2'... not infected 185s OK 185s **** Test for '^Checking `pop3'\.\.\. not infected$' 185s Checking `pop3'... not infected 185s OK 185s **** Test for '^Checking `ps'\.\.\. not infected$' 185s Checking `ps'... not infected 185s OK 185s **** Test for '^Checking `pstree'\.\.\. not infected$' 185s Checking `pstree'... not infected 185s OK 185s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 185s Checking `rpcinfo'... not infected 185s OK 185s **** Test for '^Checking `rlogind'\.\.\. not infected$' 185s Checking `rlogind'... not infected 185s OK 185s **** Test for '^Checking `rshd'\.\.\. not infected$' 185s Checking `rshd'... not infected 185s OK 185s **** Test for '^Checking `slogin'\.\.\. not infected$' 185s Checking `slogin'... not infected 185s OK 185s **** Test for '^Checking `sendmail'\.\.\. not infected$' 185s Checking `sendmail'... not infected 185s OK 185s **** Test for '^Checking `sshd'\.\.\. not infected$' 185s Checking `sshd'... not infected 185s OK 185s **** Test for '^Checking `syslogd'\.\.\. not infected$' 185s Checking `syslogd'... not infected 185s OK 185s **** Test for '^Checking `tar'\.\.\. not infected$' 185s Checking `tar'... not infected 185s OK 185s **** Test for '^Checking `tcpd'\.\.\. not infected$' 185s Checking `tcpd'... not infected 185s OK 185s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 185s Checking `tcpdump'... not infected 185s OK 185s **** Test for '^Checking `top'\.\.\. not infected$' 185s Checking `top'... not infected 185s OK 185s **** Test for '^Checking `telnetd'\.\.\. not infected$' 185s Checking `telnetd'... not infected 185s OK 185s **** Test for '^Checking `timed'\.\.\. not infected$' 185s Checking `timed'... not infected 185s OK 185s **** Test for '^Checking `traceroute'\.\.\. not infected$' 185s Checking `traceroute'... not infected 185s OK 185s **** Test for '^Checking `vdir'\.\.\. not infected$' 185s Checking `vdir'... not infected 185s OK 185s **** Test for '^Checking `w'\.\.\. not infected$' 185s Checking `w'... not infected 185s OK 185s **** Test for '^Checking `write'\.\.\. not infected$' 185s Checking `write'... not infected 185s OK 185s **** Test for '^Checking `aliens'\.\.\. started$' 185s Checking `aliens'... started 185s OK 185s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 185s Searching for suspicious files in /dev... not found 185s OK 185s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 185s Searching for known suspicious directories... not found 185s OK 185s **** Test for '^Searching for known suspicious files\.\.\. not found$' 185s Searching for known suspicious files... not found 185s OK 185s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 185s Searching for sniffer's logs... not found 185s OK 185s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 185s Searching for HiDrootkit rootkit... not found 185s OK 185s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 185s Searching for t0rn rootkit... not found 185s OK 185s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 185s Searching for t0rn v8 (or variation)... not found 185s OK 185s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 185s Searching for Lion rootkit... not found 185s OK 185s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 185s Searching for RSHA rootkit... not found 185s OK 185s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 185s Searching for RH-Sharpe rootkit... not found 185s OK 185s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 185s Searching for Ambient (ark) rootkit... not found 185s OK 185s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 185s Searching for suspicious files and dirs... WARNING 185s OK 185s **** Test for '^$' 185s 185s 185s 185s 185s 185s 185s OK 185s **** Test for '^WARNING: The following suspicious files and directories were found:$' 185s WARNING: The following suspicious files and directories were found: 185s OK 185s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 185s /usr/lib/.1 [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 185s /usr/lib/.aaa [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 185s /usr/lib/.1DIR [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 185s /usr/lib/...DIR [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 185s /usr/lib/.bbb [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 185s /usr/lib/.DIR-aaa [Not from a Debian package] 185s OK 185s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 185s /usr/lib/... [Not from a Debian package] 185s OK 185s **** Test for '^Searching for LPD Worm\.\.\. not found$' 185s Searching for LPD Worm... not found 185s OK 185s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 185s Searching for Ramen Worm rootkit... not found 185s OK 185s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 185s Searching for Maniac rootkit... not found 185s OK 185s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 185s Searching for RK17 rootkit... not found 185s OK 185s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 185s Searching for Ducoci rootkit... not found 185s OK 185s **** Test for '^Searching for Adore Worm\.\.\. not found$' 185s Searching for Adore Worm... not found 185s OK 185s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 185s Searching for ShitC Worm... not found 185s OK 185s **** Test for '^Searching for Omega Worm\.\.\. not found$' 185s Searching for Omega Worm... not found 185s OK 185s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 185s Searching for Sadmind/IIS Worm... not found 185s OK 185s **** Test for '^Searching for MonKit\.\.\. not found$' 185s Searching for MonKit... not found 185s OK 185s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 185s Searching for Showtee rootkit... not found 185s OK 185s **** Test for '^Searching for OpticKit\.\.\. not found$' 185s Searching for OpticKit... not found 185s OK 185s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 185s Searching for T.R.K... not found 185s OK 185s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 185s Searching for Mithra rootkit... not found 185s OK 185s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 185s Searching for OBSD rootkit v1... not tested 185s OK 185s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 185s Searching for LOC rootkit... not found 185s OK 185s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 185s Searching for Romanian rootkit... not found 185s OK 185s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 185s Searching for HKRK rootkit... not found 185s OK 185s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 185s Searching for Suckit rootkit... not found 185s OK 185s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 185s Searching for Volc rootkit... not found 185s OK 185s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 185s Searching for Gold2 rootkit... not found 185s OK 185s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 185s Searching for TC2 rootkit... not found 185s OK 185s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 185s Searching for Anonoying rootkit... not found 185s OK 185s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 185s Searching for ZK rootkit... not found 185s OK 185s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 185s Searching for ShKit rootkit... not found 185s OK 185s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 185s Searching for AjaKit rootkit... not found 185s OK 185s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 185s Searching for zaRwT rootkit... not found 185s OK 185s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 185s Searching for Madalin rootkit... not found 185s OK 185s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 185s Searching for Fu rootkit... not found 185s OK 185s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 185s Searching for Kenga3 rootkit... not found 185s OK 185s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 185s Searching for ESRK rootkit... not found 185s OK 185s **** Test for '^Searching for rootedoor\.\.\. not found$' 185s Searching for rootedoor... not found 185s OK 185s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 185s Searching for ENYELKM rootkit... not found 185s OK 185s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 185s Searching for common ssh-scanners... not found 185s OK 185s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 185s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 185s OK 185s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 185s Searching for Linux/Ebury 1.6... not found 185s OK 185s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 185s Searching for 64-bit Linux Rootkit... not found 185s OK 185s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 185s Searching for 64-bit Linux Rootkit modules... not found 185s OK 185s **** Test for '^Searching for Mumblehard\.\.\. not found$' 185s Searching for Mumblehard... not found 185s OK 185s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 185s Searching for Backdoor.Linux.Mokes.a... not found 185s OK 185s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 185s Searching for Malicious TinyDNS... not found 185s OK 185s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 185s Searching for Linux.Xor.DDoS... WARNING 185s OK 185s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 185s WARNING: Possible Linux.Xor.DDoS installed: 185s OK 185s **** Test for '^/tmp/clean/.+$' 185s /tmp/clean/sed [Not from a Debian package] 185s /tmp/clean/ls [Not from a Debian package] 185s /tmp/clean/id [Not from a Debian package] 185s /tmp/clean/uname [Not from a Debian package] 185s /tmp/clean/awk [Not from a Debian package] 185s /tmp/clean/head [Not from a Debian package] 185s /tmp/clean/strings [Not from a Debian package] 185s /tmp/clean/cut [Not from a Debian package] 185s /tmp/clean/netstat [Not from a Debian package] 185s /tmp/clean/ss [Not from a Debian package] 185s /tmp/clean/find [Not from a Debian package] 185s /tmp/clean/ps [Not from a Debian package] 185s /tmp/clean/xargs [Not from a Debian package] 185s /tmp/clean/dpkg-query [Not from a Debian package] 185s /tmp/clean/dirname [Not from a Debian package] 185s /tmp/clean/echo [Not from a Debian package] 185s /tmp/clean/grep [Not from a Debian package] 185s OK 185s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 185s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 185s OK 185s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 185s Searching for Linux.Proxy.1.0... not found 185s OK 185s **** Test for '^Searching for CrossRAT\.\.\. not found$' 185s Searching for CrossRAT... not found 185s OK 185s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 185s Searching for Hidden Cobra... not found 185s OK 185s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 185s Searching for Rocke Miner rootkit... not found 185s OK 185s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 185s Searching for PWNLNX4 lkm rootkit... not found 185s OK 185s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 185s Searching for PWNLNX6 lkm rootkit... not found 185s OK 185s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 185s Searching for Umbreon lrk... not found 185s OK 185s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 185s Searching for Kinsing.a backdoor rootkit... not found 185s OK 185s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 185s Searching for RotaJakiro backdoor rootkit... not found 185s OK 185s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 185s Searching for Syslogk LKM rootkit... not found 185s OK 185s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 185s Searching for Kovid LKM rootkit... not tested 185s OK 185s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 185s Searching for Tsunami DDoS Malware rootkit... not found 185s OK 185s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 185s Searching for Linux BPF Door... not found 185s OK 185s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 185s Searching for suspect PHP files... not found 185s OK 185s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 185s Searching for zero-size shell history files in /root... not found 185s OK 185s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 185s Searching for hardlinked shell history files in /root... not found 185s OK 185s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 185s Searching for suspect PHP files... not found 185s OK 185s **** Test for '^Checking `aliens'\.\.\. finished$' 185s Checking `aliens'... finished 185s OK 185s **** Test for '^Checking `asp'\.\.\. not infected$' 185s Checking `asp'... not infected 185s OK 185s **** Test for '^Checking `bindshell'\.\.\. not found$' 185s Checking `bindshell'... not found 185s OK 185s **** Test for '^Checking `lkm'\.\.\. started$' 185s Checking `lkm'... started 185s OK 185s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 185s Searching for Adore LKM... not tested 185s OK 185s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 185s Searching for sebek LKM (Adore based)... not tested 185s OK 185s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 185s Searching for knark LKM rootkit... not found 185s OK 185s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 185s Searching for for hidden processes with chkproc... not found 185s OK 185s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 185s Searching for for hidden directories using chkdirs... not found 185s OK 185s **** Test for '^Checking `lkm'\.\.\. finished$' 185s Checking `lkm'... finished 185s OK 185s **** Test for '^Checking `rexedcs'\.\.\. not found$' 185s Checking `rexedcs'... not found 185s OK 185s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 185s Checking `sniffer'... WARNING 185s OK 185s **** Test for '^WARNING: Output from ifpromisc:$' 185s WARNING: Output from ifpromisc: 185s OK 185s **** Test for '^lo: not promisc and no packet sniffer sockets$' 185s lo: not promisc and no packet sniffer sockets 185s OK 185s **** Test for '^Checking `w55808'\.\.\. not found$' 185s Checking `w55808'... not found 185s OK 185s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 185s Checking `wted'... not found 185s OK 185s **** Test for '^Checking `scalper'\.\.\. not found$' 185s Checking `scalper'... not found 185s OK 185s **** Test for '^Checking `slapper'\.\.\. not found$' 185s Checking `slapper'... not found 185s OK 185s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 185s Checking `z2'... not found 185s OK 185s **** Test for '^Checking `chkutmp'\.\.\.' 185s Checking `chkutmp'... not found 185s OK 185s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 185s Checking `OSX_RSPLUG'... not tested 185s OK 185s ** PASS: Testing: chkrootkit-1-full (/usr/sbin/chkrootkit) done: PASS 185s *** Unexpected (unmatched) lines follow (for info): 185s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 185s ** Testing: chkrootkit-2-quiet (/usr/sbin/chkrootkit -q) ... 185s *** Output 186s WARNING: The following suspicious files and directories were found: 186s /usr/lib/... [Not from a Debian package] 186s /usr/lib/.DIR-aaa [Not from a Debian package] 186s /usr/lib/.1DIR [Not from a Debian package] 186s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 186s /usr/lib/.bbb [Not from a Debian package] 186s /usr/lib/...DIR [Not from a Debian package] 186s /usr/lib/.aaa [Not from a Debian package] 186s /usr/lib/.1 [Not from a Debian package] 186s 191s WARNING: Possible Linux.Xor.DDoS installed: 191s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 191s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 191s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 191s /tmp/clean/sed [Not from a Debian package] 191s /tmp/clean/ls [Not from a Debian package] 191s /tmp/clean/id [Not from a Debian package] 191s /tmp/clean/uname [Not from a Debian package] 191s /tmp/clean/awk [Not from a Debian package] 191s /tmp/clean/head [Not from a Debian package] 191s /tmp/clean/strings [Not from a Debian package] 191s /tmp/clean/cut [Not from a Debian package] 191s /tmp/clean/netstat [Not from a Debian package] 191s /tmp/clean/ss [Not from a Debian package] 191s /tmp/clean/find [Not from a Debian package] 191s /tmp/clean/ps [Not from a Debian package] 191s /tmp/clean/xargs [Not from a Debian package] 191s /tmp/clean/dpkg-query [Not from a Debian package] 191s /tmp/clean/dirname [Not from a Debian package] 191s /tmp/clean/echo [Not from a Debian package] 191s /tmp/clean/grep [Not from a Debian package] 191s 203s WARNING: Output from ifpromisc: 203s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 203s 203s **** Files in log 203s total 8.0K 203s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 203s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 203s *** Test of content of output follows... 203s **** Test for '^WARNING: The following suspicious files and directories were found:$' 203s WARNING: The following suspicious files and directories were found: 203s OK 203s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 203s /usr/lib/.1 [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 203s /usr/lib/.aaa [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 203s /usr/lib/.1DIR [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 203s /usr/lib/...DIR [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 203s /usr/lib/.bbb [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 203s /usr/lib/.DIR-aaa [Not from a Debian package] 203s OK 203s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 203s /usr/lib/... [Not from a Debian package] 203s OK 203s **** Test for '^$' 203s 203s 203s 203s OK 203s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 203s WARNING: Possible Linux.Xor.DDoS installed: 203s OK 203s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 203s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 203s OK 203s **** Test for '^/tmp/clean/.+$' 203s /tmp/clean/sed [Not from a Debian package] 203s /tmp/clean/ls [Not from a Debian package] 203s /tmp/clean/id [Not from a Debian package] 203s /tmp/clean/uname [Not from a Debian package] 203s /tmp/clean/awk [Not from a Debian package] 203s /tmp/clean/head [Not from a Debian package] 203s /tmp/clean/strings [Not from a Debian package] 203s /tmp/clean/cut [Not from a Debian package] 203s /tmp/clean/netstat [Not from a Debian package] 203s /tmp/clean/ss [Not from a Debian package] 203s /tmp/clean/find [Not from a Debian package] 203s /tmp/clean/ps [Not from a Debian package] 203s /tmp/clean/xargs [Not from a Debian package] 203s /tmp/clean/dpkg-query [Not from a Debian package] 203s /tmp/clean/dirname [Not from a Debian package] 203s /tmp/clean/echo [Not from a Debian package] 203s /tmp/clean/grep [Not from a Debian package] 203s OK 203s ** PASS: Testing: chkrootkit-2-quiet (/usr/sbin/chkrootkit -q) done: PASS 203s *** Unexpected (unmatched) lines follow (for info): 203s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 203s * Testing: filtering of sniffer (-s) 203s ** Testing: chkrootkit-sniffer-01-full (chkrootkit sniffer) ... 203s *** Output 203s ROOTDIR is `/' 203s Checking `sniffer'... WARNING 203s 203s WARNING: Output from ifpromisc: 203s lo: not promisc and no packet sniffer sockets 203s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 203s 203s **** Files in log 203s total 8.0K 203s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 203s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 203s *** Test of content of output follows... 203s **** Test for '^ROOTDIR is `/'$' 203s ROOTDIR is `/' 203s OK 203s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 203s Checking `sniffer'... WARNING 203s OK 203s **** Test for '^$' 203s 203s 203s OK 203s **** Test for 'WARNING: Output from ifpromisc:$' 203s WARNING: Output from ifpromisc: 203s OK 203s **** Test for '^lo: not promisc and no packet sniffer sockets$' 203s lo: not promisc and no packet sniffer sockets 203s OK 203s ** PASS: Testing: chkrootkit-sniffer-01-full (chkrootkit sniffer) done: PASS 203s ** Testing: chkrootkit-sniffer-02-full-with-s (chkrootkit -s (PACKET SNIFFER|not promisc) sniffer) ... 203s *** Output 203s ROOTDIR is `/' 203s Checking `sniffer'... not found 203s **** Files in log 204s total 8.0K 204s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 204s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 204s *** Test of content of output follows... 204s **** Test for '^ROOTDIR is `/'$' 204s ROOTDIR is `/' 204s OK 204s **** Test for '^Checking `sniffer'\.\.\. not found$' 204s Checking `sniffer'... not found 204s OK 204s ** PASS: Testing: chkrootkit-sniffer-02-full-with-s (chkrootkit -s (PACKET SNIFFER|not promisc) sniffer) done: PASS 204s ** Testing: chkrootkit-sniffer-03-quiet-with-s (chkrootkit -q -s PACKET SNIFFER sniffer) ... 204s *** Output 204s **** Files in log 204s total 8.0K 204s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 204s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 204s *** Test of content of output follows... 204s **** Expected is empty, so output should be empty 204s Output is indeed empty: PASS 204s ** PASS: Testing: chkrootkit-sniffer-03-quiet-with-s (chkrootkit -q -s PACKET SNIFFER sniffer) done: PASS 204s * Testing: chkrootkit-daily - should give no output when disabled 204s ** Testing: cron-1-with-no-config (chkrootkit-daily) ... 204s *** Output 204s **** Files in log 204s total 8.0K 204s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 204s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 204s *** Test of content of output follows... 204s **** Expected is empty, so output should be empty 204s Output is indeed empty: PASS 204s ** PASS: Testing: cron-1-with-no-config (chkrootkit-daily) done: PASS 204s ** Testing: cron-2-disabled (chkrootkit-daily) ... 204s *** Output 204s **** Files in log 204s total 8.0K 204s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 204s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 204s *** Test of content of output follows... 204s **** Expected is empty, so output should be empty 204s Output is indeed empty: PASS 204s ** PASS: Testing: cron-2-disabled (chkrootkit-daily) done: PASS 204s * Testing: chkrootkit-daily (without diff mode, full output, no MAILTO) 204s ** Testing: cron-no-diff-mode-01-full (chkrootkit-daily) ... 204s *** Output 222s ROOTDIR is `/' 222s Checking `amd'... not infected 222s Checking `basename'... not infected 222s Checking `biff'... not infected 222s Checking `chfn'... not infected 222s Checking `chsh'... not infected 222s Checking `cron'... not infected 222s Checking `crontab'... not infected 222s Checking `date'... not infected 222s Checking `du'... not infected 222s Checking `dirname'... not infected 222s Checking `echo'... not infected 222s Checking `egrep'... not infected 222s Checking `env'... not infected 222s Checking `find'... not infected 222s Checking `fingerd'... not infected 222s Checking `gpm'... not infected 222s Checking `grep'... not infected 222s Checking `hdparm'... not infected 222s Checking `su'... not infected 222s Checking `ifconfig'... not infected 222s Checking `inetd'... not infected 222s Checking `inetdconf'... not infected 222s Checking `identd'... not infected 222s Checking `init'... not infected 222s Checking `killall'... not infected 222s Checking `ldsopreload'... not infected 222s Checking `login'... not infected 222s Checking `ls'... not infected 222s Checking `lsof'... not infected 222s Checking `mail'... not infected 222s Checking `mingetty'... not infected 222s Checking `netstat'... not infected 222s Checking `named'... not infected 222s Checking `passwd'... not infected 222s Checking `pidof'... not infected 222s Checking `pop2'... not infected 222s Checking `pop3'... not infected 222s Checking `ps'... not infected 222s Checking `pstree'... not infected 222s Checking `rpcinfo'... not infected 222s Checking `rlogind'... not infected 222s Checking `rshd'... not infected 222s Checking `slogin'... not infected 222s Checking `sendmail'... not infected 222s Checking `sshd'... not infected 222s Checking `syslogd'... not infected 222s Checking `tar'... not infected 222s Checking `tcpd'... not infected 222s Checking `tcpdump'... not infected 222s Checking `top'... not infected 222s Checking `telnetd'... not infected 222s Checking `timed'... not infected 222s Checking `traceroute'... not infected 222s Checking `vdir'... not infected 222s Checking `w'... not infected 222s Checking `write'... not infected 222s Checking `aliens'... started 222s Searching for suspicious files in /dev... not found 222s Searching for known suspicious directories... not found 222s Searching for known suspicious files... not found 222s Searching for sniffer's logs... not found 222s Searching for HiDrootkit rootkit... not found 222s Searching for t0rn rootkit... not found 222s Searching for t0rn v8 (or variation)... not found 222s Searching for Lion rootkit... not found 222s Searching for RSHA rootkit... not found 222s Searching for RH-Sharpe rootkit... not found 222s Searching for Ambient (ark) rootkit... not found 222s Searching for suspicious files and dirs... WARNING 222s 222s WARNING: The following suspicious files and directories were found: 222s /usr/lib/... [Not from a Debian package] 222s /usr/lib/.DIR-aaa [Not from a Debian package] 222s /usr/lib/.1DIR [Not from a Debian package] 222s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 222s /usr/lib/.bbb [Not from a Debian package] 222s /usr/lib/...DIR [Not from a Debian package] 222s /usr/lib/.aaa [Not from a Debian package] 222s /usr/lib/.1 [Not from a Debian package] 222s 222s Searching for LPD Worm... not found 222s Searching for Ramen Worm rootkit... not found 222s Searching for Maniac rootkit... not found 222s Searching for RK17 rootkit... not found 222s Searching for Ducoci rootkit... not found 222s Searching for Adore Worm... not found 222s Searching for ShitC Worm... not found 222s Searching for Omega Worm... not found 222s Searching for Sadmind/IIS Worm... not found 222s Searching for MonKit... not found 222s Searching for Showtee rootkit... not found 222s Searching for OpticKit... not found 222s Searching for T.R.K... not found 222s Searching for Mithra rootkit... not found 222s Searching for OBSD rootkit v1... not tested 222s Searching for LOC rootkit... not found 222s Searching for Romanian rootkit... not found 222s Searching for HKRK rootkit... not found 222s Searching for Suckit rootkit... not found 222s Searching for Volc rootkit... not found 222s Searching for Gold2 rootkit... not found 222s Searching for TC2 rootkit... not found 222s Searching for Anonoying rootkit... not found 222s Searching for ZK rootkit... not found 222s Searching for ShKit rootkit... not found 222s Searching for AjaKit rootkit... not found 222s Searching for zaRwT rootkit... not found 222s Searching for Madalin rootkit... not found 222s Searching for Fu rootkit... not found 222s Searching for Kenga3 rootkit... not found 222s Searching for ESRK rootkit... not found 222s Searching for rootedoor... not found 222s Searching for ENYELKM rootkit... not found 222s Searching for common ssh-scanners... not found 222s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 222s Searching for Linux/Ebury 1.6... not found 222s Searching for 64-bit Linux Rootkit... not found 222s Searching for 64-bit Linux Rootkit modules... not found 222s Searching for Mumblehard... not found 222s Searching for Backdoor.Linux.Mokes.a... not found 222s Searching for Malicious TinyDNS... not found 222s Searching for Linux.Xor.DDoS... WARNING 222s 222s WARNING: Possible Linux.Xor.DDoS installed: 222s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 222s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 222s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 222s /tmp/clean/sed [Not from a Debian package] 222s /tmp/clean/ls [Not from a Debian package] 222s /tmp/clean/id [Not from a Debian package] 222s /tmp/clean/uname [Not from a Debian package] 222s /tmp/clean/awk [Not from a Debian package] 222s /tmp/clean/head [Not from a Debian package] 222s /tmp/clean/strings [Not from a Debian package] 222s /tmp/clean/cut [Not from a Debian package] 222s /tmp/clean/netstat [Not from a Debian package] 222s /tmp/clean/ss [Not from a Debian package] 222s /tmp/clean/find [Not from a Debian package] 222s /tmp/clean/ps [Not from a Debian package] 222s /tmp/clean/xargs [Not from a Debian package] 222s /tmp/clean/dpkg-query [Not from a Debian package] 222s /tmp/clean/dirname [Not from a Debian package] 222s /tmp/clean/echo [Not from a Debian package] 222s /tmp/clean/grep [Not from a Debian package] 222s 222s Searching for Linux.Proxy.1.0... not found 222s Searching for CrossRAT... not found 222s Searching for Hidden Cobra... not found 222s Searching for Rocke Miner rootkit... not found 222s Searching for PWNLNX4 lkm rootkit... not found 222s Searching for PWNLNX6 lkm rootkit... not found 222s Searching for Umbreon lrk... not found 222s Searching for Kinsing.a backdoor rootkit... not found 222s Searching for RotaJakiro backdoor rootkit... not found 222s Searching for Syslogk LKM rootkit... not found 222s Searching for Kovid LKM rootkit... not tested 222s Searching for Tsunami DDoS Malware rootkit... not found 222s Searching for Linux BPF Door... not found 222s Searching for suspect PHP files... not found 222s Searching for zero-size shell history files in /root... not found 222s Searching for hardlinked shell history files in /root... not found 222s Checking `aliens'... finished 222s Checking `asp'... not infected 222s Checking `bindshell'... not found 222s Checking `lkm'... started 222s Searching for Adore LKM... not tested 222s Searching for sebek LKM (Adore based)... not tested 222s Searching for knark LKM rootkit... not found 222s Searching for for hidden processes with chkproc... not found 222s Searching for for hidden directories using chkdirs... not found 222s Checking `lkm'... finished 222s Checking `rexedcs'... not found 222s Checking `sniffer'... WARNING 222s 222s WARNING: Output from ifpromisc: 222s lo: not promisc and no packet sniffer sockets 222s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 222s 222s Checking `w55808'... not found 222s Checking `wted'... not found 222s Checking `scalper'... not found 222s Checking `slapper'... not found 222s Checking `z2'... not found 222s Checking `chkutmp'... not found 222s Checking `OSX_RSPLUG'... not tested 222s **** Files in log 222s total 80K 222s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 222s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 222s -rw-r--r-- 1 root root 21K Nov 26 20:43 chkrootkit-daily.log 222s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today 222s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today.raw 222s *** Test of content of output follows... 222s **** Test for '^ROOTDIR is `/'$' 222s ROOTDIR is `/' 222s OK 222s **** Test for '^Checking `amd'\.\.\. not infected$' 222s Checking `amd'... not infected 222s OK 222s **** Test for '^Checking `basename'\.\.\. not infected$' 222s Checking `basename'... not infected 222s OK 222s **** Test for '^Checking `biff'\.\.\. not infected$' 222s Checking `biff'... not infected 222s OK 222s **** Test for '^Checking `chfn'\.\.\. not infected$' 222s Checking `chfn'... not infected 222s OK 222s **** Test for '^Checking `chsh'\.\.\. not infected$' 222s Checking `chsh'... not infected 222s OK 222s **** Test for '^Checking `cron'\.\.\. not infected$' 222s Checking `cron'... not infected 222s OK 222s **** Test for '^Checking `crontab'\.\.\. not infected$' 222s Checking `crontab'... not infected 222s OK 222s **** Test for '^Checking `date'\.\.\. not infected$' 222s Checking `date'... not infected 222s OK 222s **** Test for '^Checking `du'\.\.\. not infected$' 222s Checking `du'... not infected 222s OK 222s **** Test for '^Checking `dirname'\.\.\. not infected$' 222s Checking `dirname'... not infected 222s OK 222s **** Test for '^Checking `echo'\.\.\. not infected$' 222s Checking `echo'... not infected 222s OK 222s **** Test for '^Checking `egrep'\.\.\. not infected$' 222s Checking `egrep'... not infected 222s OK 222s **** Test for '^Checking `env'\.\.\. not infected$' 222s Checking `env'... not infected 222s OK 222s **** Test for '^Checking `find'\.\.\. not infected$' 222s Checking `find'... not infected 222s OK 222s **** Test for '^Checking `fingerd'\.\.\. not infected$' 222s Checking `fingerd'... not infected 222s OK 222s **** Test for '^Checking `gpm'\.\.\. not infected$' 222s Checking `gpm'... not infected 222s OK 222s **** Test for '^Checking `grep'\.\.\. not infected$' 222s Checking `grep'... not infected 222s OK 222s **** Test for '^Checking `hdparm'\.\.\. not infected$' 222s Checking `hdparm'... not infected 222s OK 222s **** Test for '^Checking `su'\.\.\. not infected$' 222s Checking `su'... not infected 222s OK 222s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 222s Checking `ifconfig'... not infected 222s OK 222s **** Test for '^Checking `inetd'\.\.\. not infected$' 222s Checking `inetd'... not infected 222s OK 222s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 222s Checking `inetdconf'... not infected 222s OK 222s **** Test for '^Checking `identd'\.\.\. not infected$' 222s Checking `identd'... not infected 222s OK 222s **** Test for '^Checking `init'\.\.\. not infected$' 222s Checking `init'... not infected 222s OK 222s **** Test for '^Checking `killall'\.\.\. not infected$' 222s Checking `killall'... not infected 222s OK 222s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 222s Checking `ldsopreload'... not infected 222s OK 222s **** Test for '^Checking `login'\.\.\. not infected$' 222s Checking `login'... not infected 222s OK 222s **** Test for '^Checking `ls'\.\.\. not infected$' 222s Checking `ls'... not infected 222s OK 222s **** Test for '^Checking `lsof'\.\.\. not infected$' 222s Checking `lsof'... not infected 222s OK 222s **** Test for '^Checking `mail'\.\.\. not infected$' 222s Checking `mail'... not infected 222s OK 222s **** Test for '^Checking `mingetty'\.\.\. not infected$' 222s Checking `mingetty'... not infected 222s OK 222s **** Test for '^Checking `netstat'\.\.\. not infected$' 222s Checking `netstat'... not infected 222s OK 222s **** Test for '^Checking `named'\.\.\. not infected$' 222s Checking `named'... not infected 222s OK 222s **** Test for '^Checking `passwd'\.\.\. not infected$' 222s Checking `passwd'... not infected 222s OK 222s **** Test for '^Checking `pidof'\.\.\. not infected$' 222s Checking `pidof'... not infected 222s OK 222s **** Test for '^Checking `pop2'\.\.\. not infected$' 222s Checking `pop2'... not infected 222s OK 222s **** Test for '^Checking `pop3'\.\.\. not infected$' 222s Checking `pop3'... not infected 222s OK 222s **** Test for '^Checking `ps'\.\.\. not infected$' 222s Checking `ps'... not infected 222s OK 222s **** Test for '^Checking `pstree'\.\.\. not infected$' 222s Checking `pstree'... not infected 222s OK 222s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 222s Checking `rpcinfo'... not infected 222s OK 222s **** Test for '^Checking `rlogind'\.\.\. not infected$' 222s Checking `rlogind'... not infected 222s OK 222s **** Test for '^Checking `rshd'\.\.\. not infected$' 222s Checking `rshd'... not infected 222s OK 222s **** Test for '^Checking `slogin'\.\.\. not infected$' 222s Checking `slogin'... not infected 222s OK 222s **** Test for '^Checking `sendmail'\.\.\. not infected$' 222s Checking `sendmail'... not infected 222s OK 222s **** Test for '^Checking `sshd'\.\.\. not infected$' 222s Checking `sshd'... not infected 222s OK 222s **** Test for '^Checking `syslogd'\.\.\. not infected$' 222s Checking `syslogd'... not infected 222s OK 222s **** Test for '^Checking `tar'\.\.\. not infected$' 222s Checking `tar'... not infected 222s OK 222s **** Test for '^Checking `tcpd'\.\.\. not infected$' 222s Checking `tcpd'... not infected 222s OK 222s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 222s Checking `tcpdump'... not infected 222s OK 222s **** Test for '^Checking `top'\.\.\. not infected$' 222s Checking `top'... not infected 222s OK 222s **** Test for '^Checking `telnetd'\.\.\. not infected$' 222s Checking `telnetd'... not infected 222s OK 222s **** Test for '^Checking `timed'\.\.\. not infected$' 222s Checking `timed'... not infected 222s OK 222s **** Test for '^Checking `traceroute'\.\.\. not infected$' 222s Checking `traceroute'... not infected 222s OK 222s **** Test for '^Checking `vdir'\.\.\. not infected$' 222s Checking `vdir'... not infected 222s OK 222s **** Test for '^Checking `w'\.\.\. not infected$' 222s Checking `w'... not infected 222s OK 222s **** Test for '^Checking `write'\.\.\. not infected$' 222s Checking `write'... not infected 222s OK 222s **** Test for '^Checking `aliens'\.\.\. started$' 222s Checking `aliens'... started 222s OK 222s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 222s Searching for suspicious files in /dev... not found 222s OK 222s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 222s Searching for known suspicious directories... not found 222s OK 222s **** Test for '^Searching for known suspicious files\.\.\. not found$' 222s Searching for known suspicious files... not found 222s OK 222s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 222s Searching for sniffer's logs... not found 222s OK 222s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 222s Searching for HiDrootkit rootkit... not found 222s OK 222s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 222s Searching for t0rn rootkit... not found 222s OK 222s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 222s Searching for t0rn v8 (or variation)... not found 222s OK 222s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 222s Searching for Lion rootkit... not found 222s OK 222s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 222s Searching for RSHA rootkit... not found 222s OK 222s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 222s Searching for RH-Sharpe rootkit... not found 222s OK 222s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 222s Searching for Ambient (ark) rootkit... not found 222s OK 222s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 222s Searching for suspicious files and dirs... WARNING 222s OK 222s **** Test for '^$' 222s 222s 222s 222s 222s 222s 222s OK 222s **** Test for '^WARNING: The following suspicious files and directories were found:$' 222s WARNING: The following suspicious files and directories were found: 222s OK 222s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 222s /usr/lib/.1 [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 222s /usr/lib/.aaa [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 222s /usr/lib/.1DIR [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 222s /usr/lib/...DIR [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 222s /usr/lib/.bbb [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 222s /usr/lib/.DIR-aaa [Not from a Debian package] 222s OK 222s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 222s /usr/lib/... [Not from a Debian package] 222s OK 222s **** Test for '^Searching for LPD Worm\.\.\. not found$' 222s Searching for LPD Worm... not found 222s OK 222s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 222s Searching for Ramen Worm rootkit... not found 222s OK 222s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 222s Searching for Maniac rootkit... not found 222s OK 222s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 222s Searching for RK17 rootkit... not found 222s OK 222s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 222s Searching for Ducoci rootkit... not found 222s OK 222s **** Test for '^Searching for Adore Worm\.\.\. not found$' 222s Searching for Adore Worm... not found 222s OK 222s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 222s Searching for ShitC Worm... not found 222s OK 222s **** Test for '^Searching for Omega Worm\.\.\. not found$' 222s Searching for Omega Worm... not found 222s OK 222s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 222s Searching for Sadmind/IIS Worm... not found 222s OK 222s **** Test for '^Searching for MonKit\.\.\. not found$' 222s Searching for MonKit... not found 222s OK 222s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 222s Searching for Showtee rootkit... not found 222s OK 222s **** Test for '^Searching for OpticKit\.\.\. not found$' 222s Searching for OpticKit... not found 222s OK 222s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 222s Searching for T.R.K... not found 222s OK 222s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 222s Searching for Mithra rootkit... not found 222s OK 222s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 222s Searching for OBSD rootkit v1... not tested 222s OK 222s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 222s Searching for LOC rootkit... not found 222s OK 222s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 222s Searching for Romanian rootkit... not found 222s OK 222s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 222s Searching for HKRK rootkit... not found 222s OK 222s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 222s Searching for Suckit rootkit... not found 222s OK 222s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 222s Searching for Volc rootkit... not found 222s OK 222s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 222s Searching for Gold2 rootkit... not found 222s OK 222s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 222s Searching for TC2 rootkit... not found 222s OK 222s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 222s Searching for Anonoying rootkit... not found 222s OK 222s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 222s Searching for ZK rootkit... not found 222s OK 222s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 222s Searching for ShKit rootkit... not found 222s OK 222s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 222s Searching for AjaKit rootkit... not found 222s OK 222s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 222s Searching for zaRwT rootkit... not found 222s OK 222s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 222s Searching for Madalin rootkit... not found 222s OK 222s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 222s Searching for Fu rootkit... not found 222s OK 222s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 222s Searching for Kenga3 rootkit... not found 222s OK 222s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 222s Searching for ESRK rootkit... not found 222s OK 222s **** Test for '^Searching for rootedoor\.\.\. not found$' 222s Searching for rootedoor... not found 222s OK 222s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 222s Searching for ENYELKM rootkit... not found 222s OK 222s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 222s Searching for common ssh-scanners... not found 222s OK 222s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 222s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 222s OK 222s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 222s Searching for Linux/Ebury 1.6... not found 222s OK 222s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 222s Searching for 64-bit Linux Rootkit... not found 222s OK 222s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 222s Searching for 64-bit Linux Rootkit modules... not found 222s OK 222s **** Test for '^Searching for Mumblehard\.\.\. not found$' 222s Searching for Mumblehard... not found 222s OK 222s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 222s Searching for Backdoor.Linux.Mokes.a... not found 222s OK 222s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 222s Searching for Malicious TinyDNS... not found 222s OK 222s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 222s Searching for Linux.Xor.DDoS... WARNING 222s OK 222s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 222s WARNING: Possible Linux.Xor.DDoS installed: 222s OK 222s **** Test for '^/tmp/clean/.+$' 222s /tmp/clean/sed [Not from a Debian package] 222s /tmp/clean/ls [Not from a Debian package] 222s /tmp/clean/id [Not from a Debian package] 222s /tmp/clean/uname [Not from a Debian package] 222s /tmp/clean/awk [Not from a Debian package] 222s /tmp/clean/head [Not from a Debian package] 222s /tmp/clean/strings [Not from a Debian package] 222s /tmp/clean/cut [Not from a Debian package] 222s /tmp/clean/netstat [Not from a Debian package] 222s /tmp/clean/ss [Not from a Debian package] 222s /tmp/clean/find [Not from a Debian package] 222s /tmp/clean/ps [Not from a Debian package] 222s /tmp/clean/xargs [Not from a Debian package] 222s /tmp/clean/dpkg-query [Not from a Debian package] 222s /tmp/clean/dirname [Not from a Debian package] 222s /tmp/clean/echo [Not from a Debian package] 222s /tmp/clean/grep [Not from a Debian package] 222s OK 222s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 222s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 222s OK 222s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 222s Searching for Linux.Proxy.1.0... not found 222s OK 222s **** Test for '^Searching for CrossRAT\.\.\. not found$' 222s Searching for CrossRAT... not found 222s OK 222s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 222s Searching for Hidden Cobra... not found 222s OK 222s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 222s Searching for Rocke Miner rootkit... not found 222s OK 222s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 222s Searching for PWNLNX4 lkm rootkit... not found 222s OK 222s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 222s Searching for PWNLNX6 lkm rootkit... not found 222s OK 222s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 222s Searching for Umbreon lrk... not found 222s OK 222s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 222s Searching for Kinsing.a backdoor rootkit... not found 222s OK 222s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 222s Searching for RotaJakiro backdoor rootkit... not found 222s OK 222s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 222s Searching for Syslogk LKM rootkit... not found 222s OK 222s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 222s Searching for Kovid LKM rootkit... not tested 222s OK 222s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 222s Searching for Tsunami DDoS Malware rootkit... not found 222s OK 222s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 222s Searching for Linux BPF Door... not found 222s OK 222s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 222s Searching for suspect PHP files... not found 222s OK 222s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 222s Searching for zero-size shell history files in /root... not found 222s OK 222s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 222s Searching for hardlinked shell history files in /root... not found 222s OK 222s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 222s Searching for suspect PHP files... not found 222s OK 222s **** Test for '^Checking `aliens'\.\.\. finished$' 222s Checking `aliens'... finished 222s OK 222s **** Test for '^Checking `asp'\.\.\. not infected$' 222s Checking `asp'... not infected 222s OK 222s **** Test for '^Checking `bindshell'\.\.\. not found$' 222s Checking `bindshell'... not found 222s OK 222s **** Test for '^Checking `lkm'\.\.\. started$' 222s Checking `lkm'... started 222s OK 222s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 222s Searching for Adore LKM... not tested 222s OK 222s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 222s Searching for sebek LKM (Adore based)... not tested 222s OK 222s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 222s Searching for knark LKM rootkit... not found 222s OK 222s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 222s Searching for for hidden processes with chkproc... not found 222s OK 222s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 222s Searching for for hidden directories using chkdirs... not found 222s OK 222s **** Test for '^Checking `lkm'\.\.\. finished$' 222s Checking `lkm'... finished 222s OK 222s **** Test for '^Checking `rexedcs'\.\.\. not found$' 222s Checking `rexedcs'... not found 222s OK 222s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 222s Checking `sniffer'... WARNING 222s OK 222s **** Test for '^WARNING: Output from ifpromisc:$' 222s WARNING: Output from ifpromisc: 222s OK 222s **** Test for '^lo: not promisc and no packet sniffer sockets$' 222s lo: not promisc and no packet sniffer sockets 222s OK 222s **** Test for '^Checking `w55808'\.\.\. not found$' 222s Checking `w55808'... not found 222s OK 222s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 222s Checking `wted'... not found 222s OK 222s **** Test for '^Checking `scalper'\.\.\. not found$' 222s Checking `scalper'... not found 222s OK 222s **** Test for '^Checking `slapper'\.\.\. not found$' 222s Checking `slapper'... not found 222s OK 222s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 222s Checking `z2'... not found 222s OK 222s **** Test for '^Checking `chkutmp'\.\.\.' 222s Checking `chkutmp'... not found 222s OK 222s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 222s Checking `OSX_RSPLUG'... not tested 222s OK 222s ** PASS: Testing: cron-no-diff-mode-01-full (chkrootkit-daily) done: PASS 222s *** Unexpected (unmatched) lines follow (for info): 222s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 222s ** Testing: cron-no-diff-mode-02-full-filter-and-ignore (chkrootkit-daily) ... 222s *** Output 240s ROOTDIR is `/' 240s Checking `amd'... not infected 240s Checking `basename'... not infected 240s Checking `biff'... not infected 240s Checking `chfn'... not infected 240s Checking `chsh'... not infected 240s Checking `cron'... not infected 240s Checking `crontab'... not infected 240s Checking `date'... not infected 240s Checking `du'... not infected 240s Checking `dirname'... not infected 240s Checking `echo'... not infected 240s Checking `egrep'... not infected 240s Checking `env'... not infected 240s Checking `find'... not infected 240s Checking `fingerd'... not infected 240s Checking `gpm'... not infected 240s Checking `grep'... not infected 240s Checking `hdparm'... not infected 240s Checking `su'... not infected 240s Checking `ifconfig'... not infected 240s Checking `inetd'... not infected 240s Checking `inetdconf'... not infected 240s Checking `identd'... not infected 240s Checking `init'... not infected 240s Checking `killall'... not infected 240s Checking `ldsopreload'... not infected 240s Checking `login'... not infected 240s Checking `ls'... not infected 240s Checking `lsof'... not infected 240s Checking `mail'... not infected 240s Checking `mingetty'... not infected 240s Checking `netstat'... not infected 240s Checking `named'... not infected 240s Checking `passwd'... not infected 240s Checking `pidof'... not infected 240s Checking `pop2'... not infected 240s Checking `pop3'... not infected 240s Checking `ps'... not infected 240s Checking `pstree'... not infected 240s Checking `rpcinfo'... not infected 240s Checking `rlogind'... not infected 240s Checking `rshd'... not infected 240s Checking `slogin'... not infected 240s Checking `sendmail'... not infected 240s Checking `sshd'... not infected 240s Checking `syslogd'... not infected 240s Checking `tar'... not infected 240s Checking `tcpd'... not infected 240s Checking `tcpdump'... not infected 240s Checking `top'... not infected 240s Checking `telnetd'... not infected 240s Checking `timed'... not infected 240s Checking `traceroute'... not infected 240s Checking `vdir'... not infected 240s Checking `w'... not infected 240s Checking `write'... not infected 240s Checking `aliens'... started 240s Searching for suspicious files in /dev... not found 240s Searching for known suspicious directories... not found 240s Searching for known suspicious files... not found 240s Searching for sniffer's logs... not found 240s Searching for HiDrootkit rootkit... not found 240s Searching for t0rn rootkit... not found 240s Searching for t0rn v8 (or variation)... not found 240s Searching for Lion rootkit... not found 240s Searching for RSHA rootkit... not found 240s Searching for RH-Sharpe rootkit... not found 240s Searching for Ambient (ark) rootkit... not found 240s Searching for suspicious files and dirs... WARNING 240s 240s WARNING: The following suspicious files and directories were found: 240s /usr/lib/... [Not from a Debian package] 240s /usr/lib/.1DIR [Not from a Debian package] 240s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 240s CHANGED-IN-FILTER_bb [Not from a Debian package] 240s /usr/lib/...DIR [Not from a Debian package] 240s /usr/lib/.1 [Not from a Debian package] 240s 240s Searching for LPD Worm... not found 240s Searching for Ramen Worm rootkit... not found 240s Searching for Maniac rootkit... not found 240s Searching for RK17 rootkit... not found 240s Searching for Ducoci rootkit... not found 240s Searching for Adore Worm... not found 240s Searching for ShitC Worm... not found 240s Searching for Omega Worm... not found 240s Searching for Sadmind/IIS Worm... not found 240s Searching for MonKit... not found 240s Searching for Showtee rootkit... not found 240s Searching for OpticKit... not found 240s Searching for T.R.K... not found 240s Searching for Mithra rootkit... not found 240s Searching for OBSD rootkit v1... not tested 240s Searching for LOC rootkit... not found 240s Searching for Romanian rootkit... not found 240s Searching for HKRK rootkit... not found 240s Searching for Suckit rootkit... not found 240s Searching for Volc rootkit... not found 240s Searching for Gold2 rootkit... not found 240s Searching for TC2 rootkit... not found 240s Searching for Anonoying rootkit... not found 240s Searching for ZK rootkit... not found 240s Searching for ShKit rootkit... not found 240s Searching for AjaKit rootkit... not found 240s Searching for zaRwT rootkit... not found 240s Searching for Madalin rootkit... not found 240s Searching for Fu rootkit... not found 240s Searching for Kenga3 rootkit... not found 240s Searching for ESRK rootkit... not found 240s Searching for rootedoor... not found 240s Searching for ENYELKM rootkit... not found 240s Searching for common ssh-scanners... not found 240s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 240s Searching for Linux/Ebury 1.6... not found 240s Searching for 64-bit Linux Rootkit... not found 240s Searching for 64-bit Linux Rootkit modules... not found 240s Searching for Mumblehard... not found 240s Searching for Backdoor.Linux.Mokes.a... not found 240s Searching for Malicious TinyDNS... not found 240s Searching for Linux.Xor.DDoS... WARNING 240s 240s WARNING: Possible Linux.Xor.DDoS installed: 240s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 240s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 240s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 240s /tmp/clean/sed [Not from a Debian package] 240s /tmp/clean/ls [Not from a Debian package] 240s /tmp/clean/id [Not from a Debian package] 240s /tmp/clean/uname [Not from a Debian package] 240s /tmp/clean/awk [Not from a Debian package] 240s /tmp/clean/head [Not from a Debian package] 240s /tmp/clean/strings [Not from a Debian package] 240s /tmp/clean/cut [Not from a Debian package] 240s /tmp/clean/netstat [Not from a Debian package] 240s /tmp/clean/ss [Not from a Debian package] 240s /tmp/clean/find [Not from a Debian package] 240s /tmp/clean/ps [Not from a Debian package] 240s /tmp/clean/xargs [Not from a Debian package] 240s /tmp/clean/dpkg-query [Not from a Debian package] 240s /tmp/clean/dirname [Not from a Debian package] 240s /tmp/clean/echo [Not from a Debian package] 240s /tmp/clean/grep [Not from a Debian package] 240s 240s Searching for Linux.Proxy.1.0... not found 240s Searching for CrossRAT... not found 240s Searching for Hidden Cobra... not found 240s Searching for Rocke Miner rootkit... not found 240s Searching for PWNLNX4 lkm rootkit... not found 240s Searching for PWNLNX6 lkm rootkit... not found 240s Searching for Umbreon lrk... not found 240s Searching for Kinsing.a backdoor rootkit... not found 240s Searching for RotaJakiro backdoor rootkit... not found 240s Searching for Syslogk LKM rootkit... not found 240s Searching for Kovid LKM rootkit... not tested 240s Searching for Tsunami DDoS Malware rootkit... not found 240s Searching for Linux BPF Door... not found 240s Searching for suspect PHP files... not found 240s Searching for zero-size shell history files in /root... not found 240s Searching for hardlinked shell history files in /root... not found 240s Checking `aliens'... finished 240s Checking `asp'... not infected 240s Checking `bindshell'... not found 240s Checking `lkm'... started 240s Searching for Adore LKM... not tested 240s Searching for sebek LKM (Adore based)... not tested 240s Searching for knark LKM rootkit... not found 240s Searching for for hidden processes with chkproc... not found 240s Searching for for hidden directories using chkdirs... not found 240s Checking `lkm'... finished 240s Checking `rexedcs'... not found 240s Checking `sniffer'... WARNING 240s 240s WARNING: Output from ifpromisc: 240s lo: not promisc and no packet sniffer sockets 240s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 240s 240s Checking `w55808'... not found 240s Checking `wted'... not found 240s Checking `scalper'... not found 240s Checking `slapper'... not found 240s Checking `z2'... not found 240s Checking `chkutmp'... not found 240s Checking `OSX_RSPLUG'... not tested 240s **** Files in log 240s total 80K 240s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 240s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 240s -rw-r--r-- 1 root root 21K Nov 26 20:43 chkrootkit-daily.log 240s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today 240s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today.raw 240s *** Test of content of output follows... 240s **** Test for '^ROOTDIR is `/'$' 240s ROOTDIR is `/' 240s OK 240s **** Test for '^Checking `amd'\.\.\. not infected$' 240s Checking `amd'... not infected 240s OK 240s **** Test for '^Checking `basename'\.\.\. not infected$' 240s Checking `basename'... not infected 240s OK 240s **** Test for '^Checking `biff'\.\.\. not infected$' 240s Checking `biff'... not infected 240s OK 240s **** Test for '^Checking `chfn'\.\.\. not infected$' 240s Checking `chfn'... not infected 240s OK 240s **** Test for '^Checking `chsh'\.\.\. not infected$' 240s Checking `chsh'... not infected 240s OK 240s **** Test for '^Checking `cron'\.\.\. not infected$' 240s Checking `cron'... not infected 240s OK 240s **** Test for '^Checking `crontab'\.\.\. not infected$' 240s Checking `crontab'... not infected 240s OK 240s **** Test for '^Checking `date'\.\.\. not infected$' 240s Checking `date'... not infected 240s OK 240s **** Test for '^Checking `du'\.\.\. not infected$' 240s Checking `du'... not infected 240s OK 240s **** Test for '^Checking `dirname'\.\.\. not infected$' 240s Checking `dirname'... not infected 240s OK 240s **** Test for '^Checking `echo'\.\.\. not infected$' 240s Checking `echo'... not infected 240s OK 240s **** Test for '^Checking `egrep'\.\.\. not infected$' 240s Checking `egrep'... not infected 240s OK 240s **** Test for '^Checking `env'\.\.\. not infected$' 240s Checking `env'... not infected 240s OK 240s **** Test for '^Checking `find'\.\.\. not infected$' 240s Checking `find'... not infected 240s OK 240s **** Test for '^Checking `fingerd'\.\.\. not infected$' 240s Checking `fingerd'... not infected 240s OK 240s **** Test for '^Checking `gpm'\.\.\. not infected$' 240s Checking `gpm'... not infected 240s OK 240s **** Test for '^Checking `grep'\.\.\. not infected$' 240s Checking `grep'... not infected 240s OK 240s **** Test for '^Checking `hdparm'\.\.\. not infected$' 240s Checking `hdparm'... not infected 240s OK 240s **** Test for '^Checking `su'\.\.\. not infected$' 240s Checking `su'... not infected 240s OK 240s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 240s Checking `ifconfig'... not infected 240s OK 240s **** Test for '^Checking `inetd'\.\.\. not infected$' 240s Checking `inetd'... not infected 240s OK 240s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 240s Checking `inetdconf'... not infected 240s OK 240s **** Test for '^Checking `identd'\.\.\. not infected$' 240s Checking `identd'... not infected 240s OK 240s **** Test for '^Checking `init'\.\.\. not infected$' 240s Checking `init'... not infected 240s OK 240s **** Test for '^Checking `killall'\.\.\. not infected$' 240s Checking `killall'... not infected 240s OK 240s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 240s Checking `ldsopreload'... not infected 240s OK 240s **** Test for '^Checking `login'\.\.\. not infected$' 240s Checking `login'... not infected 240s OK 240s **** Test for '^Checking `ls'\.\.\. not infected$' 240s Checking `ls'... not infected 240s OK 240s **** Test for '^Checking `lsof'\.\.\. not infected$' 240s Checking `lsof'... not infected 240s OK 240s **** Test for '^Checking `mail'\.\.\. not infected$' 240s Checking `mail'... not infected 240s OK 240s **** Test for '^Checking `mingetty'\.\.\. not infected$' 240s Checking `mingetty'... not infected 240s OK 240s **** Test for '^Checking `netstat'\.\.\. not infected$' 240s Checking `netstat'... not infected 240s OK 240s **** Test for '^Checking `named'\.\.\. not infected$' 240s Checking `named'... not infected 240s OK 240s **** Test for '^Checking `passwd'\.\.\. not infected$' 240s Checking `passwd'... not infected 240s OK 240s **** Test for '^Checking `pidof'\.\.\. not infected$' 240s Checking `pidof'... not infected 240s OK 240s **** Test for '^Checking `pop2'\.\.\. not infected$' 240s Checking `pop2'... not infected 240s OK 240s **** Test for '^Checking `pop3'\.\.\. not infected$' 240s Checking `pop3'... not infected 240s OK 240s **** Test for '^Checking `ps'\.\.\. not infected$' 240s Checking `ps'... not infected 240s OK 240s **** Test for '^Checking `pstree'\.\.\. not infected$' 240s Checking `pstree'... not infected 240s OK 240s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 240s Checking `rpcinfo'... not infected 240s OK 240s **** Test for '^Checking `rlogind'\.\.\. not infected$' 240s Checking `rlogind'... not infected 240s OK 240s **** Test for '^Checking `rshd'\.\.\. not infected$' 240s Checking `rshd'... not infected 240s OK 240s **** Test for '^Checking `slogin'\.\.\. not infected$' 240s Checking `slogin'... not infected 240s OK 240s **** Test for '^Checking `sendmail'\.\.\. not infected$' 240s Checking `sendmail'... not infected 240s OK 240s **** Test for '^Checking `sshd'\.\.\. not infected$' 240s Checking `sshd'... not infected 240s OK 240s **** Test for '^Checking `syslogd'\.\.\. not infected$' 240s Checking `syslogd'... not infected 240s OK 240s **** Test for '^Checking `tar'\.\.\. not infected$' 240s Checking `tar'... not infected 240s OK 240s **** Test for '^Checking `tcpd'\.\.\. not infected$' 240s Checking `tcpd'... not infected 240s OK 240s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 240s Checking `tcpdump'... not infected 240s OK 240s **** Test for '^Checking `top'\.\.\. not infected$' 240s Checking `top'... not infected 240s OK 240s **** Test for '^Checking `telnetd'\.\.\. not infected$' 240s Checking `telnetd'... not infected 240s OK 240s **** Test for '^Checking `timed'\.\.\. not infected$' 240s Checking `timed'... not infected 240s OK 240s **** Test for '^Checking `traceroute'\.\.\. not infected$' 240s Checking `traceroute'... not infected 240s OK 240s **** Test for '^Checking `vdir'\.\.\. not infected$' 240s Checking `vdir'... not infected 240s OK 240s **** Test for '^Checking `w'\.\.\. not infected$' 240s Checking `w'... not infected 240s OK 240s **** Test for '^Checking `write'\.\.\. not infected$' 240s Checking `write'... not infected 240s OK 240s **** Test for '^Checking `aliens'\.\.\. started$' 240s Checking `aliens'... started 240s OK 240s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 240s Searching for suspicious files in /dev... not found 240s OK 240s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 240s Searching for known suspicious directories... not found 240s OK 240s **** Test for '^Searching for known suspicious files\.\.\. not found$' 240s Searching for known suspicious files... not found 240s OK 240s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 240s Searching for sniffer's logs... not found 240s OK 240s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 240s Searching for HiDrootkit rootkit... not found 240s OK 240s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 240s Searching for t0rn rootkit... not found 240s OK 240s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 240s Searching for t0rn v8 (or variation)... not found 240s OK 240s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 240s Searching for Lion rootkit... not found 240s OK 240s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 240s Searching for RSHA rootkit... not found 240s OK 240s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 240s Searching for RH-Sharpe rootkit... not found 240s OK 240s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 240s Searching for Ambient (ark) rootkit... not found 240s OK 240s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 240s Searching for suspicious files and dirs... WARNING 240s OK 240s **** Test for '^$' 240s 240s 240s 240s 240s 240s 240s OK 240s **** Test for 'The following suspicious files and directories were found:$' 240s WARNING: The following suspicious files and directories were found: 240s OK 240s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 240s /usr/lib/.1 [Not from a Debian package] 240s OK 240s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 240s /usr/lib/.1DIR [Not from a Debian package] 240s OK 240s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 240s /usr/lib/...DIR [Not from a Debian package] 240s OK 240s **** Test for '^CHANGED-IN-FILTER_bb \[Not from a Debian package\]$' 240s CHANGED-IN-FILTER_bb [Not from a Debian package] 240s OK 240s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 240s /usr/lib/... [Not from a Debian package] 240s OK 240s **** Test for '^Searching for LPD Worm\.\.\. not found$' 240s Searching for LPD Worm... not found 240s OK 240s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 240s Searching for Ramen Worm rootkit... not found 240s OK 240s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 240s Searching for Maniac rootkit... not found 240s OK 240s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 240s Searching for RK17 rootkit... not found 240s OK 240s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 240s Searching for Ducoci rootkit... not found 240s OK 240s **** Test for '^Searching for Adore Worm\.\.\. not found$' 240s Searching for Adore Worm... not found 240s OK 240s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 240s Searching for ShitC Worm... not found 240s OK 240s **** Test for '^Searching for Omega Worm\.\.\. not found$' 240s Searching for Omega Worm... not found 240s OK 240s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 240s Searching for Sadmind/IIS Worm... not found 240s OK 240s **** Test for '^Searching for MonKit\.\.\. not found$' 240s Searching for MonKit... not found 240s OK 240s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 240s Searching for Showtee rootkit... not found 240s OK 240s **** Test for '^Searching for OpticKit\.\.\. not found$' 240s Searching for OpticKit... not found 240s OK 240s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 240s Searching for T.R.K... not found 240s OK 240s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 240s Searching for Mithra rootkit... not found 240s OK 240s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 240s Searching for OBSD rootkit v1... not tested 240s OK 240s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 240s Searching for LOC rootkit... not found 240s OK 240s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 240s Searching for Romanian rootkit... not found 240s OK 240s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 240s Searching for HKRK rootkit... not found 240s OK 240s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 240s Searching for Suckit rootkit... not found 240s OK 240s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 240s Searching for Volc rootkit... not found 240s OK 240s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 240s Searching for Gold2 rootkit... not found 240s OK 240s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 240s Searching for TC2 rootkit... not found 240s OK 240s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 240s Searching for Anonoying rootkit... not found 240s OK 240s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 240s Searching for ZK rootkit... not found 240s OK 240s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 240s Searching for ShKit rootkit... not found 240s OK 240s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 240s Searching for AjaKit rootkit... not found 240s OK 240s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 240s Searching for zaRwT rootkit... not found 240s OK 240s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 240s Searching for Madalin rootkit... not found 240s OK 240s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 240s Searching for Fu rootkit... not found 240s OK 240s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 240s Searching for Kenga3 rootkit... not found 240s OK 240s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 240s Searching for ESRK rootkit... not found 240s OK 240s **** Test for '^Searching for rootedoor\.\.\. not found$' 240s Searching for rootedoor... not found 240s OK 240s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 240s Searching for ENYELKM rootkit... not found 240s OK 240s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 240s Searching for common ssh-scanners... not found 240s OK 240s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 240s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 240s OK 240s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 240s Searching for Linux/Ebury 1.6... not found 240s OK 240s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 240s Searching for 64-bit Linux Rootkit... not found 240s OK 240s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 240s Searching for 64-bit Linux Rootkit modules... not found 240s OK 240s **** Test for '^Searching for Mumblehard\.\.\. not found$' 240s Searching for Mumblehard... not found 240s OK 240s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 240s Searching for Backdoor.Linux.Mokes.a... not found 240s OK 240s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 240s Searching for Malicious TinyDNS... not found 240s OK 240s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 240s Searching for Linux.Xor.DDoS... WARNING 240s OK 240s **** Test for 'WARNING: Possible Linux\.Xor\.DDoS installed:$' 240s WARNING: Possible Linux.Xor.DDoS installed: 240s OK 240s **** Test for '^/tmp/clean/.+$' 240s /tmp/clean/sed [Not from a Debian package] 240s /tmp/clean/ls [Not from a Debian package] 240s /tmp/clean/id [Not from a Debian package] 240s /tmp/clean/uname [Not from a Debian package] 240s /tmp/clean/awk [Not from a Debian package] 240s /tmp/clean/head [Not from a Debian package] 240s /tmp/clean/strings [Not from a Debian package] 240s /tmp/clean/cut [Not from a Debian package] 240s /tmp/clean/netstat [Not from a Debian package] 240s /tmp/clean/ss [Not from a Debian package] 240s /tmp/clean/find [Not from a Debian package] 240s /tmp/clean/ps [Not from a Debian package] 240s /tmp/clean/xargs [Not from a Debian package] 240s /tmp/clean/dpkg-query [Not from a Debian package] 240s /tmp/clean/dirname [Not from a Debian package] 240s /tmp/clean/echo [Not from a Debian package] 240s /tmp/clean/grep [Not from a Debian package] 240s OK 240s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 240s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 240s OK 240s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 240s Searching for Linux.Proxy.1.0... not found 240s OK 240s **** Test for '^Searching for CrossRAT\.\.\. not found$' 240s Searching for CrossRAT... not found 240s OK 240s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 240s Searching for Hidden Cobra... not found 240s OK 240s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 240s Searching for Rocke Miner rootkit... not found 240s OK 240s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 240s Searching for PWNLNX4 lkm rootkit... not found 240s OK 240s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 240s Searching for PWNLNX6 lkm rootkit... not found 240s OK 240s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 240s Searching for Umbreon lrk... not found 240s OK 240s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 240s Searching for Kinsing.a backdoor rootkit... not found 240s OK 240s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 240s Searching for RotaJakiro backdoor rootkit... not found 240s OK 240s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 240s Searching for Syslogk LKM rootkit... not found 240s OK 240s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 240s Searching for Kovid LKM rootkit... not tested 240s OK 240s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 240s Searching for Tsunami DDoS Malware rootkit... not found 240s OK 240s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 240s Searching for Linux BPF Door... not found 240s OK 240s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 240s Searching for zero-size shell history files in /root... not found 240s OK 240s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 240s Searching for hardlinked shell history files in /root... not found 240s OK 240s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 240s Searching for suspect PHP files... not found 240s OK 240s **** Test for '^Checking `aliens'\.\.\. finished$' 240s Checking `aliens'... finished 240s OK 240s **** Test for '^Checking `asp'\.\.\. not infected$' 240s Checking `asp'... not infected 240s OK 240s **** Test for '^Checking `bindshell'\.\.\. not found' 240s Checking `bindshell'... not found 240s OK 240s **** Test for '^Checking `lkm'\.\.\. started$' 240s Checking `lkm'... started 240s OK 240s **** Test for '^Checking `rexedcs'\.\.\. not found$' 241s Checking `rexedcs'... not found 241s OK 241s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 241s Searching for for hidden processes with chkproc... not found 241s OK 241s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 241s Searching for for hidden directories using chkdirs... not found 241s OK 241s **** Test for '^Checking `lkm'\.\.\. finished$' 241s Checking `lkm'... finished 241s OK 241s **** Test for '^Searching for Adore LKM\.\.\. not tested' 241s Searching for Adore LKM... not tested 241s OK 241s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested' 241s Searching for sebek LKM (Adore based)... not tested 241s OK 241s **** Test for '^Searching for knark LKM rootkit\.\.\. not found' 241s Searching for knark LKM rootkit... not found 241s OK 241s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 241s Checking `sniffer'... WARNING 241s OK 241s **** Test for '^WARNING: Output from ifpromisc:$' 241s WARNING: Output from ifpromisc: 241s OK 241s **** Test for '^lo: not promisc and no packet sniffer sockets$' 241s lo: not promisc and no packet sniffer sockets 241s OK 241s **** Test for '^Checking `w55808'\.\.\. not found$' 241s Checking `w55808'... not found 241s OK 241s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 241s Checking `wted'... not found 241s OK 241s **** Test for '^Checking `scalper'\.\.\. not found$' 241s Checking `scalper'... not found 241s OK 241s **** Test for '^Checking `slapper'\.\.\. not found$' 241s Checking `slapper'... not found 241s OK 241s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 241s Checking `z2'... not found 241s OK 241s **** Test for '^Checking `chkutmp'\.\.\.' 241s Checking `chkutmp'... not found 241s OK 241s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 241s Checking `OSX_RSPLUG'... not tested 241s OK 241s ** PASS: Testing: cron-no-diff-mode-02-full-filter-and-ignore (chkrootkit-daily) done: PASS 241s *** Unexpected (unmatched) lines follow (for info): 241s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 241s * Testing: chkrootkit-daily (without diff mode, quiet output, no MAILTO) 241s ** Testing: cron-no-diff-mode-03-quiet (chkrootkit-daily) ... 241s *** Output 259s WARNING: The following suspicious files and directories were found: 259s /usr/lib/... [Not from a Debian package] 259s /usr/lib/.DIR-aaa [Not from a Debian package] 259s /usr/lib/.1DIR [Not from a Debian package] 259s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 259s /usr/lib/.bbb [Not from a Debian package] 259s /usr/lib/...DIR [Not from a Debian package] 259s /usr/lib/.aaa [Not from a Debian package] 259s /usr/lib/.1 [Not from a Debian package] 259s 259s WARNING: Possible Linux.Xor.DDoS installed: 259s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 259s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 259s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 259s /tmp/clean/sed [Not from a Debian package] 259s /tmp/clean/ls [Not from a Debian package] 259s /tmp/clean/id [Not from a Debian package] 259s /tmp/clean/uname [Not from a Debian package] 259s /tmp/clean/awk [Not from a Debian package] 259s /tmp/clean/head [Not from a Debian package] 259s /tmp/clean/strings [Not from a Debian package] 259s /tmp/clean/cut [Not from a Debian package] 259s /tmp/clean/netstat [Not from a Debian package] 259s /tmp/clean/ss [Not from a Debian package] 259s /tmp/clean/find [Not from a Debian package] 259s /tmp/clean/ps [Not from a Debian package] 259s /tmp/clean/xargs [Not from a Debian package] 259s /tmp/clean/dpkg-query [Not from a Debian package] 259s /tmp/clean/dirname [Not from a Debian package] 259s /tmp/clean/echo [Not from a Debian package] 259s /tmp/clean/grep [Not from a Debian package] 259s 259s WARNING: Output from ifpromisc: 259s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 259s 259s **** Files in log 259s total 44K 259s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 259s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 259s -rw-r--r-- 1 root root 11K Nov 26 20:43 chkrootkit-daily.log 259s -rw-r--r-- 1 root root 11K Nov 26 20:43 log.today 259s -rw-r--r-- 1 root root 11K Nov 26 20:43 log.today.raw 259s *** Test of content of output follows... 259s **** Test for '^WARNING: The following suspicious files and directories were found:$' 259s WARNING: The following suspicious files and directories were found: 259s OK 259s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 259s /usr/lib/.1 [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 259s /usr/lib/.aaa [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 259s /usr/lib/.1DIR [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 259s /usr/lib/...DIR [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 259s /usr/lib/.bbb [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 259s /usr/lib/.DIR-aaa [Not from a Debian package] 259s OK 259s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 259s /usr/lib/... [Not from a Debian package] 259s OK 259s **** Test for '^$' 259s 259s 259s 259s OK 259s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 259s WARNING: Possible Linux.Xor.DDoS installed: 259s OK 259s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 259s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 259s OK 259s **** Test for '^/tmp/clean/.+$' 259s /tmp/clean/sed [Not from a Debian package] 259s /tmp/clean/ls [Not from a Debian package] 259s /tmp/clean/id [Not from a Debian package] 259s /tmp/clean/uname [Not from a Debian package] 259s /tmp/clean/awk [Not from a Debian package] 259s /tmp/clean/head [Not from a Debian package] 259s /tmp/clean/strings [Not from a Debian package] 259s /tmp/clean/cut [Not from a Debian package] 259s /tmp/clean/netstat [Not from a Debian package] 259s /tmp/clean/ss [Not from a Debian package] 259s /tmp/clean/find [Not from a Debian package] 259s /tmp/clean/ps [Not from a Debian package] 259s /tmp/clean/xargs [Not from a Debian package] 259s /tmp/clean/dpkg-query [Not from a Debian package] 259s /tmp/clean/dirname [Not from a Debian package] 259s /tmp/clean/echo [Not from a Debian package] 259s /tmp/clean/grep [Not from a Debian package] 259s OK 259s ** PASS: Testing: cron-no-diff-mode-03-quiet (chkrootkit-daily) done: PASS 259s *** Unexpected (unmatched) lines follow (for info): 259s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 259s ** Testing: cron-no-diff-mode-04-quiet-no-ionice (chkrootkit-daily) ... 259s *** Output 276s WARNING: The following suspicious files and directories were found: 276s /usr/lib/... [Not from a Debian package] 276s /usr/lib/.DIR-aaa [Not from a Debian package] 276s /usr/lib/.1DIR [Not from a Debian package] 276s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 276s /usr/lib/.bbb [Not from a Debian package] 276s /usr/lib/...DIR [Not from a Debian package] 276s /usr/lib/.aaa [Not from a Debian package] 276s /usr/lib/.1 [Not from a Debian package] 276s 276s WARNING: Possible Linux.Xor.DDoS installed: 276s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 276s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 276s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 276s /tmp/clean/sed [Not from a Debian package] 276s /tmp/clean/ls [Not from a Debian package] 276s /tmp/clean/id [Not from a Debian package] 276s /tmp/clean/uname [Not from a Debian package] 276s /tmp/clean/awk [Not from a Debian package] 276s /tmp/clean/head [Not from a Debian package] 276s /tmp/clean/strings [Not from a Debian package] 276s /tmp/clean/cut [Not from a Debian package] 276s /tmp/clean/netstat [Not from a Debian package] 276s /tmp/clean/ss [Not from a Debian package] 276s /tmp/clean/find [Not from a Debian package] 276s /tmp/clean/ps [Not from a Debian package] 276s /tmp/clean/xargs [Not from a Debian package] 276s /tmp/clean/dpkg-query [Not from a Debian package] 276s /tmp/clean/dirname [Not from a Debian package] 276s /tmp/clean/echo [Not from a Debian package] 276s /tmp/clean/grep [Not from a Debian package] 276s 276s WARNING: Output from ifpromisc: 276s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 276s 276s **** Files in log 276s total 44K 276s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 276s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 276s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 276s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 276s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 276s *** Test of content of output follows... 276s **** Test for '^WARNING: The following suspicious files and directories were found:$' 276s WARNING: The following suspicious files and directories were found: 276s OK 276s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 276s /usr/lib/.1 [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 276s /usr/lib/.aaa [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 276s /usr/lib/.1DIR [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 276s /usr/lib/...DIR [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 276s /usr/lib/.bbb [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 276s /usr/lib/.DIR-aaa [Not from a Debian package] 276s OK 276s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 276s /usr/lib/... [Not from a Debian package] 276s OK 276s **** Test for '^$' 276s 276s 276s 276s OK 276s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 276s WARNING: Possible Linux.Xor.DDoS installed: 276s OK 276s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 276s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 276s OK 276s **** Test for '^/tmp/clean/.+$' 276s /tmp/clean/sed [Not from a Debian package] 276s /tmp/clean/ls [Not from a Debian package] 276s /tmp/clean/id [Not from a Debian package] 276s /tmp/clean/uname [Not from a Debian package] 276s /tmp/clean/awk [Not from a Debian package] 276s /tmp/clean/head [Not from a Debian package] 276s /tmp/clean/strings [Not from a Debian package] 276s /tmp/clean/cut [Not from a Debian package] 276s /tmp/clean/netstat [Not from a Debian package] 276s /tmp/clean/ss [Not from a Debian package] 276s /tmp/clean/find [Not from a Debian package] 276s /tmp/clean/ps [Not from a Debian package] 276s /tmp/clean/xargs [Not from a Debian package] 276s /tmp/clean/dpkg-query [Not from a Debian package] 276s /tmp/clean/dirname [Not from a Debian package] 276s /tmp/clean/echo [Not from a Debian package] 276s /tmp/clean/grep [Not from a Debian package] 276s OK 276s ** PASS: Testing: cron-no-diff-mode-04-quiet-no-ionice (chkrootkit-daily) done: PASS 276s *** Unexpected (unmatched) lines follow (for info): 276s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 276s ** Testing: cron-no-diff-mode-05-quiet-filter-and-ignore (chkrootkit-daily) ... 276s *** Output 293s WARNING: The following suspicious files and directories were found: 293s /usr/lib/... [Not from a Debian package] 293s /usr/lib/.DIR-aaa [Not from a Debian package] 293s /usr/lib/.1DIR [Not from a Debian package] 293s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 293s CHANGED-IN-FILTER_bb [Not from a Debian package] 293s /usr/lib/...DIR [Not from a Debian package] 293s /usr/lib/.1 [Not from a Debian package] 293s 293s WARNING: Possible Linux.Xor.DDoS installed: 293s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 293s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 293s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 293s /tmp/clean/sed [Not from a Debian package] 293s /tmp/clean/ls [Not from a Debian package] 293s /tmp/clean/id [Not from a Debian package] 293s /tmp/clean/uname [Not from a Debian package] 293s /tmp/clean/awk [Not from a Debian package] 293s /tmp/clean/head [Not from a Debian package] 293s /tmp/clean/strings [Not from a Debian package] 293s /tmp/clean/cut [Not from a Debian package] 293s /tmp/clean/netstat [Not from a Debian package] 293s /tmp/clean/ss [Not from a Debian package] 293s /tmp/clean/find [Not from a Debian package] 293s /tmp/clean/ps [Not from a Debian package] 293s /tmp/clean/xargs [Not from a Debian package] 293s /tmp/clean/dpkg-query [Not from a Debian package] 293s /tmp/clean/dirname [Not from a Debian package] 293s /tmp/clean/echo [Not from a Debian package] 293s /tmp/clean/grep [Not from a Debian package] 293s 293s WARNING: Output from ifpromisc: 293s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 293s 293s **** Files in log 293s total 44K 293s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 293s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 293s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 293s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 293s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 293s *** Test of content of output follows... 293s **** Test for 'WARNING: The following suspicious files and directories were found:$' 293s WARNING: The following suspicious files and directories were found: 293s OK 293s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 293s /usr/lib/.1 [Not from a Debian package] 293s OK 293s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 293s /usr/lib/.1DIR [Not from a Debian package] 293s OK 293s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 293s /usr/lib/...DIR [Not from a Debian package] 293s OK 293s **** Test for '^CHANGED-IN-FILTER_bb \[Not from a Debian package\]$' 293s CHANGED-IN-FILTER_bb [Not from a Debian package] 293s OK 293s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 293s /usr/lib/.DIR-aaa [Not from a Debian package] 293s OK 293s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 293s /usr/lib/... [Not from a Debian package] 293s OK 293s **** Test for '^$' 293s 293s 293s 293s OK 293s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 293s WARNING: Possible Linux.Xor.DDoS installed: 293s OK 293s **** Test for '^/tmp/clean/.+ \[Not from a Debian package\]$' 293s /tmp/clean/sed [Not from a Debian package] 293s /tmp/clean/ls [Not from a Debian package] 293s /tmp/clean/id [Not from a Debian package] 293s /tmp/clean/uname [Not from a Debian package] 293s /tmp/clean/awk [Not from a Debian package] 293s /tmp/clean/head [Not from a Debian package] 293s /tmp/clean/strings [Not from a Debian package] 293s /tmp/clean/cut [Not from a Debian package] 293s /tmp/clean/netstat [Not from a Debian package] 293s /tmp/clean/ss [Not from a Debian package] 293s /tmp/clean/find [Not from a Debian package] 293s /tmp/clean/ps [Not from a Debian package] 293s /tmp/clean/xargs [Not from a Debian package] 293s /tmp/clean/dpkg-query [Not from a Debian package] 293s /tmp/clean/dirname [Not from a Debian package] 293s /tmp/clean/echo [Not from a Debian package] 293s /tmp/clean/grep [Not from a Debian package] 293s OK 293s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 293s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 293s OK 293s ** PASS: Testing: cron-no-diff-mode-05-quiet-filter-and-ignore (chkrootkit-daily) done: PASS 293s *** Unexpected (unmatched) lines follow (for info): 293s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 293s ** Testing: cron-no-diff-mode-06-quiet-invalid-filter-is-ignored (chkrootkit-daily) ... 293s *** Output 293s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored' 312s WARNING: The following suspicious files and directories were found: 312s /usr/lib/... [Not from a Debian package] 312s /usr/lib/.DIR-aaa [Not from a Debian package] 312s /usr/lib/.1DIR [Not from a Debian package] 312s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 312s /usr/lib/.bbb [Not from a Debian package] 312s /usr/lib/...DIR [Not from a Debian package] 312s /usr/lib/.1 [Not from a Debian package] 312s 312s WARNING: Possible Linux.Xor.DDoS installed: 312s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 312s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 312s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 312s /tmp/clean/sed [Not from a Debian package] 312s /tmp/clean/ls [Not from a Debian package] 312s /tmp/clean/id [Not from a Debian package] 312s /tmp/clean/uname [Not from a Debian package] 312s /tmp/clean/awk [Not from a Debian package] 312s /tmp/clean/head [Not from a Debian package] 312s /tmp/clean/strings [Not from a Debian package] 312s /tmp/clean/cut [Not from a Debian package] 312s /tmp/clean/netstat [Not from a Debian package] 312s /tmp/clean/ss [Not from a Debian package] 312s /tmp/clean/find [Not from a Debian package] 312s /tmp/clean/ps [Not from a Debian package] 312s /tmp/clean/xargs [Not from a Debian package] 312s /tmp/clean/dpkg-query [Not from a Debian package] 312s /tmp/clean/dirname [Not from a Debian package] 312s /tmp/clean/echo [Not from a Debian package] 312s /tmp/clean/grep [Not from a Debian package] 312s 312s WARNING: Output from ifpromisc: 312s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 312s 312s **** Files in log 312s total 44K 312s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 312s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 312s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 312s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 312s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 312s *** Test of content of output follows... 312s **** Test for '^Ignoring invalid \$FILTER='sed s/this/is/invalid/sed/and/will/be/ignored'$' 312s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored' 312s OK 312s **** Test for '^WARNING: The following suspicious files and directories were found:$' 312s WARNING: The following suspicious files and directories were found: 312s OK 312s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 312s /usr/lib/.1 [Not from a Debian package] 312s OK 312s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 312s /usr/lib/.1DIR [Not from a Debian package] 312s OK 312s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 312s /usr/lib/...DIR [Not from a Debian package] 312s OK 312s **** Test for '^(/usr)?/lib/.bbb \[Not from a Debian package\]$' 312s /usr/lib/.bbb [Not from a Debian package] 312s OK 312s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 312s /usr/lib/.DIR-aaa [Not from a Debian package] 312s OK 312s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 312s /usr/lib/... [Not from a Debian package] 312s OK 312s **** Test for '^$' 312s 312s 312s 312s OK 312s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 312s WARNING: Possible Linux.Xor.DDoS installed: 312s OK 312s **** Test for '^/tmp/clean/.+$' 312s /tmp/clean/sed [Not from a Debian package] 312s /tmp/clean/ls [Not from a Debian package] 312s /tmp/clean/id [Not from a Debian package] 312s /tmp/clean/uname [Not from a Debian package] 312s /tmp/clean/awk [Not from a Debian package] 312s /tmp/clean/head [Not from a Debian package] 312s /tmp/clean/strings [Not from a Debian package] 312s /tmp/clean/cut [Not from a Debian package] 312s /tmp/clean/netstat [Not from a Debian package] 312s /tmp/clean/ss [Not from a Debian package] 312s /tmp/clean/find [Not from a Debian package] 312s /tmp/clean/ps [Not from a Debian package] 312s /tmp/clean/xargs [Not from a Debian package] 312s /tmp/clean/dpkg-query [Not from a Debian package] 312s /tmp/clean/dirname [Not from a Debian package] 312s /tmp/clean/echo [Not from a Debian package] 312s /tmp/clean/grep [Not from a Debian package] 312s OK 312s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 312s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 312s OK 312s ** PASS: Testing: cron-no-diff-mode-06-quiet-invalid-filter-is-ignored (chkrootkit-daily) done: PASS 312s *** Unexpected (unmatched) lines follow (for info): 312s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 312s * Testing: chkrootkit-daily (with DIFF_MODE, full output, no MAILTO) 312s ** Testing: cron-with-diff-mode-01-full (chkrootkit-daily) ... 312s *** Output 330s No file /var/log/chkrootkit/log.expected 330s This file should contain expected output from chkrootkit 330s 330s Today's run produced the following output: 330s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 330s ROOTDIR is `/' 330s Checking `amd'... not infected 330s Checking `basename'... not infected 330s Checking `biff'... not infected 330s Checking `chfn'... not infected 330s Checking `chsh'... not infected 330s Checking `cron'... not infected 330s Checking `crontab'... not infected 330s Checking `date'... not infected 330s Checking `du'... not infected 330s Checking `dirname'... not infected 330s Checking `echo'... not infected 330s Checking `egrep'... not infected 330s Checking `env'... not infected 330s Checking `find'... not infected 330s Checking `fingerd'... not infected 330s Checking `gpm'... not infected 330s Checking `grep'... not infected 330s Checking `hdparm'... not infected 330s Checking `su'... not infected 330s Checking `ifconfig'... not infected 330s Checking `inetd'... not infected 330s Checking `inetdconf'... not infected 330s Checking `identd'... not infected 330s Checking `init'... not infected 330s Checking `killall'... not infected 330s Checking `ldsopreload'... not infected 330s Checking `login'... not infected 330s Checking `ls'... not infected 330s Checking `lsof'... not infected 330s Checking `mail'... not infected 330s Checking `mingetty'... not infected 330s Checking `netstat'... not infected 330s Checking `named'... not infected 330s Checking `passwd'... not infected 330s Checking `pidof'... not infected 330s Checking `pop2'... not infected 330s Checking `pop3'... not infected 330s Checking `ps'... not infected 330s Checking `pstree'... not infected 330s Checking `rpcinfo'... not infected 330s Checking `rlogind'... not infected 330s Checking `rshd'... not infected 330s Checking `slogin'... not infected 330s Checking `sendmail'... not infected 330s Checking `sshd'... not infected 330s Checking `syslogd'... not infected 330s Checking `tar'... not infected 330s Checking `tcpd'... not infected 330s Checking `tcpdump'... not infected 330s Checking `top'... not infected 330s Checking `telnetd'... not infected 330s Checking `timed'... not infected 330s Checking `traceroute'... not infected 330s Checking `vdir'... not infected 330s Checking `w'... not infected 330s Checking `write'... not infected 330s Checking `aliens'... started 330s Searching for suspicious files in /dev... not found 330s Searching for known suspicious directories... not found 330s Searching for known suspicious files... not found 330s Searching for sniffer's logs... not found 330s Searching for HiDrootkit rootkit... not found 330s Searching for t0rn rootkit... not found 330s Searching for t0rn v8 (or variation)... not found 330s Searching for Lion rootkit... not found 330s Searching for RSHA rootkit... not found 330s Searching for RH-Sharpe rootkit... not found 330s Searching for Ambient (ark) rootkit... not found 330s Searching for suspicious files and dirs... WARNING 330s 330s WARNING: The following suspicious files and directories were found: 330s /usr/lib/... [Not from a Debian package] 330s /usr/lib/.DIR-aaa [Not from a Debian package] 330s /usr/lib/.1DIR [Not from a Debian package] 330s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 330s /usr/lib/.bbb [Not from a Debian package] 330s /usr/lib/...DIR [Not from a Debian package] 330s /usr/lib/.aaa [Not from a Debian package] 330s /usr/lib/.1 [Not from a Debian package] 330s 330s Searching for LPD Worm... not found 330s Searching for Ramen Worm rootkit... not found 330s Searching for Maniac rootkit... not found 330s Searching for RK17 rootkit... not found 330s Searching for Ducoci rootkit... not found 330s Searching for Adore Worm... not found 330s Searching for ShitC Worm... not found 330s Searching for Omega Worm... not found 330s Searching for Sadmind/IIS Worm... not found 330s Searching for MonKit... not found 330s Searching for Showtee rootkit... not found 330s Searching for OpticKit... not found 330s Searching for T.R.K... not found 330s Searching for Mithra rootkit... not found 330s Searching for OBSD rootkit v1... not tested 330s Searching for LOC rootkit... not found 330s Searching for Romanian rootkit... not found 330s Searching for HKRK rootkit... not found 330s Searching for Suckit rootkit... not found 330s Searching for Volc rootkit... not found 330s Searching for Gold2 rootkit... not found 330s Searching for TC2 rootkit... not found 330s Searching for Anonoying rootkit... not found 330s Searching for ZK rootkit... not found 330s Searching for ShKit rootkit... not found 330s Searching for AjaKit rootkit... not found 330s Searching for zaRwT rootkit... not found 330s Searching for Madalin rootkit... not found 330s Searching for Fu rootkit... not found 330s Searching for Kenga3 rootkit... not found 330s Searching for ESRK rootkit... not found 330s Searching for rootedoor... not found 330s Searching for ENYELKM rootkit... not found 330s Searching for common ssh-scanners... not found 330s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 330s Searching for Linux/Ebury 1.6... not found 330s Searching for 64-bit Linux Rootkit... not found 330s Searching for 64-bit Linux Rootkit modules... not found 330s Searching for Mumblehard... not found 330s Searching for Backdoor.Linux.Mokes.a... not found 330s Searching for Malicious TinyDNS... not found 330s Searching for Linux.Xor.DDoS... WARNING 330s 330s WARNING: Possible Linux.Xor.DDoS installed: 330s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 330s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 330s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 330s /tmp/clean/sed [Not from a Debian package] 330s /tmp/clean/ls [Not from a Debian package] 330s /tmp/clean/id [Not from a Debian package] 330s /tmp/clean/uname [Not from a Debian package] 330s /tmp/clean/awk [Not from a Debian package] 330s /tmp/clean/head [Not from a Debian package] 330s /tmp/clean/strings [Not from a Debian package] 330s /tmp/clean/cut [Not from a Debian package] 330s /tmp/clean/netstat [Not from a Debian package] 330s /tmp/clean/ss [Not from a Debian package] 330s /tmp/clean/find [Not from a Debian package] 330s /tmp/clean/ps [Not from a Debian package] 330s /tmp/clean/xargs [Not from a Debian package] 330s /tmp/clean/dpkg-query [Not from a Debian package] 330s /tmp/clean/dirname [Not from a Debian package] 330s /tmp/clean/echo [Not from a Debian package] 330s /tmp/clean/grep [Not from a Debian package] 330s 330s Searching for Linux.Proxy.1.0... not found 330s Searching for CrossRAT... not found 330s Searching for Hidden Cobra... not found 330s Searching for Rocke Miner rootkit... not found 330s Searching for PWNLNX4 lkm rootkit... not found 330s Searching for PWNLNX6 lkm rootkit... not found 330s Searching for Umbreon lrk... not found 330s Searching for Kinsing.a backdoor rootkit... not found 330s Searching for RotaJakiro backdoor rootkit... not found 330s Searching for Syslogk LKM rootkit... not found 330s Searching for Kovid LKM rootkit... not tested 330s Searching for Tsunami DDoS Malware rootkit... not found 330s Searching for Linux BPF Door... not found 330s Searching for suspect PHP files... not found 330s Searching for zero-size shell history files in /root... not found 330s Searching for hardlinked shell history files in /root... not found 330s Checking `aliens'... finished 330s Checking `asp'... not infected 330s Checking `bindshell'... not found 330s Checking `lkm'... started 330s Searching for Adore LKM... not tested 330s Searching for sebek LKM (Adore based)... not tested 330s Searching for knark LKM rootkit... not found 330s Searching for for hidden processes with chkproc... not found 330s Searching for for hidden directories using chkdirs... not found 330s Checking `lkm'... finished 330s Checking `rexedcs'... not found 330s Checking `sniffer'... WARNING 330s 330s WARNING: Output from ifpromisc: 330s lo: not promisc and no packet sniffer sockets 330s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 330s 330s Checking `w55808'... not found 330s Checking `wted'... not found 330s Checking `scalper'... not found 330s Checking `slapper'... not found 330s Checking `z2'... not found 330s Checking `chkutmp'... not found 330s Checking `OSX_RSPLUG'... not tested 330s --- [ END: cat /var/log/chkrootkit/log.today ] --- 330s 330s To create this file containing all output from today's run, do (as root) 330s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 330s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 330s **** Files in log 330s total 80K 330s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 330s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 330s -rw-r--r-- 1 root root 22K Nov 26 20:44 chkrootkit-daily.log 330s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today 330s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today.raw 330s *** Test of content of output follows... 330s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 330s No file /var/log/chkrootkit/log.expected 330s OK 330s **** Test for '^This file should contain expected output from chkrootkit$' 330s This file should contain expected output from chkrootkit 330s OK 330s **** Test for '^$' 330s 330s 330s 330s 330s 330s 330s 330s 330s OK 330s **** Test for '^Today's run produced the following output:$' 330s Today's run produced the following output: 330s OK 330s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 330s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 330s OK 330s **** Test for '^ROOTDIR is `/'$' 330s ROOTDIR is `/' 330s OK 330s **** Test for '^Checking `amd'\.\.\. not infected$' 330s Checking `amd'... not infected 330s OK 330s **** Test for '^Checking `basename'\.\.\. not infected$' 330s Checking `basename'... not infected 330s OK 330s **** Test for '^Checking `biff'\.\.\. not infected$' 330s Checking `biff'... not infected 330s OK 330s **** Test for '^Checking `chfn'\.\.\. not infected$' 330s Checking `chfn'... not infected 330s OK 330s **** Test for '^Checking `chsh'\.\.\. not infected$' 330s Checking `chsh'... not infected 330s OK 330s **** Test for '^Checking `cron'\.\.\. not infected$' 330s Checking `cron'... not infected 330s OK 330s **** Test for '^Checking `crontab'\.\.\. not infected$' 330s Checking `crontab'... not infected 330s OK 330s **** Test for '^Checking `date'\.\.\. not infected$' 330s Checking `date'... not infected 330s OK 330s **** Test for '^Checking `du'\.\.\. not infected$' 330s Checking `du'... not infected 330s OK 330s **** Test for '^Checking `dirname'\.\.\. not infected$' 330s Checking `dirname'... not infected 330s OK 330s **** Test for '^Checking `echo'\.\.\. not infected$' 330s Checking `echo'... not infected 330s OK 330s **** Test for '^Checking `egrep'\.\.\. not infected$' 330s Checking `egrep'... not infected 330s OK 330s **** Test for '^Checking `env'\.\.\. not infected$' 330s Checking `env'... not infected 330s OK 330s **** Test for '^Checking `find'\.\.\. not infected$' 330s Checking `find'... not infected 330s OK 330s **** Test for '^Checking `fingerd'\.\.\. not infected$' 330s Checking `fingerd'... not infected 330s OK 330s **** Test for '^Checking `gpm'\.\.\. not infected$' 330s Checking `gpm'... not infected 330s OK 330s **** Test for '^Checking `grep'\.\.\. not infected$' 330s Checking `grep'... not infected 330s OK 330s **** Test for '^Checking `hdparm'\.\.\. not infected$' 330s Checking `hdparm'... not infected 330s OK 330s **** Test for '^Checking `su'\.\.\. not infected$' 330s Checking `su'... not infected 330s OK 330s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 330s Checking `ifconfig'... not infected 330s OK 330s **** Test for '^Checking `inetd'\.\.\. not infected$' 330s Checking `inetd'... not infected 330s OK 330s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 330s Checking `inetdconf'... not infected 330s OK 330s **** Test for '^Checking `identd'\.\.\. not infected$' 330s Checking `identd'... not infected 330s OK 330s **** Test for '^Checking `init'\.\.\. not infected$' 330s Checking `init'... not infected 330s OK 330s **** Test for '^Checking `killall'\.\.\. not infected$' 330s Checking `killall'... not infected 330s OK 330s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 330s Checking `ldsopreload'... not infected 330s OK 330s **** Test for '^Checking `login'\.\.\. not infected$' 330s Checking `login'... not infected 330s OK 330s **** Test for '^Checking `ls'\.\.\. not infected$' 330s Checking `ls'... not infected 330s OK 330s **** Test for '^Checking `lsof'\.\.\. not infected$' 330s Checking `lsof'... not infected 330s OK 330s **** Test for '^Checking `mail'\.\.\. not infected$' 330s Checking `mail'... not infected 330s OK 330s **** Test for '^Checking `mingetty'\.\.\. not infected$' 330s Checking `mingetty'... not infected 330s OK 330s **** Test for '^Checking `netstat'\.\.\. not infected$' 330s Checking `netstat'... not infected 330s OK 330s **** Test for '^Checking `named'\.\.\. not infected$' 330s Checking `named'... not infected 330s OK 330s **** Test for '^Checking `passwd'\.\.\. not infected$' 330s Checking `passwd'... not infected 330s OK 330s **** Test for '^Checking `pidof'\.\.\. not infected$' 330s Checking `pidof'... not infected 330s OK 330s **** Test for '^Checking `pop2'\.\.\. not infected$' 330s Checking `pop2'... not infected 330s OK 330s **** Test for '^Checking `pop3'\.\.\. not infected$' 330s Checking `pop3'... not infected 330s OK 330s **** Test for '^Checking `ps'\.\.\. not infected$' 330s Checking `ps'... not infected 330s OK 330s **** Test for '^Checking `pstree'\.\.\. not infected$' 330s Checking `pstree'... not infected 330s OK 330s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 330s Checking `rpcinfo'... not infected 330s OK 330s **** Test for '^Checking `rlogind'\.\.\. not infected$' 330s Checking `rlogind'... not infected 330s OK 330s **** Test for '^Checking `rshd'\.\.\. not infected$' 330s Checking `rshd'... not infected 330s OK 330s **** Test for '^Checking `slogin'\.\.\. not infected$' 330s Checking `slogin'... not infected 330s OK 330s **** Test for '^Checking `sendmail'\.\.\. not infected$' 330s Checking `sendmail'... not infected 330s OK 330s **** Test for '^Checking `sshd'\.\.\. not infected$' 330s Checking `sshd'... not infected 330s OK 330s **** Test for '^Checking `syslogd'\.\.\. not infected$' 330s Checking `syslogd'... not infected 330s OK 330s **** Test for '^Checking `tar'\.\.\. not infected$' 330s Checking `tar'... not infected 330s OK 330s **** Test for '^Checking `tcpd'\.\.\. not infected$' 330s Checking `tcpd'... not infected 330s OK 330s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 330s Checking `tcpdump'... not infected 330s OK 330s **** Test for '^Checking `top'\.\.\. not infected$' 330s Checking `top'... not infected 330s OK 330s **** Test for '^Checking `telnetd'\.\.\. not infected$' 330s Checking `telnetd'... not infected 330s OK 330s **** Test for '^Checking `timed'\.\.\. not infected$' 330s Checking `timed'... not infected 330s OK 330s **** Test for '^Checking `traceroute'\.\.\. not infected$' 330s Checking `traceroute'... not infected 330s OK 330s **** Test for '^Checking `vdir'\.\.\. not infected$' 330s Checking `vdir'... not infected 330s OK 330s **** Test for '^Checking `w'\.\.\. not infected$' 330s Checking `w'... not infected 330s OK 330s **** Test for '^Checking `write'\.\.\. not infected$' 330s Checking `write'... not infected 330s OK 330s **** Test for '^Checking `aliens'\.\.\. started$' 330s Checking `aliens'... started 330s OK 330s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 330s Searching for suspicious files in /dev... not found 330s OK 330s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 330s Searching for known suspicious directories... not found 330s OK 330s **** Test for '^Searching for known suspicious files\.\.\. not found$' 330s Searching for known suspicious files... not found 330s OK 330s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 330s Searching for sniffer's logs... not found 330s OK 330s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 330s Searching for HiDrootkit rootkit... not found 330s OK 330s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 330s Searching for t0rn rootkit... not found 330s OK 330s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 330s Searching for t0rn v8 (or variation)... not found 330s OK 330s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 330s Searching for Lion rootkit... not found 330s OK 330s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 330s Searching for RSHA rootkit... not found 330s OK 330s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 330s Searching for RH-Sharpe rootkit... not found 330s OK 330s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 330s Searching for Ambient (ark) rootkit... not found 330s OK 330s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 330s Searching for suspicious files and dirs... WARNING 330s OK 330s **** Test for '^WARNING: The following suspicious files and directories were found:$' 330s WARNING: The following suspicious files and directories were found: 330s OK 330s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 330s /usr/lib/.1 [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 330s /usr/lib/.aaa [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 330s /usr/lib/.1DIR [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 330s /usr/lib/...DIR [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 330s /usr/lib/.bbb [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 330s /usr/lib/.DIR-aaa [Not from a Debian package] 330s OK 330s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 330s /usr/lib/... [Not from a Debian package] 330s OK 330s **** Test for '^$' 330s 330s 330s 330s 330s 330s 330s 330s 330s OK 330s **** Test for '^Searching for LPD Worm\.\.\. not found$' 330s Searching for LPD Worm... not found 330s OK 330s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 330s Searching for Ramen Worm rootkit... not found 330s OK 330s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 330s Searching for Maniac rootkit... not found 330s OK 330s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 330s Searching for RK17 rootkit... not found 330s OK 330s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 330s Searching for Ducoci rootkit... not found 330s OK 330s **** Test for '^Searching for Adore Worm\.\.\. not found$' 330s Searching for Adore Worm... not found 330s OK 330s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 330s Searching for ShitC Worm... not found 330s OK 330s **** Test for '^Searching for Omega Worm\.\.\. not found$' 331s Searching for Omega Worm... not found 331s OK 331s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 331s Searching for Sadmind/IIS Worm... not found 331s OK 331s **** Test for '^Searching for MonKit\.\.\. not found$' 331s Searching for MonKit... not found 331s OK 331s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 331s Searching for Showtee rootkit... not found 331s OK 331s **** Test for '^Searching for OpticKit\.\.\. not found$' 331s Searching for OpticKit... not found 331s OK 331s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 331s Searching for T.R.K... not found 331s OK 331s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 331s Searching for Mithra rootkit... not found 331s OK 331s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 331s Searching for OBSD rootkit v1... not tested 331s OK 331s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 331s Searching for LOC rootkit... not found 331s OK 331s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 331s Searching for Romanian rootkit... not found 331s OK 331s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 331s Searching for HKRK rootkit... not found 331s OK 331s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 331s Searching for Suckit rootkit... not found 331s OK 331s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 331s Searching for Volc rootkit... not found 331s OK 331s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 331s Searching for Gold2 rootkit... not found 331s OK 331s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 331s Searching for TC2 rootkit... not found 331s OK 331s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 331s Searching for Anonoying rootkit... not found 331s OK 331s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 331s Searching for ZK rootkit... not found 331s OK 331s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 331s Searching for ShKit rootkit... not found 331s OK 331s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 331s Searching for AjaKit rootkit... not found 331s OK 331s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 331s Searching for zaRwT rootkit... not found 331s OK 331s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 331s Searching for Madalin rootkit... not found 331s OK 331s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 331s Searching for Fu rootkit... not found 331s OK 331s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 331s Searching for Kenga3 rootkit... not found 331s OK 331s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 331s Searching for ESRK rootkit... not found 331s OK 331s **** Test for '^Searching for rootedoor\.\.\. not found$' 331s Searching for rootedoor... not found 331s OK 331s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 331s Searching for ENYELKM rootkit... not found 331s OK 331s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 331s Searching for common ssh-scanners... not found 331s OK 331s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 331s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 331s OK 331s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 331s Searching for Linux/Ebury 1.6... not found 331s OK 331s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 331s Searching for 64-bit Linux Rootkit... not found 331s OK 331s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 331s Searching for 64-bit Linux Rootkit modules... not found 331s OK 331s **** Test for '^Searching for Mumblehard\.\.\. not found$' 331s Searching for Mumblehard... not found 331s OK 331s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 331s Searching for Backdoor.Linux.Mokes.a... not found 331s OK 331s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 331s Searching for Malicious TinyDNS... not found 331s OK 331s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 331s Searching for Linux.Xor.DDoS... WARNING 331s OK 331s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 331s WARNING: Possible Linux.Xor.DDoS installed: 331s OK 331s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 331s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 331s OK 331s **** Test for '^/tmp/clean/.+$' 331s /tmp/clean/sed [Not from a Debian package] 331s /tmp/clean/ls [Not from a Debian package] 331s /tmp/clean/id [Not from a Debian package] 331s /tmp/clean/uname [Not from a Debian package] 331s /tmp/clean/awk [Not from a Debian package] 331s /tmp/clean/head [Not from a Debian package] 331s /tmp/clean/strings [Not from a Debian package] 331s /tmp/clean/cut [Not from a Debian package] 331s /tmp/clean/netstat [Not from a Debian package] 331s /tmp/clean/ss [Not from a Debian package] 331s /tmp/clean/find [Not from a Debian package] 331s /tmp/clean/ps [Not from a Debian package] 331s /tmp/clean/xargs [Not from a Debian package] 331s /tmp/clean/dpkg-query [Not from a Debian package] 331s /tmp/clean/dirname [Not from a Debian package] 331s /tmp/clean/echo [Not from a Debian package] 331s /tmp/clean/grep [Not from a Debian package] 331s OK 331s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 331s Searching for Linux.Proxy.1.0... not found 331s OK 331s **** Test for '^Searching for CrossRAT\.\.\. not found$' 331s Searching for CrossRAT... not found 331s OK 331s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 331s Searching for Hidden Cobra... not found 331s OK 331s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 331s Searching for Rocke Miner rootkit... not found 331s OK 331s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 331s Searching for PWNLNX4 lkm rootkit... not found 331s OK 331s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 331s Searching for PWNLNX6 lkm rootkit... not found 331s OK 331s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 331s Searching for Umbreon lrk... not found 331s OK 331s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 331s Searching for Kinsing.a backdoor rootkit... not found 331s OK 331s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 331s Searching for RotaJakiro backdoor rootkit... not found 331s OK 331s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 331s Searching for Syslogk LKM rootkit... not found 331s OK 331s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 331s Searching for Kovid LKM rootkit... not tested 331s OK 331s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 331s Searching for Tsunami DDoS Malware rootkit... not found 331s OK 331s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 331s Searching for Linux BPF Door... not found 331s OK 331s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 331s Searching for suspect PHP files... not found 331s OK 331s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 331s Searching for zero-size shell history files in /root... not found 331s OK 331s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 331s Searching for hardlinked shell history files in /root... not found 331s OK 331s **** Test for '^Checking `aliens'\.\.\. finished$' 331s Checking `aliens'... finished 331s OK 331s **** Test for '^Checking `asp'\.\.\. not infected$' 331s Checking `asp'... not infected 331s OK 331s **** Test for '^Checking `bindshell'\.\.\. not found$' 331s Checking `bindshell'... not found 331s OK 331s **** Test for '^Checking `lkm'\.\.\. started$' 331s Checking `lkm'... started 331s OK 331s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 331s Searching for Adore LKM... not tested 331s OK 331s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 331s Searching for sebek LKM (Adore based)... not tested 331s OK 331s **** Test for '^Searching for knark LKM rootkit... not found$' 331s Searching for knark LKM rootkit... not found 331s OK 331s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 331s Searching for for hidden processes with chkproc... not found 331s OK 331s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 331s Searching for for hidden directories using chkdirs... not found 331s OK 331s **** Test for '^Checking `lkm'\.\.\. finished$' 331s Checking `lkm'... finished 331s OK 331s **** Test for '^Checking `rexedcs'\.\.\. not found$' 331s Checking `rexedcs'... not found 331s OK 331s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 331s Checking `sniffer'... WARNING 331s OK 331s **** Test for '^WARNING: Output from ifpromisc:$' 331s WARNING: Output from ifpromisc: 331s OK 331s **** Test for '^lo: not promisc and no packet sniffer sockets$' 331s lo: not promisc and no packet sniffer sockets 331s OK 331s **** Test for '^Checking `w55808'\.\.\. not found$' 331s Checking `w55808'... not found 331s OK 331s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 331s Checking `wted'... not found 331s OK 331s **** Test for '^Checking `scalper'\.\.\. not found$' 331s Checking `scalper'... not found 331s OK 331s **** Test for '^Checking `slapper'\.\.\. not found$' 331s Checking `slapper'... not found 331s OK 331s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 331s Checking `z2'... not found 331s OK 331s **** Test for '^Checking `chkutmp'\.\.\.' 331s Checking `chkutmp'... not found 331s OK 331s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 331s Checking `OSX_RSPLUG'... not tested 331s OK 331s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 331s --- [ END: cat /var/log/chkrootkit/log.today ] --- 331s OK 331s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 331s To create this file containing all output from today's run, do (as root) 331s OK 331s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 331s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 331s OK 331s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 331s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 331s OK 331s ** PASS: Testing: cron-with-diff-mode-01-full (chkrootkit-daily) done: PASS 331s *** Unexpected (unmatched) lines follow (for info): 331s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 331s ** Testing: cron-with-diff-mode-02-full-rerun (chkrootkit-daily) ... 331s *** Output 348s No file /var/log/chkrootkit/log.expected 348s This file should contain expected output from chkrootkit 348s 348s Today's run produced the following output: 348s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 348s ROOTDIR is `/' 348s Checking `amd'... not infected 348s Checking `basename'... not infected 348s Checking `biff'... not infected 348s Checking `chfn'... not infected 348s Checking `chsh'... not infected 348s Checking `cron'... not infected 348s Checking `crontab'... not infected 348s Checking `date'... not infected 348s Checking `du'... not infected 348s Checking `dirname'... not infected 348s Checking `echo'... not infected 348s Checking `egrep'... not infected 348s Checking `env'... not infected 348s Checking `find'... not infected 348s Checking `fingerd'... not infected 348s Checking `gpm'... not infected 348s Checking `grep'... not infected 348s Checking `hdparm'... not infected 348s Checking `su'... not infected 348s Checking `ifconfig'... not infected 348s Checking `inetd'... not infected 348s Checking `inetdconf'... not infected 348s Checking `identd'... not infected 348s Checking `init'... not infected 348s Checking `killall'... not infected 348s Checking `ldsopreload'... not infected 348s Checking `login'... not infected 348s Checking `ls'... not infected 348s Checking `lsof'... not infected 348s Checking `mail'... not infected 348s Checking `mingetty'... not infected 348s Checking `netstat'... not infected 348s Checking `named'... not infected 348s Checking `passwd'... not infected 348s Checking `pidof'... not infected 348s Checking `pop2'... not infected 348s Checking `pop3'... not infected 348s Checking `ps'... not infected 348s Checking `pstree'... not infected 348s Checking `rpcinfo'... not infected 348s Checking `rlogind'... not infected 348s Checking `rshd'... not infected 348s Checking `slogin'... not infected 348s Checking `sendmail'... not infected 348s Checking `sshd'... not infected 348s Checking `syslogd'... not infected 348s Checking `tar'... not infected 348s Checking `tcpd'... not infected 348s Checking `tcpdump'... not infected 348s Checking `top'... not infected 348s Checking `telnetd'... not infected 348s Checking `timed'... not infected 348s Checking `traceroute'... not infected 348s Checking `vdir'... not infected 348s Checking `w'... not infected 348s Checking `write'... not infected 348s Checking `aliens'... started 348s Searching for suspicious files in /dev... not found 348s Searching for known suspicious directories... not found 348s Searching for known suspicious files... not found 348s Searching for sniffer's logs... not found 348s Searching for HiDrootkit rootkit... not found 348s Searching for t0rn rootkit... not found 348s Searching for t0rn v8 (or variation)... not found 348s Searching for Lion rootkit... not found 348s Searching for RSHA rootkit... not found 348s Searching for RH-Sharpe rootkit... not found 348s Searching for Ambient (ark) rootkit... not found 348s Searching for suspicious files and dirs... WARNING 348s 348s WARNING: The following suspicious files and directories were found: 348s /usr/lib/... [Not from a Debian package] 348s /usr/lib/.DIR-aaa [Not from a Debian package] 348s /usr/lib/.1DIR [Not from a Debian package] 348s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 348s /usr/lib/.bbb [Not from a Debian package] 348s /usr/lib/...DIR [Not from a Debian package] 348s /usr/lib/.aaa [Not from a Debian package] 348s /usr/lib/.1 [Not from a Debian package] 348s 348s Searching for LPD Worm... not found 348s Searching for Ramen Worm rootkit... not found 348s Searching for Maniac rootkit... not found 348s Searching for RK17 rootkit... not found 348s Searching for Ducoci rootkit... not found 348s Searching for Adore Worm... not found 348s Searching for ShitC Worm... not found 348s Searching for Omega Worm... not found 348s Searching for Sadmind/IIS Worm... not found 348s Searching for MonKit... not found 348s Searching for Showtee rootkit... not found 348s Searching for OpticKit... not found 348s Searching for T.R.K... not found 348s Searching for Mithra rootkit... not found 348s Searching for OBSD rootkit v1... not tested 348s Searching for LOC rootkit... not found 348s Searching for Romanian rootkit... not found 348s Searching for HKRK rootkit... not found 348s Searching for Suckit rootkit... not found 348s Searching for Volc rootkit... not found 348s Searching for Gold2 rootkit... not found 348s Searching for TC2 rootkit... not found 348s Searching for Anonoying rootkit... not found 348s Searching for ZK rootkit... not found 348s Searching for ShKit rootkit... not found 348s Searching for AjaKit rootkit... not found 348s Searching for zaRwT rootkit... not found 348s Searching for Madalin rootkit... not found 348s Searching for Fu rootkit... not found 348s Searching for Kenga3 rootkit... not found 348s Searching for ESRK rootkit... not found 348s Searching for rootedoor... not found 348s Searching for ENYELKM rootkit... not found 348s Searching for common ssh-scanners... not found 348s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 348s Searching for Linux/Ebury 1.6... not found 348s Searching for 64-bit Linux Rootkit... not found 348s Searching for 64-bit Linux Rootkit modules... not found 348s Searching for Mumblehard... not found 348s Searching for Backdoor.Linux.Mokes.a... not found 348s Searching for Malicious TinyDNS... not found 348s Searching for Linux.Xor.DDoS... WARNING 348s 348s WARNING: Possible Linux.Xor.DDoS installed: 348s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 348s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 348s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 348s /tmp/clean/sed [Not from a Debian package] 348s /tmp/clean/ls [Not from a Debian package] 348s /tmp/clean/id [Not from a Debian package] 348s /tmp/clean/uname [Not from a Debian package] 348s /tmp/clean/awk [Not from a Debian package] 348s /tmp/clean/head [Not from a Debian package] 348s /tmp/clean/strings [Not from a Debian package] 348s /tmp/clean/cut [Not from a Debian package] 348s /tmp/clean/netstat [Not from a Debian package] 348s /tmp/clean/ss [Not from a Debian package] 348s /tmp/clean/find [Not from a Debian package] 348s /tmp/clean/ps [Not from a Debian package] 348s /tmp/clean/xargs [Not from a Debian package] 348s /tmp/clean/dpkg-query [Not from a Debian package] 348s /tmp/clean/dirname [Not from a Debian package] 348s /tmp/clean/echo [Not from a Debian package] 348s /tmp/clean/grep [Not from a Debian package] 348s 348s Searching for Linux.Proxy.1.0... not found 348s Searching for CrossRAT... not found 348s Searching for Hidden Cobra... not found 348s Searching for Rocke Miner rootkit... not found 348s Searching for PWNLNX4 lkm rootkit... not found 348s Searching for PWNLNX6 lkm rootkit... not found 348s Searching for Umbreon lrk... not found 348s Searching for Kinsing.a backdoor rootkit... not found 348s Searching for RotaJakiro backdoor rootkit... not found 348s Searching for Syslogk LKM rootkit... not found 348s Searching for Kovid LKM rootkit... not tested 348s Searching for Tsunami DDoS Malware rootkit... not found 348s Searching for Linux BPF Door... not found 348s Searching for suspect PHP files... not found 348s Searching for zero-size shell history files in /root... not found 348s Searching for hardlinked shell history files in /root... not found 348s Checking `aliens'... finished 348s Checking `asp'... not infected 348s Checking `bindshell'... not found 348s Checking `lkm'... started 348s Searching for Adore LKM... not tested 348s Searching for sebek LKM (Adore based)... not tested 348s Searching for knark LKM rootkit... not found 348s Searching for for hidden processes with chkproc... not found 348s Searching for for hidden directories using chkdirs... not found 348s Checking `lkm'... finished 348s Checking `rexedcs'... not found 348s Checking `sniffer'... WARNING 348s 348s WARNING: Output from ifpromisc: 348s lo: not promisc and no packet sniffer sockets 348s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 348s 348s Checking `w55808'... not found 348s Checking `wted'... not found 348s Checking `scalper'... not found 348s Checking `slapper'... not found 348s Checking `z2'... not found 348s Checking `chkutmp'... not found 348s Checking `OSX_RSPLUG'... not tested 348s --- [ END: cat /var/log/chkrootkit/log.today ] --- 348s 348s To create this file containing all output from today's run, do (as root) 348s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 348s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 348s **** Files in log 348s total 80K 348s drwxr-xr-x 2 root root 4.0K Nov 26 20:42 . 348s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 348s -rw-r--r-- 1 root root 22K Nov 26 20:45 chkrootkit-daily.log 348s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 348s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 348s *** Test of content of output follows... 348s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 348s No file /var/log/chkrootkit/log.expected 348s OK 348s **** Test for '^This file should contain expected output from chkrootkit$' 348s This file should contain expected output from chkrootkit 348s OK 348s **** Test for '^$' 348s 348s 348s 348s 348s 348s 348s 348s 348s OK 348s **** Test for '^Today's run produced the following output:$' 348s Today's run produced the following output: 348s OK 348s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 348s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 348s OK 348s **** Test for '^ROOTDIR is `/'$' 348s ROOTDIR is `/' 348s OK 348s **** Test for '^Checking `amd'\.\.\. not infected$' 348s Checking `amd'... not infected 348s OK 348s **** Test for '^Checking `basename'\.\.\. not infected$' 348s Checking `basename'... not infected 348s OK 348s **** Test for '^Checking `biff'\.\.\. not infected$' 348s Checking `biff'... not infected 348s OK 348s **** Test for '^Checking `chfn'\.\.\. not infected$' 348s Checking `chfn'... not infected 348s OK 348s **** Test for '^Checking `chsh'\.\.\. not infected$' 348s Checking `chsh'... not infected 348s OK 348s **** Test for '^Checking `cron'\.\.\. not infected$' 348s Checking `cron'... not infected 348s OK 348s **** Test for '^Checking `crontab'\.\.\. not infected$' 348s Checking `crontab'... not infected 348s OK 348s **** Test for '^Checking `date'\.\.\. not infected$' 348s Checking `date'... not infected 348s OK 348s **** Test for '^Checking `du'\.\.\. not infected$' 348s Checking `du'... not infected 348s OK 348s **** Test for '^Checking `dirname'\.\.\. not infected$' 348s Checking `dirname'... not infected 348s OK 348s **** Test for '^Checking `echo'\.\.\. not infected$' 348s Checking `echo'... not infected 348s OK 348s **** Test for '^Checking `egrep'\.\.\. not infected$' 348s Checking `egrep'... not infected 348s OK 348s **** Test for '^Checking `env'\.\.\. not infected$' 348s Checking `env'... not infected 348s OK 348s **** Test for '^Checking `find'\.\.\. not infected$' 348s Checking `find'... not infected 348s OK 348s **** Test for '^Checking `fingerd'\.\.\. not infected$' 348s Checking `fingerd'... not infected 348s OK 348s **** Test for '^Checking `gpm'\.\.\. not infected$' 348s Checking `gpm'... not infected 348s OK 348s **** Test for '^Checking `grep'\.\.\. not infected$' 348s Checking `grep'... not infected 348s OK 348s **** Test for '^Checking `hdparm'\.\.\. not infected$' 348s Checking `hdparm'... not infected 348s OK 348s **** Test for '^Checking `su'\.\.\. not infected$' 348s Checking `su'... not infected 348s OK 348s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 348s Checking `ifconfig'... not infected 348s OK 348s **** Test for '^Checking `inetd'\.\.\. not infected$' 348s Checking `inetd'... not infected 348s OK 348s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 348s Checking `inetdconf'... not infected 348s OK 348s **** Test for '^Checking `identd'\.\.\. not infected$' 348s Checking `identd'... not infected 348s OK 348s **** Test for '^Checking `init'\.\.\. not infected$' 348s Checking `init'... not infected 348s OK 348s **** Test for '^Checking `killall'\.\.\. not infected$' 348s Checking `killall'... not infected 348s OK 348s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 348s Checking `ldsopreload'... not infected 348s OK 348s **** Test for '^Checking `login'\.\.\. not infected$' 348s Checking `login'... not infected 348s OK 348s **** Test for '^Checking `ls'\.\.\. not infected$' 348s Checking `ls'... not infected 348s OK 348s **** Test for '^Checking `lsof'\.\.\. not infected$' 348s Checking `lsof'... not infected 348s OK 348s **** Test for '^Checking `mail'\.\.\. not infected$' 348s Checking `mail'... not infected 348s OK 348s **** Test for '^Checking `mingetty'\.\.\. not infected$' 348s Checking `mingetty'... not infected 348s OK 348s **** Test for '^Checking `netstat'\.\.\. not infected$' 348s Checking `netstat'... not infected 348s OK 348s **** Test for '^Checking `named'\.\.\. not infected$' 348s Checking `named'... not infected 348s OK 348s **** Test for '^Checking `passwd'\.\.\. not infected$' 348s Checking `passwd'... not infected 348s OK 348s **** Test for '^Checking `pidof'\.\.\. not infected$' 348s Checking `pidof'... not infected 348s OK 348s **** Test for '^Checking `pop2'\.\.\. not infected$' 348s Checking `pop2'... not infected 348s OK 348s **** Test for '^Checking `pop3'\.\.\. not infected$' 348s Checking `pop3'... not infected 348s OK 348s **** Test for '^Checking `ps'\.\.\. not infected$' 348s Checking `ps'... not infected 348s OK 348s **** Test for '^Checking `pstree'\.\.\. not infected$' 348s Checking `pstree'... not infected 348s OK 348s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 348s Checking `rpcinfo'... not infected 348s OK 348s **** Test for '^Checking `rlogind'\.\.\. not infected$' 348s Checking `rlogind'... not infected 348s OK 348s **** Test for '^Checking `rshd'\.\.\. not infected$' 348s Checking `rshd'... not infected 348s OK 348s **** Test for '^Checking `slogin'\.\.\. not infected$' 348s Checking `slogin'... not infected 348s OK 348s **** Test for '^Checking `sendmail'\.\.\. not infected$' 348s Checking `sendmail'... not infected 348s OK 348s **** Test for '^Checking `sshd'\.\.\. not infected$' 348s Checking `sshd'... not infected 348s OK 348s **** Test for '^Checking `syslogd'\.\.\. not infected$' 348s Checking `syslogd'... not infected 348s OK 348s **** Test for '^Checking `tar'\.\.\. not infected$' 348s Checking `tar'... not infected 348s OK 348s **** Test for '^Checking `tcpd'\.\.\. not infected$' 348s Checking `tcpd'... not infected 348s OK 348s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 348s Checking `tcpdump'... not infected 348s OK 348s **** Test for '^Checking `top'\.\.\. not infected$' 348s Checking `top'... not infected 348s OK 348s **** Test for '^Checking `telnetd'\.\.\. not infected$' 348s Checking `telnetd'... not infected 348s OK 348s **** Test for '^Checking `timed'\.\.\. not infected$' 348s Checking `timed'... not infected 348s OK 348s **** Test for '^Checking `traceroute'\.\.\. not infected$' 348s Checking `traceroute'... not infected 348s OK 348s **** Test for '^Checking `vdir'\.\.\. not infected$' 348s Checking `vdir'... not infected 348s OK 348s **** Test for '^Checking `w'\.\.\. not infected$' 348s Checking `w'... not infected 348s OK 348s **** Test for '^Checking `write'\.\.\. not infected$' 348s Checking `write'... not infected 348s OK 348s **** Test for '^Checking `aliens'\.\.\. started$' 348s Checking `aliens'... started 349s OK 349s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 349s Searching for suspicious files in /dev... not found 349s OK 349s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 349s Searching for known suspicious directories... not found 349s OK 349s **** Test for '^Searching for known suspicious files\.\.\. not found$' 349s Searching for known suspicious files... not found 349s OK 349s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 349s Searching for sniffer's logs... not found 349s OK 349s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 349s Searching for HiDrootkit rootkit... not found 349s OK 349s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 349s Searching for t0rn rootkit... not found 349s OK 349s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 349s Searching for t0rn v8 (or variation)... not found 349s OK 349s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 349s Searching for Lion rootkit... not found 349s OK 349s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 349s Searching for RSHA rootkit... not found 349s OK 349s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 349s Searching for RH-Sharpe rootkit... not found 349s OK 349s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 349s Searching for Ambient (ark) rootkit... not found 349s OK 349s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 349s Searching for suspicious files and dirs... WARNING 349s OK 349s **** Test for '^WARNING: The following suspicious files and directories were found:$' 349s WARNING: The following suspicious files and directories were found: 349s OK 349s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 349s /usr/lib/.1 [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 349s /usr/lib/.aaa [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 349s /usr/lib/.1DIR [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 349s /usr/lib/...DIR [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 349s /usr/lib/.bbb [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 349s /usr/lib/.DIR-aaa [Not from a Debian package] 349s OK 349s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 349s /usr/lib/... [Not from a Debian package] 349s OK 349s **** Test for '^$' 349s 349s 349s 349s 349s 349s 349s 349s 349s OK 349s **** Test for '^Searching for LPD Worm\.\.\. not found$' 349s Searching for LPD Worm... not found 349s OK 349s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 349s Searching for Ramen Worm rootkit... not found 349s OK 349s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 349s Searching for Maniac rootkit... not found 349s OK 349s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 349s Searching for RK17 rootkit... not found 349s OK 349s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 349s Searching for Ducoci rootkit... not found 349s OK 349s **** Test for '^Searching for Adore Worm\.\.\. not found$' 349s Searching for Adore Worm... not found 349s OK 349s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 349s Searching for ShitC Worm... not found 349s OK 349s **** Test for '^Searching for Omega Worm\.\.\. not found$' 349s Searching for Omega Worm... not found 349s OK 349s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 349s Searching for Sadmind/IIS Worm... not found 349s OK 349s **** Test for '^Searching for MonKit\.\.\. not found$' 349s Searching for MonKit... not found 349s OK 349s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 349s Searching for Showtee rootkit... not found 349s OK 349s **** Test for '^Searching for OpticKit\.\.\. not found$' 349s Searching for OpticKit... not found 349s OK 349s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 349s Searching for T.R.K... not found 349s OK 349s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 349s Searching for Mithra rootkit... not found 349s OK 349s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 349s Searching for OBSD rootkit v1... not tested 349s OK 349s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 349s Searching for LOC rootkit... not found 349s OK 349s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 349s Searching for Romanian rootkit... not found 349s OK 349s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 349s Searching for HKRK rootkit... not found 349s OK 349s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 349s Searching for Suckit rootkit... not found 349s OK 349s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 349s Searching for Volc rootkit... not found 349s OK 349s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 349s Searching for Gold2 rootkit... not found 349s OK 349s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 349s Searching for TC2 rootkit... not found 349s OK 349s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 349s Searching for Anonoying rootkit... not found 349s OK 349s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 349s Searching for ZK rootkit... not found 349s OK 349s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 349s Searching for ShKit rootkit... not found 349s OK 349s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 349s Searching for AjaKit rootkit... not found 349s OK 349s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 349s Searching for zaRwT rootkit... not found 349s OK 349s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 349s Searching for Madalin rootkit... not found 349s OK 349s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 349s Searching for Fu rootkit... not found 349s OK 349s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 349s Searching for Kenga3 rootkit... not found 349s OK 349s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 349s Searching for ESRK rootkit... not found 349s OK 349s **** Test for '^Searching for rootedoor\.\.\. not found$' 349s Searching for rootedoor... not found 349s OK 349s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 349s Searching for ENYELKM rootkit... not found 349s OK 349s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 349s Searching for common ssh-scanners... not found 349s OK 349s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 349s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 349s OK 349s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 349s Searching for Linux/Ebury 1.6... not found 349s OK 349s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 349s Searching for 64-bit Linux Rootkit... not found 349s OK 349s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 349s Searching for 64-bit Linux Rootkit modules... not found 349s OK 349s **** Test for '^Searching for Mumblehard\.\.\. not found$' 349s Searching for Mumblehard... not found 349s OK 349s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 349s Searching for Backdoor.Linux.Mokes.a... not found 349s OK 349s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 349s Searching for Malicious TinyDNS... not found 349s OK 349s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 349s Searching for Linux.Xor.DDoS... WARNING 349s OK 349s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 349s WARNING: Possible Linux.Xor.DDoS installed: 349s OK 349s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 349s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 349s OK 349s **** Test for '^/tmp/clean/.+$' 349s /tmp/clean/sed [Not from a Debian package] 349s /tmp/clean/ls [Not from a Debian package] 349s /tmp/clean/id [Not from a Debian package] 349s /tmp/clean/uname [Not from a Debian package] 349s /tmp/clean/awk [Not from a Debian package] 349s /tmp/clean/head [Not from a Debian package] 349s /tmp/clean/strings [Not from a Debian package] 349s /tmp/clean/cut [Not from a Debian package] 349s /tmp/clean/netstat [Not from a Debian package] 349s /tmp/clean/ss [Not from a Debian package] 349s /tmp/clean/find [Not from a Debian package] 349s /tmp/clean/ps [Not from a Debian package] 349s /tmp/clean/xargs [Not from a Debian package] 349s /tmp/clean/dpkg-query [Not from a Debian package] 349s /tmp/clean/dirname [Not from a Debian package] 349s /tmp/clean/echo [Not from a Debian package] 349s /tmp/clean/grep [Not from a Debian package] 349s OK 349s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 349s Searching for Linux.Proxy.1.0... not found 349s OK 349s **** Test for '^Searching for CrossRAT\.\.\. not found$' 349s Searching for CrossRAT... not found 349s OK 349s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 349s Searching for Hidden Cobra... not found 349s OK 349s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 349s Searching for Rocke Miner rootkit... not found 349s OK 349s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 349s Searching for PWNLNX4 lkm rootkit... not found 349s OK 349s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 349s Searching for PWNLNX6 lkm rootkit... not found 349s OK 349s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 349s Searching for Umbreon lrk... not found 349s OK 349s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 349s Searching for Kinsing.a backdoor rootkit... not found 349s OK 349s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 349s Searching for RotaJakiro backdoor rootkit... not found 349s OK 349s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 349s Searching for Syslogk LKM rootkit... not found 349s OK 349s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 349s Searching for Kovid LKM rootkit... not tested 349s OK 349s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 349s Searching for Tsunami DDoS Malware rootkit... not found 349s OK 349s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 349s Searching for Linux BPF Door... not found 349s OK 349s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 349s Searching for suspect PHP files... not found 349s OK 349s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 349s Searching for zero-size shell history files in /root... not found 349s OK 349s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 349s Searching for hardlinked shell history files in /root... not found 349s OK 349s **** Test for '^Checking `aliens'\.\.\. finished$' 349s Checking `aliens'... finished 349s OK 349s **** Test for '^Checking `asp'\.\.\. not infected$' 349s Checking `asp'... not infected 349s OK 349s **** Test for '^Checking `bindshell'\.\.\. not found$' 349s Checking `bindshell'... not found 349s OK 349s **** Test for '^Checking `lkm'\.\.\. started$' 349s Checking `lkm'... started 349s OK 349s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 349s Searching for Adore LKM... not tested 349s OK 349s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 349s Searching for sebek LKM (Adore based)... not tested 349s OK 349s **** Test for '^Searching for knark LKM rootkit... not found$' 349s Searching for knark LKM rootkit... not found 349s OK 349s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 349s Searching for for hidden processes with chkproc... not found 349s OK 349s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 349s Searching for for hidden directories using chkdirs... not found 349s OK 349s **** Test for '^Checking `lkm'\.\.\. finished$' 349s Checking `lkm'... finished 349s OK 349s **** Test for '^Checking `rexedcs'\.\.\. not found$' 349s Checking `rexedcs'... not found 349s OK 349s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 349s Checking `sniffer'... WARNING 349s OK 349s **** Test for '^WARNING: Output from ifpromisc:$' 349s WARNING: Output from ifpromisc: 349s OK 349s **** Test for '^lo: not promisc and no packet sniffer sockets$' 349s lo: not promisc and no packet sniffer sockets 349s OK 349s **** Test for '^Checking `w55808'\.\.\. not found$' 349s Checking `w55808'... not found 349s OK 349s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 349s Checking `wted'... not found 349s OK 349s **** Test for '^Checking `scalper'\.\.\. not found$' 349s Checking `scalper'... not found 349s OK 349s **** Test for '^Checking `slapper'\.\.\. not found$' 349s Checking `slapper'... not found 349s OK 349s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 349s Checking `z2'... not found 349s OK 349s **** Test for '^Checking `chkutmp'\.\.\.' 349s Checking `chkutmp'... not found 349s OK 349s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 349s Checking `OSX_RSPLUG'... not tested 349s OK 349s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 349s --- [ END: cat /var/log/chkrootkit/log.today ] --- 349s OK 349s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 349s To create this file containing all output from today's run, do (as root) 349s OK 349s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 349s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 349s OK 349s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 349s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 349s OK 349s ** PASS: Testing: cron-with-diff-mode-02-full-rerun (chkrootkit-daily) done: PASS 349s *** Unexpected (unmatched) lines follow (for info): 349s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 349s ** Testing: cron-with-diff-mode-03-full-after-update (chkrootkit-daily) ... 349s *** Output 366s **** Files in log 366s total 80K 366s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 366s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 366s -rw-r--r-- 1 root root 0 Nov 26 20:45 chkrootkit-daily.log 366s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 366s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 366s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 366s *** Test of content of output follows... 366s **** Expected is empty, so output should be empty 366s Output is indeed empty: PASS 366s ** PASS: Testing: cron-with-diff-mode-03-full-after-update (chkrootkit-daily) done: PASS 366s ** Testing: cron-with-diff-mode-04-full-no-ionice (chkrootkit-daily) ... 366s *** Output 384s **** Files in log 384s total 80K 384s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 384s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 384s -rw-r--r-- 1 root root 0 Nov 26 20:45 chkrootkit-daily.log 384s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 384s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 384s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 384s *** Test of content of output follows... 384s **** Expected is empty, so output should be empty 384s Output is indeed empty: PASS 384s ** PASS: Testing: cron-with-diff-mode-04-full-no-ionice (chkrootkit-daily) done: PASS 384s ** Testing: cron-with-diff-mode-05-full-filter-and-ignore (chkrootkit-daily) ... 384s *** Output 401s chkrootkit output was not as expected. 401s 401s The difference is: 401s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 401s --- /var/log/chkrootkit/log.expected 2024-11-26 20:45:15.133213339 +0000 401s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:07.628574988 +0000 401s @@ -74,9 +74,8 @@ 401s /usr/lib/.DIR-aaa [Not from a Debian package] 401s /usr/lib/.1DIR [Not from a Debian package] 401s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 401s -/usr/lib/.bbb [Not from a Debian package] 401s +/usr/lib/.bCHANGED-IN-FILTER_ 401s /usr/lib/...DIR [Not from a Debian package] 401s -/usr/lib/.aaa [Not from a Debian package] 401s /usr/lib/.1 [Not from a Debian package] 401s 401s Searching for LPD Worm... not found 401s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 401s 401s To update the expected output, run (as root) 401s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 401s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 401s **** Files in log 401s total 84K 401s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 401s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 401s -rw-r--r-- 1 root root 1.1K Nov 26 20:46 chkrootkit-daily.log 401s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 401s -rw-r--r-- 1 root root 21K Nov 26 20:46 log.today 401s -rw-r--r-- 1 root root 21K Nov 26 20:46 log.today.raw 401s *** Test of content of output follows... 401s **** Test for '^chkrootkit output was not as expected\.$' 401s chkrootkit output was not as expected. 401s OK 401s **** Test for '^$' 401s 401s 401s OK 401s **** Test for '^The difference is:$' 401s The difference is: 401s OK 401s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 401s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 401s OK 401s **** Test for '^--- /var/log/chkrootkit/log\.expected' 401s --- /var/log/chkrootkit/log.expected 2024-11-26 20:45:15.133213339 +0000 401s OK 401s **** Test for '^\++ /var/log/chkrootkit/log\.today' 401s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:07.628574988 +0000 401s OK 401s **** Test for '^@@[@0-9, +-]+$' 401s @@ -74,9 +74,8 @@ 401s OK 401s **** Test for '^[[:space:]]' 401s /usr/lib/.DIR-aaa [Not from a Debian package] 401s /usr/lib/.1DIR [Not from a Debian package] 401s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 401s /usr/lib/...DIR [Not from a Debian package] 401s /usr/lib/.1 [Not from a Debian package] 401s 401s Searching for LPD Worm... not found 401s OK 401s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 401s -/usr/lib/.aaa [Not from a Debian package] 401s OK 401s **** Test for '^-(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 401s -/usr/lib/.bbb [Not from a Debian package] 401s OK 401s **** Test for '^\+(/usr)?/lib/\.bCHANGED-IN-FILTER_$' 401s +/usr/lib/.bCHANGED-IN-FILTER_ 401s OK 401s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 401s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 401s OK 401s **** Test for '^To update the expected output, run \(as root\)$' 401s To update the expected output, run (as root) 401s OK 401s **** Test for '^# cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log\.expected$' 401s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 401s OK 401s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 401s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 401s OK 401s ** PASS: Testing: cron-with-diff-mode-05-full-filter-and-ignore (chkrootkit-daily) done: PASS 401s * Testing: chkrootkit-daily (diff mode, quiet output, no MAILTO) 401s ** Testing: cron-with-diff-mode-06-quiet (chkrootkit-daily) ... 401s *** Output 418s No file /var/log/chkrootkit/log.expected 418s This file should contain expected output from chkrootkit 418s 418s Today's run produced the following output: 418s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 418s WARNING: The following suspicious files and directories were found: 418s /usr/lib/... [Not from a Debian package] 418s /usr/lib/.DIR-aaa [Not from a Debian package] 418s /usr/lib/.1DIR [Not from a Debian package] 418s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 418s /usr/lib/.bbb [Not from a Debian package] 418s /usr/lib/...DIR [Not from a Debian package] 418s /usr/lib/.aaa [Not from a Debian package] 418s /usr/lib/.1 [Not from a Debian package] 418s 418s WARNING: Possible Linux.Xor.DDoS installed: 418s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 418s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 418s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 418s /tmp/clean/sed [Not from a Debian package] 418s /tmp/clean/ls [Not from a Debian package] 418s /tmp/clean/id [Not from a Debian package] 418s /tmp/clean/uname [Not from a Debian package] 418s /tmp/clean/awk [Not from a Debian package] 418s /tmp/clean/head [Not from a Debian package] 418s /tmp/clean/strings [Not from a Debian package] 418s /tmp/clean/cut [Not from a Debian package] 418s /tmp/clean/netstat [Not from a Debian package] 418s /tmp/clean/ss [Not from a Debian package] 418s /tmp/clean/find [Not from a Debian package] 418s /tmp/clean/ps [Not from a Debian package] 418s /tmp/clean/xargs [Not from a Debian package] 418s /tmp/clean/dpkg-query [Not from a Debian package] 418s /tmp/clean/dirname [Not from a Debian package] 418s /tmp/clean/echo [Not from a Debian package] 418s /tmp/clean/grep [Not from a Debian package] 418s 418s WARNING: Output from ifpromisc: 418s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 418s 418s --- [ END: cat /var/log/chkrootkit/log.today ] --- 418s 418s To create this file containing all output from today's run, do (as root) 418s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 418s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 418s **** Files in log 418s total 44K 418s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 418s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 418s -rw-r--r-- 1 root root 11K Nov 26 20:46 chkrootkit-daily.log 418s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 418s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 418s *** Test of content of output follows... 418s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 418s No file /var/log/chkrootkit/log.expected 418s OK 418s **** Test for '^This file should contain expected output from chkrootkit$' 418s This file should contain expected output from chkrootkit 418s OK 418s **** Test for '^$' 418s 418s 418s 418s 418s 418s OK 418s **** Test for '^Today's run produced the following output:$' 418s Today's run produced the following output: 418s OK 418s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 418s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 418s OK 418s **** Test for '^WARNING: The following suspicious files and directories were found:$' 418s WARNING: The following suspicious files and directories were found: 418s OK 418s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 418s /usr/lib/.1 [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 418s /usr/lib/.aaa [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 418s /usr/lib/.1DIR [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 418s /usr/lib/...DIR [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 418s /usr/lib/.bbb [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 418s /usr/lib/.DIR-aaa [Not from a Debian package] 418s OK 418s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 418s /usr/lib/... [Not from a Debian package] 418s OK 418s **** Test for '^$' 418s 418s 418s 418s 418s 418s OK 418s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 418s WARNING: Possible Linux.Xor.DDoS installed: 418s OK 418s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 418s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 418s OK 418s **** Test for '^/tmp/clean/.+$' 418s /tmp/clean/sed [Not from a Debian package] 418s /tmp/clean/ls [Not from a Debian package] 418s /tmp/clean/id [Not from a Debian package] 418s /tmp/clean/uname [Not from a Debian package] 418s /tmp/clean/awk [Not from a Debian package] 418s /tmp/clean/head [Not from a Debian package] 418s /tmp/clean/strings [Not from a Debian package] 418s /tmp/clean/cut [Not from a Debian package] 418s /tmp/clean/netstat [Not from a Debian package] 418s /tmp/clean/ss [Not from a Debian package] 418s /tmp/clean/find [Not from a Debian package] 418s /tmp/clean/ps [Not from a Debian package] 418s /tmp/clean/xargs [Not from a Debian package] 418s /tmp/clean/dpkg-query [Not from a Debian package] 418s /tmp/clean/dirname [Not from a Debian package] 418s /tmp/clean/echo [Not from a Debian package] 418s /tmp/clean/grep [Not from a Debian package] 418s OK 418s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 418s --- [ END: cat /var/log/chkrootkit/log.today ] --- 418s OK 418s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 418s To create this file containing all output from today's run, do (as root) 418s OK 418s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 418s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 418s OK 418s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 418s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 418s OK 418s ** PASS: Testing: cron-with-diff-mode-06-quiet (chkrootkit-daily) done: PASS 418s *** Unexpected (unmatched) lines follow (for info): 418s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 418s ** Testing: cron-with-diff-mode-07-quiet-rerun (chkrootkit-daily) ... 418s *** Output 435s No file /var/log/chkrootkit/log.expected 435s This file should contain expected output from chkrootkit 435s 435s Today's run produced the following output: 435s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 435s WARNING: The following suspicious files and directories were found: 435s /usr/lib/... [Not from a Debian package] 435s /usr/lib/.DIR-aaa [Not from a Debian package] 435s /usr/lib/.1DIR [Not from a Debian package] 435s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 435s /usr/lib/.bbb [Not from a Debian package] 435s /usr/lib/...DIR [Not from a Debian package] 435s /usr/lib/.aaa [Not from a Debian package] 435s /usr/lib/.1 [Not from a Debian package] 435s 435s WARNING: Possible Linux.Xor.DDoS installed: 435s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 435s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 435s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 435s /tmp/clean/sed [Not from a Debian package] 435s /tmp/clean/ls [Not from a Debian package] 435s /tmp/clean/id [Not from a Debian package] 435s /tmp/clean/uname [Not from a Debian package] 435s /tmp/clean/awk [Not from a Debian package] 435s /tmp/clean/head [Not from a Debian package] 435s /tmp/clean/strings [Not from a Debian package] 435s /tmp/clean/cut [Not from a Debian package] 435s /tmp/clean/netstat [Not from a Debian package] 435s /tmp/clean/ss [Not from a Debian package] 435s /tmp/clean/find [Not from a Debian package] 435s /tmp/clean/ps [Not from a Debian package] 435s /tmp/clean/xargs [Not from a Debian package] 435s /tmp/clean/dpkg-query [Not from a Debian package] 435s /tmp/clean/dirname [Not from a Debian package] 435s /tmp/clean/echo [Not from a Debian package] 435s /tmp/clean/grep [Not from a Debian package] 435s 435s WARNING: Output from ifpromisc: 435s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 435s 435s --- [ END: cat /var/log/chkrootkit/log.today ] --- 435s 435s To create this file containing all output from today's run, do (as root) 435s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 435s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 435s **** Files in log 435s total 44K 435s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 435s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 435s -rw-r--r-- 1 root root 11K Nov 26 20:46 chkrootkit-daily.log 435s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 435s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 435s *** Test of content of output follows... 435s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 435s No file /var/log/chkrootkit/log.expected 435s OK 435s **** Test for '^This file should contain expected output from chkrootkit$' 435s This file should contain expected output from chkrootkit 435s OK 435s **** Test for '^$' 435s 435s 435s 435s 435s 435s OK 435s **** Test for '^Today's run produced the following output:$' 435s Today's run produced the following output: 435s OK 435s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 435s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 435s OK 435s **** Test for '^WARNING: The following suspicious files and directories were found:$' 435s WARNING: The following suspicious files and directories were found: 435s OK 435s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 435s /usr/lib/.1 [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 435s /usr/lib/.aaa [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 435s /usr/lib/.1DIR [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 435s /usr/lib/...DIR [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 435s /usr/lib/.bbb [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 435s /usr/lib/.DIR-aaa [Not from a Debian package] 435s OK 435s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 435s /usr/lib/... [Not from a Debian package] 435s OK 435s **** Test for '^$' 435s 435s 435s 435s 435s 435s OK 435s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 435s WARNING: Possible Linux.Xor.DDoS installed: 435s OK 435s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 435s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 435s OK 435s **** Test for '^/tmp/clean/.+$' 435s /tmp/clean/sed [Not from a Debian package] 435s /tmp/clean/ls [Not from a Debian package] 435s /tmp/clean/id [Not from a Debian package] 435s /tmp/clean/uname [Not from a Debian package] 435s /tmp/clean/awk [Not from a Debian package] 435s /tmp/clean/head [Not from a Debian package] 435s /tmp/clean/strings [Not from a Debian package] 435s /tmp/clean/cut [Not from a Debian package] 435s /tmp/clean/netstat [Not from a Debian package] 435s /tmp/clean/ss [Not from a Debian package] 435s /tmp/clean/find [Not from a Debian package] 435s /tmp/clean/ps [Not from a Debian package] 435s /tmp/clean/xargs [Not from a Debian package] 435s /tmp/clean/dpkg-query [Not from a Debian package] 435s /tmp/clean/dirname [Not from a Debian package] 435s /tmp/clean/echo [Not from a Debian package] 435s /tmp/clean/grep [Not from a Debian package] 435s OK 435s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 435s --- [ END: cat /var/log/chkrootkit/log.today ] --- 435s OK 435s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 435s To create this file containing all output from today's run, do (as root) 435s OK 435s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 435s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 435s OK 435s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 435s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 435s OK 435s ** PASS: Testing: cron-with-diff-mode-07-quiet-rerun (chkrootkit-daily) done: PASS 435s *** Unexpected (unmatched) lines follow (for info): 435s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 435s ** Testing: cron-with-diff-mode-08-quiet-after-update (chkrootkit-daily) ... 435s *** Output 452s **** Files in log 452s total 44K 452s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 452s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 452s -rw-r--r-- 1 root root 0 Nov 26 20:46 chkrootkit-daily.log 452s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 452s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 452s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 452s *** Test of content of output follows... 452s **** Expected is empty, so output should be empty 452s Output is indeed empty: PASS 452s ** PASS: Testing: cron-with-diff-mode-08-quiet-after-update (chkrootkit-daily) done: PASS 452s ** Testing: cron-with-diff-mode-09-quiet-filter-and-ignore (chkrootkit-daily) ... 452s *** Output 470s chkrootkit output was not as expected. 470s 470s The difference is: 470s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 470s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:41.505121807 +0000 470s +++ /var/log/chkrootkit/log.today 2024-11-26 20:47:15.948598472 +0000 470s @@ -1,11 +1,9 @@ 470s WARNING: The following suspicious files and directories were found: 470s /usr/lib/... [Not from a Debian package] 470s -/usr/lib/.DIR-aaa [Not from a Debian package] 470s /usr/lib/.1DIR [Not from a Debian package] 470s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 470s -/usr/lib/.bbb [Not from a Debian package] 470s +/usr/lib/.bCHANGED-IN-FILTER_ 470s /usr/lib/...DIR [Not from a Debian package] 470s -/usr/lib/.aaa [Not from a Debian package] 470s /usr/lib/.1 [Not from a Debian package] 470s 470s WARNING: Possible Linux.Xor.DDoS installed: 470s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 470s 470s To update the expected output, run (as root) 470s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 470s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 470s **** Files in log 470s total 48K 470s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 470s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 470s -rw-r--r-- 1 root root 1.2K Nov 26 20:47 chkrootkit-daily.log 470s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 470s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 470s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 470s *** Test of content of output follows... 470s **** Test for '^chkrootkit output was not as expected\.$' 470s chkrootkit output was not as expected. 470s OK 470s **** Test for '^$' 470s 470s 470s OK 470s **** Test for '^The difference is:$' 470s The difference is: 470s OK 470s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---' 470s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 470s OK 470s **** Test for '^--- /var/log/chkrootkit/log\.expected' 470s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:41.505121807 +0000 470s OK 470s **** Test for '^\++ /var/log/chkrootkit/log\.today' 470s +++ /var/log/chkrootkit/log.today 2024-11-26 20:47:15.948598472 +0000 470s OK 470s **** Test for '^@@[0-9, +-]+' 470s @@ -1,11 +1,9 @@ 470s OK 470s **** Test for '^[[:space:]]' 470s WARNING: The following suspicious files and directories were found: 470s /usr/lib/... [Not from a Debian package] 470s /usr/lib/.1DIR [Not from a Debian package] 470s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 470s /usr/lib/...DIR [Not from a Debian package] 470s /usr/lib/.1 [Not from a Debian package] 470s 470s WARNING: Possible Linux.Xor.DDoS installed: 470s OK 470s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 470s -/usr/lib/.aaa [Not from a Debian package] 470s OK 470s **** Test for '^-(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 470s -/usr/lib/.bbb [Not from a Debian package] 470s OK 470s **** Test for '^-(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 470s -/usr/lib/.DIR-aaa [Not from a Debian package] 470s OK 470s **** Test for '^\+(/usr)?/lib/\.bCHANGED-IN-FILTER_$' 470s +/usr/lib/.bCHANGED-IN-FILTER_ 470s OK 470s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 470s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 470s OK 470s **** Test for '^$' 470s 470s 470s OK 470s **** Test for '^To update the expected output, run \(as root\)$' 470s To update the expected output, run (as root) 470s OK 470s **** Test for '^# cp -a -f /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 470s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 470s OK 470s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 470s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 470s OK 470s ** PASS: Testing: cron-with-diff-mode-09-quiet-filter-and-ignore (chkrootkit-daily) done: PASS 470s ** Testing: cron-with-diff-mode-10-quiet-invalid-filter-is-ignored (chkrootkit-daily) ... 470s *** Output 470s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode' 487s chkrootkit output was not as expected. 487s 487s The difference is: 487s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 487s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:41.505121807 +0000 487s +++ /var/log/chkrootkit/log.today 2024-11-26 20:47:32.967846059 +0000 487s @@ -1,11 +1,9 @@ 487s WARNING: The following suspicious files and directories were found: 487s /usr/lib/... [Not from a Debian package] 487s -/usr/lib/.DIR-aaa [Not from a Debian package] 487s /usr/lib/.1DIR [Not from a Debian package] 487s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 487s /usr/lib/.bbb [Not from a Debian package] 487s /usr/lib/...DIR [Not from a Debian package] 487s -/usr/lib/.aaa [Not from a Debian package] 487s /usr/lib/.1 [Not from a Debian package] 487s 487s WARNING: Possible Linux.Xor.DDoS installed: 487s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 487s 487s To update the expected output, run (as root) 487s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 487s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 487s **** Files in log 487s total 48K 487s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 487s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 487s -rw-r--r-- 1 root root 1.1K Nov 26 20:47 chkrootkit-daily.log 487s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 487s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 487s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 487s *** Test of content of output follows... 487s **** Test for '^Ignoring invalid \$FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode'$' 487s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode' 487s OK 487s **** Test for '^chkrootkit output was not as expected\.$' 487s chkrootkit output was not as expected. 487s OK 487s **** Test for '^$' 487s 487s 487s OK 487s **** Test for '^The difference is:$' 487s The difference is: 487s OK 487s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 487s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 487s OK 487s **** Test for '^--- /var/log/chkrootkit/log\.expected' 487s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:41.505121807 +0000 487s OK 487s **** Test for '^\++ /var/log/chkrootkit/log\.today' 487s +++ /var/log/chkrootkit/log.today 2024-11-26 20:47:32.967846059 +0000 487s OK 487s **** Test for '^@@[@0-9, +-]+' 487s @@ -1,11 +1,9 @@ 487s OK 487s **** Test for '^[[:space:]]' 487s WARNING: The following suspicious files and directories were found: 487s /usr/lib/... [Not from a Debian package] 487s /usr/lib/.1DIR [Not from a Debian package] 487s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 487s /usr/lib/.bbb [Not from a Debian package] 487s /usr/lib/...DIR [Not from a Debian package] 487s /usr/lib/.1 [Not from a Debian package] 487s 487s WARNING: Possible Linux.Xor.DDoS installed: 487s OK 487s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 487s -/usr/lib/.aaa [Not from a Debian package] 487s OK 487s **** Test for '^-(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 487s -/usr/lib/.DIR-aaa [Not from a Debian package] 487s OK 487s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 487s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 487s OK 487s **** Test for '^$' 487s 487s 487s OK 487s **** Test for '^To update the expected output, run \(as root\)$' 487s To update the expected output, run (as root) 487s OK 487s **** Test for '^# cp -a -f /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 487s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 487s OK 487s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 487s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 487s OK 487s ** PASS: Testing: cron-with-diff-mode-10-quiet-invalid-filter-is-ignored (chkrootkit-daily) done: PASS 487s * test MAILTO 487s ** Mocking out 'mail' command: /usr/sbin/mail 487s -rwxr-xr-x 1 root root 69 Nov 26 20:41 /usr/sbin/mail 487s /usr/sbin/mail: 487s #!/bin/sh 487s echo "mail called with $# args:" 487s for x in "$@"; do 487s echo "<$x>" 487s done 487s while read -r line; do 487s echo "> $line" 487s done 487s exit 0 487s mail called with 4 args: 487s 487s <1> 487s <2> 487s <3> 487s > stdin 487s ** Testing: chkrootkit-daily-mail-01 (chkrootkit-daily) ... 487s *** Output 504s mail called with 3 args: 504s <-s> 504s <[chkrootkit] alert for autopkgtest.local> 504s 504s > No file /var/log/chkrootkit/log.expected 504s > This file should contain expected output from chkrootkit 504s > 504s > Today's run produced the following output: 504s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 504s > WARNING: The following suspicious files and directories were found: 504s > /usr/lib/... [Not from a Debian package] 504s > /usr/lib/.DIR-aaa [Not from a Debian package] 504s > /usr/lib/.1DIR [Not from a Debian package] 504s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 504s > /usr/lib/.bbb [Not from a Debian package] 504s > /usr/lib/...DIR [Not from a Debian package] 504s > /usr/lib/.aaa [Not from a Debian package] 504s > /usr/lib/.1 [Not from a Debian package] 504s > 504s > WARNING: Possible Linux.Xor.DDoS installed: 504s > /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 504s > /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 504s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 504s > /tmp/clean/sed [Not from a Debian package] 504s > /tmp/clean/ls [Not from a Debian package] 504s > /tmp/clean/id [Not from a Debian package] 504s > /tmp/clean/uname [Not from a Debian package] 504s > /tmp/clean/awk [Not from a Debian package] 504s > /tmp/clean/head [Not from a Debian package] 504s > /tmp/clean/strings [Not from a Debian package] 504s > /tmp/clean/cut [Not from a Debian package] 504s > /tmp/clean/netstat [Not from a Debian package] 504s > /tmp/clean/ss [Not from a Debian package] 504s > /tmp/clean/find [Not from a Debian package] 504s > /tmp/clean/ps [Not from a Debian package] 504s > /tmp/clean/xargs [Not from a Debian package] 504s > /tmp/clean/dpkg-query [Not from a Debian package] 504s > /tmp/clean/dirname [Not from a Debian package] 504s > /tmp/clean/echo [Not from a Debian package] 504s > /tmp/clean/grep [Not from a Debian package] 504s > 504s > WARNING: Output from ifpromisc: 504s > ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 504s > 504s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 504s > 504s > To create this file containing all output from today's run, do (as root) 504s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 504s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 504s **** Files in log 504s total 44K 504s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 504s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 504s -rw-r--r-- 1 root root 11K Nov 26 20:47 chkrootkit-daily.log 504s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 504s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 504s *** Test of content of output follows... 504s **** Test for '^mail called with 3 args:$' 504s mail called with 3 args: 504s OK 504s **** Test for '^<-s>$' 504s <-s> 504s OK 504s **** Test for '^<\[chkrootkit\] alert for' 504s <[chkrootkit] alert for autopkgtest.local> 504s OK 504s **** Test for '^$' 504s 504s OK 504s **** Test for '^> No file /var/log/chkrootkit/log\.expected$' 504s > No file /var/log/chkrootkit/log.expected 504s OK 504s **** Test for '^> This file should contain expected output from chkrootkit$' 504s > This file should contain expected output from chkrootkit 504s OK 504s **** Test for '^> $' 504s > 504s > 504s > 504s > 504s > 504s OK 504s **** Test for '^> Today's run produced the following output:$' 504s > Today's run produced the following output: 504s OK 504s **** Test for '^> --- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 504s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 504s OK 504s **** Test for '^> WARNING: The following suspicious files and directories were found:$' 504s > WARNING: The following suspicious files and directories were found: 504s OK 504s **** Test for '^> (/usr)?/lib/\.1 \[Not from a Debian package\]$' 504s > /usr/lib/.1 [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.aaa \[Not from a Debian package\]$' 504s > /usr/lib/.aaa [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 504s > /usr/lib/.1DIR [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 504s > /usr/lib/...DIR [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.bbb \[Not from a Debian package\]$' 504s > /usr/lib/.bbb [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 504s > /usr/lib/.DIR-aaa [Not from a Debian package] 504s OK 504s **** Test for '^> (/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 504s > /usr/lib/... [Not from a Debian package] 504s OK 504s **** Test for '^> $' 504s > 504s > 504s > 504s > 504s > 504s OK 504s **** Test for '^> WARNING: Possible Linux\.Xor\.DDoS installed:$' 504s > WARNING: Possible Linux.Xor.DDoS installed: 504s OK 504s **** Test for '^> /tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 504s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 504s OK 504s **** Test for '^> /tmp/clean/.+$' 504s > /tmp/clean/sed [Not from a Debian package] 504s > /tmp/clean/ls [Not from a Debian package] 504s > /tmp/clean/id [Not from a Debian package] 504s > /tmp/clean/uname [Not from a Debian package] 504s > /tmp/clean/awk [Not from a Debian package] 504s > /tmp/clean/head [Not from a Debian package] 504s > /tmp/clean/strings [Not from a Debian package] 504s > /tmp/clean/cut [Not from a Debian package] 504s > /tmp/clean/netstat [Not from a Debian package] 504s > /tmp/clean/ss [Not from a Debian package] 504s > /tmp/clean/find [Not from a Debian package] 504s > /tmp/clean/ps [Not from a Debian package] 504s > /tmp/clean/xargs [Not from a Debian package] 504s > /tmp/clean/dpkg-query [Not from a Debian package] 504s > /tmp/clean/dirname [Not from a Debian package] 504s > /tmp/clean/echo [Not from a Debian package] 504s > /tmp/clean/grep [Not from a Debian package] 504s OK 504s **** Test for '^> --- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 504s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 504s OK 504s **** Test for '^> To create this file containing all output from today's run, do \(as root\)$' 504s > To create this file containing all output from today's run, do (as root) 504s OK 504s **** Test for '^> # cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 504s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 504s OK 504s **** Test for '^> # \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 504s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 504s OK 504s ** PASS: Testing: chkrootkit-daily-mail-01 (chkrootkit-daily) done: PASS 504s *** Unexpected (unmatched) lines follow (for info): 504s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 504s ** Testing: chkrootkit-daily-mail-02-rerun (chkrootkit-daily) ... 504s *** Output 522s mail called with 3 args: 522s <-s> 522s <[chkrootkit] alert for autopkgtest.local> 522s 522s > No file /var/log/chkrootkit/log.expected 522s > This file should contain expected output from chkrootkit 522s > 522s > Today's run produced the following output: 522s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 522s > WARNING: The following suspicious files and directories were found: 522s > /usr/lib/... [Not from a Debian package] 522s > /usr/lib/.DIR-aaa [Not from a Debian package] 522s > /usr/lib/.1DIR [Not from a Debian package] 522s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 522s > /usr/lib/.bbb [Not from a Debian package] 522s > /usr/lib/...DIR [Not from a Debian package] 522s > /usr/lib/.aaa [Not from a Debian package] 522s > /usr/lib/.1 [Not from a Debian package] 522s > 522s > WARNING: Possible Linux.Xor.DDoS installed: 522s > /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 522s > /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 522s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 522s > /tmp/clean/sed [Not from a Debian package] 522s > /tmp/clean/ls [Not from a Debian package] 522s > /tmp/clean/id [Not from a Debian package] 522s > /tmp/clean/uname [Not from a Debian package] 522s > /tmp/clean/awk [Not from a Debian package] 522s > /tmp/clean/head [Not from a Debian package] 522s > /tmp/clean/strings [Not from a Debian package] 522s > /tmp/clean/cut [Not from a Debian package] 522s > /tmp/clean/netstat [Not from a Debian package] 522s > /tmp/clean/ss [Not from a Debian package] 522s > /tmp/clean/find [Not from a Debian package] 522s > /tmp/clean/ps [Not from a Debian package] 522s > /tmp/clean/xargs [Not from a Debian package] 522s > /tmp/clean/dpkg-query [Not from a Debian package] 522s > /tmp/clean/dirname [Not from a Debian package] 522s > /tmp/clean/echo [Not from a Debian package] 522s > /tmp/clean/grep [Not from a Debian package] 522s > 522s > WARNING: Output from ifpromisc: 522s > ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 522s > 522s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 522s > 522s > To create this file containing all output from today's run, do (as root) 522s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 522s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 522s **** Files in log 522s total 44K 522s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 522s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 522s -rw-r--r-- 1 root root 11K Nov 26 20:48 chkrootkit-daily.log 522s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 522s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 522s *** Test of content of output follows... 522s **** Test for '^mail called with 3 args:$' 522s mail called with 3 args: 522s OK 522s **** Test for '^<-s>$' 522s <-s> 522s OK 522s **** Test for '^<\[chkrootkit\] alert for' 522s <[chkrootkit] alert for autopkgtest.local> 522s OK 522s **** Test for '^$' 522s 522s OK 522s **** Test for '^> No file /var/log/chkrootkit/log\.expected$' 522s > No file /var/log/chkrootkit/log.expected 522s OK 522s **** Test for '^> This file should contain expected output from chkrootkit$' 522s > This file should contain expected output from chkrootkit 522s OK 522s **** Test for '^> $' 522s > 522s > 522s > 522s > 522s > 522s OK 522s **** Test for '^> Today's run produced the following output:$' 522s > Today's run produced the following output: 522s OK 522s **** Test for '^> --- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 522s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 522s OK 522s **** Test for '^> WARNING: The following suspicious files and directories were found:$' 522s > WARNING: The following suspicious files and directories were found: 522s OK 522s **** Test for '^> (/usr)?/lib/\.1 \[Not from a Debian package\]$' 522s > /usr/lib/.1 [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.aaa \[Not from a Debian package\]$' 522s > /usr/lib/.aaa [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 522s > /usr/lib/.1DIR [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 522s > /usr/lib/...DIR [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.bbb \[Not from a Debian package\]$' 522s > /usr/lib/.bbb [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 522s > /usr/lib/.DIR-aaa [Not from a Debian package] 522s OK 522s **** Test for '^> (/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 522s > /usr/lib/... [Not from a Debian package] 522s OK 522s **** Test for '^> $' 522s > 522s > 522s > 522s > 522s > 522s OK 522s **** Test for '^> WARNING: Possible Linux\.Xor\.DDoS installed:$' 522s > WARNING: Possible Linux.Xor.DDoS installed: 522s OK 522s **** Test for '^> /tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 522s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 522s OK 522s **** Test for '^> /tmp/clean/.+$' 522s > /tmp/clean/sed [Not from a Debian package] 522s > /tmp/clean/ls [Not from a Debian package] 522s > /tmp/clean/id [Not from a Debian package] 522s > /tmp/clean/uname [Not from a Debian package] 522s > /tmp/clean/awk [Not from a Debian package] 522s > /tmp/clean/head [Not from a Debian package] 522s > /tmp/clean/strings [Not from a Debian package] 522s > /tmp/clean/cut [Not from a Debian package] 522s > /tmp/clean/netstat [Not from a Debian package] 522s > /tmp/clean/ss [Not from a Debian package] 522s > /tmp/clean/find [Not from a Debian package] 522s > /tmp/clean/ps [Not from a Debian package] 522s > /tmp/clean/xargs [Not from a Debian package] 522s > /tmp/clean/dpkg-query [Not from a Debian package] 522s > /tmp/clean/dirname [Not from a Debian package] 522s > /tmp/clean/echo [Not from a Debian package] 522s > /tmp/clean/grep [Not from a Debian package] 522s OK 522s **** Test for '^> --- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 522s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 522s OK 522s **** Test for '^> To create this file containing all output from today's run, do \(as root\)$' 522s > To create this file containing all output from today's run, do (as root) 522s OK 522s **** Test for '^> # cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 522s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 522s OK 522s **** Test for '^> # \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 522s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 522s OK 522s ** PASS: Testing: chkrootkit-daily-mail-02-rerun (chkrootkit-daily) done: PASS 522s *** Unexpected (unmatched) lines follow (for info): 522s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 522s ** Testing: chkrootkit-daily-mail-03-no-diff-means-no-mail (chkrootkit-daily) ... 522s *** Output 538s **** Files in log 538s total 44K 538s drwxr-xr-x 2 root root 4.0K Nov 26 20:48 . 538s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 538s -rw-r--r-- 1 root root 0 Nov 26 20:48 chkrootkit-daily.log 538s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.expected 538s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 538s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 538s *** Test of content of output follows... 538s **** Expected is empty, so output should be empty 538s Output is indeed empty: PASS 538s ** PASS: Testing: chkrootkit-daily-mail-03-no-diff-means-no-mail (chkrootkit-daily) done: PASS 538s * Test chkrootkit tests report infected files 538s ** setting up false positive 'fake rootkits' for every test 538s Ensuring amd shows as INFECTED 538s mv /usr/sbin/amd /usr/sbin/amd.to_replace 538s /usr/sbin/amd 538s Ensuring basename shows as INFECTED 538s mv /usr/bin/basename /usr/bin/basename.to_replace 538s /usr/bin/basename 538s Ensuring biff shows as INFECTED 538s mv /usr/sbin/biff /usr/sbin/biff.to_replace 538s /usr/sbin/biff 538s Ensuring chfn shows as INFECTED 538s mv /usr/bin/chfn /usr/bin/chfn.to_replace 538s /usr/bin/chfn 538s Ensuring chsh shows as INFECTED 538s mv /usr/bin/chsh /usr/bin/chsh.to_replace 538s /usr/bin/chsh 538s Ensuring cron shows as INFECTED 538s mv /usr/sbin/cron /usr/sbin/cron.to_replace 538s /usr/sbin/cron 538s Ensuring date shows as INFECTED 538s mv /usr/bin/date /usr/bin/date.to_replace 538s /usr/bin/date 538s Ensuring du shows as INFECTED 538s mv /usr/bin/du /usr/bin/du.to_replace 538s /usr/bin/du 538s Ensuring dirname shows as INFECTED 538s mv /usr/bin/dirname /usr/bin/dirname.to_replace 538s /usr/bin/dirname 538s Ensuring echo shows as INFECTED 538s mv /usr/bin/echo /usr/bin/echo.to_replace 538s /usr/bin/echo 538s Ensuring egrep shows as INFECTED 538s mv /usr/bin/egrep /usr/bin/egrep.to_replace 538s /usr/bin/egrep 538s Ensuring env shows as INFECTED 538s mv /usr/bin/env /usr/bin/env.to_replace 538s /usr/bin/env 538s Ensuring find shows as INFECTED 538s mv /usr/bin/find /usr/bin/find.to_replace 538s /usr/bin/find 538s Ensuring fingerd shows as INFECTED 538s mv /usr/sbin/fingerd /usr/sbin/fingerd.to_replace 538s /usr/sbin/fingerd 538s Ensuring gpm shows as INFECTED 538s mv /usr/sbin/gpm /usr/sbin/gpm.to_replace 538s /usr/sbin/gpm 538s Ensuring grep shows as INFECTED 538s mv /usr/bin/grep /usr/bin/grep.to_replace 538s /usr/bin/grep 538s Ensuring hdparm shows as INFECTED 538s mv /usr/sbin/hdparm /usr/sbin/hdparm.to_replace 538s /usr/sbin/hdparm 538s Ensuring su shows as INFECTED 538s mv /usr/bin/su /usr/bin/su.to_replace 538s /usr/bin/su 538s Ensuring ifconfig shows as INFECTED 538s mv /usr/sbin/ifconfig /usr/sbin/ifconfig.to_replace 538s /usr/sbin/ifconfig 538s Ensuring inetd shows as INFECTED 538s mv /usr/sbin/inetd /usr/sbin/inetd.to_replace 538s /usr/sbin/inetd 538s Ensuring in.identd shows as INFECTED 538s mv /usr/sbin/in.identd /usr/sbin/in.identd.to_replace 538s /usr/sbin/in.identd 538s Ensuring init shows as INFECTED 538s mv /usr/sbin/init /usr/sbin/init.to_replace 538s /usr/lib/systemd/systemd 538s Ensuring killall shows as INFECTED 538s mv /usr/bin/killall /usr/bin/killall.to_replace 538s /usr/bin/killall 538s Ensuring login shows as INFECTED 538s mv /usr/bin/login /usr/bin/login.to_replace 538s /usr/bin/login 538s Ensuring ls shows as INFECTED 538s mv /usr/bin/ls /usr/bin/ls.to_replace 538s /usr/bin/ls 538s Ensuring lsof shows as INFECTED 538s mv /usr/bin/lsof /usr/bin/lsof.to_replace 538s /usr/bin/lsof 538s Ensuring mail shows as INFECTED 538s mv /usr/sbin/mail /usr/sbin/mail.to_replace 538s /usr/sbin/mail 538s Ensuring mingetty shows as INFECTED 538s mv /usr/sbin/mingetty /usr/sbin/mingetty.to_replace 538s /usr/sbin/mingetty 538s Ensuring netstat shows as INFECTED 538s mv /usr/bin/netstat /usr/bin/netstat.to_replace 538s /usr/bin/netstat 538s Ensuring named shows as INFECTED 538s mv /usr/sbin/named /usr/sbin/named.to_replace 538s /usr/sbin/named 538s Ensuring passwd shows as INFECTED 538s mv /usr/bin/passwd /usr/bin/passwd.to_replace 538s /usr/bin/passwd 538s Ensuring pidof shows as INFECTED 538s mv /usr/bin/pidof /usr/bin/pidof.to_replace 538s /usr/sbin/killall5 538s Ensuring in.pop2d shows as INFECTED 538s mv /usr/sbin/in.pop2d /usr/sbin/in.pop2d.to_replace 538s /usr/sbin/in.pop2d 538s Ensuring in.pop3d shows as INFECTED 538s mv /usr/sbin/in.pop3d /usr/sbin/in.pop3d.to_replace 538s /usr/sbin/in.pop3d 538s Ensuring ps shows as INFECTED 538s mv /usr/bin/ps /usr/bin/ps.to_replace 538s /usr/bin/ps 538s Ensuring pstree shows as INFECTED 538s mv /usr/bin/pstree /usr/bin/pstree.to_replace 538s /usr/bin/pstree 538s Ensuring rpcinfo shows as INFECTED 538s mv /usr/sbin/rpcinfo /usr/sbin/rpcinfo.to_replace 538s /usr/sbin/rpcinfo 538s Ensuring in.rlogind shows as INFECTED 538s making new: /usr/sbin/in.rlogind 538s /usr/sbin/in.rlogind 538s Ensuring slogin shows as INFECTED 538s mv /usr/bin/slogin /usr/bin/slogin.to_replace 538s /usr/bin/ssh 538s Ensuring sendmail shows as INFECTED 538s mv /usr/sbin/sendmail /usr/sbin/sendmail.to_replace 538s /usr/sbin/sendmail 538s Ensuring sshd shows as INFECTED 538s mv /usr/sbin/sshd /usr/sbin/sshd.to_replace 538s /usr/sbin/sshd 538s Ensuring syslogd shows as INFECTED 538s mv /usr/sbin/syslogd /usr/sbin/syslogd.to_replace 538s /usr/sbin/syslogd 538s Ensuring tar shows as INFECTED 538s mv /usr/bin/tar /usr/bin/tar.to_replace 538s /usr/bin/tar 538s Ensuring tcpd shows as INFECTED 538s mv /usr/sbin/tcpd /usr/sbin/tcpd.to_replace 538s /usr/sbin/tcpd 538s Ensuring top shows as INFECTED 538s mv /usr/bin/top /usr/bin/top.to_replace 538s /usr/bin/top 538s Ensuring telnetd shows as INFECTED 538s mv /usr/sbin/telnetd /usr/sbin/telnetd.to_replace 538s /usr/sbin/telnetd 538s Ensuring timed shows as INFECTED 538s mv /usr/sbin/timed /usr/sbin/timed.to_replace 538s /usr/sbin/timed 538s Ensuring traceroute shows as INFECTED 538s mv /usr/sbin/traceroute /usr/sbin/traceroute.to_replace 538s /usr/sbin/traceroute 538s Ensuring vdir shows as INFECTED 538s mv /usr/bin/vdir /usr/bin/vdir.to_replace 538s /usr/bin/vdir 538s Ensuring w shows as INFECTED 538s mv /usr/bin/w /usr/bin/w.to_replace 538s /usr/bin/w 538s Ensuring write shows as INFECTED 538s mv /usr/bin/write /usr/bin/write.to_replace 538s /usr/bin/write 538s Ensuring asp shows as INFECTED 538s making new: /usr/sbin/asp 538s /usr/sbin/asp 538s Ensuring crontab shows as INFECTED 538s mv /usr/bin/crontab /usr/bin/crontab.to_replace 538s /usr/bin/crontab 538s Ensuring epic shows as INFECTED 538s making new: /usr/sbin/epic 538s /usr/sbin/epic 538s for chk_crontab: mocking: crontab at /usr/bin/crontab 538s modifying tar so chk-tar finds an issue 538s -rwsr-sr-x 1 root root 249 Nov 26 20:48 /usr/bin/tar 538s To delete: /usr/sbin/in.rlogind /usr/sbin/asp /usr/sbin/epic 538s To replace (with .pre-rootkit): /usr/sbin/amd /usr/bin/basename /usr/sbin/biff /usr/bin/chfn /usr/bin/chsh /usr/sbin/cron /usr/bin/date /usr/bin/du /usr/bin/dirname /usr/bin/echo /usr/bin/egrep /usr/bin/env /usr/bin/find /usr/sbin/fingerd /usr/sbin/gpm /usr/bin/grep /usr/sbin/hdparm /usr/bin/su /usr/sbin/ifconfig /usr/sbin/inetd /usr/sbin/in.identd /usr/lib/systemd/systemd /usr/bin/killall /usr/bin/login /usr/bin/ls /usr/bin/lsof /usr/sbin/mail /usr/sbin/mingetty /usr/bin/netstat /usr/sbin/named /usr/bin/passwd /usr/sbin/killall5 /usr/sbin/in.pop2d /usr/sbin/in.pop3d /usr/bin/ps /usr/bin/pstree /usr/sbin/rpcinfo /usr/bin/ssh /usr/sbin/sendmail /usr/sbin/sshd /usr/sbin/syslogd /usr/bin/tar /usr/sbin/tcpd /usr/bin/top /usr/sbin/telnetd /usr/sbin/timed /usr/sbin/traceroute /usr/bin/vdir /usr/bin/w /usr/bin/write /usr/bin/crontab 538s modifying netstat for chk_netstat and bindshell 538s modifying ls so syslogk and kovid are detected 538s modifying grep so a Linux BPF Door is detected 538s mk: /usr/bin/atm in dir: /usr/bin 538s mk: /tmp/tcp.log in dir: /tmp 538s mk: /var/lib/games/.k/foo in dir: /var/lib/games/.k 538s mk: /usr/src/.poop/foo in dir: /usr/src/.poop 538s mk: /dev/.golf/foo in dir: /dev/.golf 538s mk: /dev/tux/foo in dir: /dev/tux 538s mk: /usr/include/. ./foo in dir: /usr/include/. . 538s mk: /usr/lib/tcl5.3/foo in dir: /usr/lib/tcl5.3 538s mk: /etc/ttyhash in dir: /etc 538s mk: /usr/local/lib/libproc.a in dir: /usr/local/lib 538s mk: /bin/mjy in dir: /bin 538s mk: /usr/bin/n3tstat in dir: /usr/bin 538s mk: /bin/lps in dir: /bin 538s mk: /usr/lib/.ark? in dir: /usr/lib 538s mk: /usr/lib/number.cgi in dir: /usr/lib 538s mk: /www/httpd/cgi-bin/last.cgi in dir: /www/httpd/cgi-bin 538s mk: /usr/bin/red.tar in dir: /usr/bin 538s mk: /bin/dy in dir: /bin 538s mk: /dev/chr in dir: /dev 538s mk: /dev/cucl in dir: /dev 538s mk: /usr/include/chk.h in dir: /usr/include 538s mk: /usr/bin/xsf in dir: /usr/bin 539s mk: /usr/lib/locale/uboot in dir: /usr/lib/locale 539s mk: /tmp/xp in dir: /tmp 539s mk: /usr/bin/volc in dir: /usr/bin 539s mk: /usr/include/proc.h in dir: /usr/include 539s mk: /etc/rc.d/init.d/network in dir: /etc/rc.d/init.d 539s mk: /usr/bin/ishit in dir: /usr/bin 539s mk: /usr/sbin/initcheck in dir: /usr/sbin 539s mk: /usr/sbin/mech in dir: /usr/sbin 539s mk: /etc/sysconfig/console/load.zk in dir: /etc/sysconfig/console 539s mk: /etc/ld.so.hash in dir: /etc 539s mk: /bin/imout in dir: /bin 539s mk: /usr/include/icekey.h in dir: /usr/include 539s mk: /sbin/xc in dir: /sbin 539s mk: /sbin/rootedoor in dir: /sbin 539s mk: /etc/.enyelkmOCULTAR.ko/foo in dir: /etc/.enyelkmOCULTAR.ko 539s mk: /var/tmp/vuln.txt in dir: /var/tmp 539s mk: /usr/local/hide/foo in dir: /usr/local/hide 539s mk: /lib/modules/module_init.ko in dir: /lib/modules 539s mk: /tmp/ss0-0 in dir: /tmp 539s mk: /usr/var/mediamgrs.jar in dir: /usr/var 539s mk: /tmp/.ICE-unix/engine.so in dir: /tmp/.ICE-unix 539s mk: /etc/xig in dir: /etc 539s mk: /var/tmp/.1/x in dir: /var/tmp/.1 539s mk: /var/run/.tmp/y in dir: /var/run/.tmp 539s mk: /tmp/suterusu/pwnlnx6 in dir: /tmp/suterusu 539s mk: /usr/share/libc.so.69 in dir: /usr/share 539s mk: /tmp/kdevtmpfsi in dir: /tmp 539s mk: /bin/systemd-daemon in dir: /bin 539s mk: /syslogk in dir: / 539s mk: /root/.whatever.history in dir: /root 539s mk: /root/.whatever.history.hardlink in dir: /root 539s mk: /tmp/name.php in dir: /tmp 539s mk: /bin/.ps in dir: /bin 539s mk: /usr/bin/mailrc in dir: /usr/bin 539s mk: /www/httpd/cgi-bin/bogus.cgi in dir: /www/httpd/cgi-bin 539s mk: /bin/frgy in dir: /bin 539s mk: /dev/cuc in dir: /dev 539s mk: /usr/lib/libpikapp.a in dir: /usr/lib 539s mk: /var/spool/cron/crontabs/foo in dir: /var/spool/cron/crontabs 539s mk: /etc/rc.local in dir: /etc 539s mk: /sbin/ssh in dir: /sbin 539s mk: /dev/bad-file in dir: /dev 539s mk: /etc/passwd in dir: /etc 539s mk: /etc/inetd.conf in dir: /etc 539s mk: /lib/x86_64-linux-gnu/libkeyutils.so.1 in dir: /lib/x86_64-linux-gnu 539s mk: /home/ ./tinyDNS in dir: /home/ . 539s mk: /tmp/by-content in dir: /tmp 539s mk: /bin/in.rexedcs in dir: /bin 539s mk: /tmp/.uua in dir: /tmp 539s mk: /tmp/.bugtraq.c in dir: /tmp 539s mk: /tmp/.../r in dir: /tmp/... 539s mk: /bin/cls in dir: /bin 539s mk: /tmp/sp ace/aaa' exit 1; " in dir: /tmp/sp ace 539s To move back to .pre-rootkit: /etc/rc.local /etc/passwd /etc/inetd.conf /lib/x86_64-linux-gnu/libkeyutils.so.1 539s To rm: /usr/bin/atm /tmp/tcp.log /var/lib/games/.k/foo /usr/src/.poop/foo /dev/.golf/foo /dev/tux/foo /usr/include/. ./foo /usr/lib/tcl5.3/foo /etc/ttyhash /usr/local/lib/libproc.a /bin/mjy /usr/bin/n3tstat /bin/lps /usr/lib/.ark? /usr/lib/number.cgi /www/httpd/cgi-bin/last.cgi /usr/bin/red.tar /bin/dy /dev/chr /dev/cucl /usr/include/chk.h /usr/bin/xsf /usr/lib/locale/uboot /tmp/xp /usr/bin/volc /usr/include/proc.h /etc/rc.d/init.d/network /usr/bin/ishit /usr/sbin/initcheck /usr/sbin/mech /etc/sysconfig/console/load.zk /etc/ld.so.hash /bin/imout /usr/include/icekey.h /sbin/xc /sbin/rootedoor /etc/.enyelkmOCULTAR.ko/foo /var/tmp/vuln.txt /usr/local/hide/foo /lib/modules/module_init.ko /tmp/ss0-0 /usr/var/mediamgrs.jar /tmp/.ICE-unix/engine.so /etc/xig /var/tmp/.1/x /var/run/.tmp/y /tmp/suterusu/pwnlnx6 /usr/share/libc.so.69 /tmp/kdevtmpfsi /bin/systemd-daemon /syslogk /root/.whatever.history /root/.whatever.history.hardlink /tmp/name.php /bin/.ps /usr/bin/mailrc /www/httpd/cgi-bin/bogus.cgi /bin/frgy /dev/cuc /usr/lib/libpikapp.a /var/spool/cron/crontabs/foo /sbin/ssh /dev/bad-file /home/ ./tinyDNS /tmp/by-content /bin/in.rexedcs /tmp/.uua /tmp/.bugtraq.c /tmp/.../r /bin/cls /tmp/sp ace/aaa' exit 1; " 539s for chk_ldsopreload 539s for chk_rshd 539s susp dev 539s for chk_inetdconf 539s /etc/shells 539s # /etc/shells: valid login shells 539s /bin/sh 539s /usr/bin/sh 539s /bin/bash 539s /usr/bin/bash 539s /bin/rbash 539s /usr/bin/rbash 539s /usr/bin/dash 539s /usr/bin/screen 539s /usr/bin/tmux 539s asp 539s stream tcp nowait /bin/sh 539s asp 539s dont know how to fake some lkms (cant make a file in /proc): not tested: sniffer, z2, chkutmp. OSX_RSPLUG never runs under linux. chk_ldsopreload seems to be broken 539s ** Testing: all-tests-can-find-something-01 (chkrootkit -p /tmp/clean) ... 539s *** Output 539s ROOTDIR is `/' 539s Checking `amd'... INFECTED 539s Checking `basename'... INFECTED 539s Checking `biff'... INFECTED 539s Checking `chfn'... INFECTED 539s Checking `chsh'... INFECTED 539s Checking `cron'... INFECTED 539s Checking `crontab'... WARNING 539s WARNING: crontab for nobody found, possible Lupper.Worm. 539s Checking for Lupper.Worm... INFECTED 539s Checking `date'... INFECTED 539s Checking `du'... INFECTED 539s Checking `dirname'... INFECTED 539s Checking `echo'... INFECTED 539s Checking `egrep'... INFECTED 539s Checking `env'... INFECTED 539s Checking `find'... INFECTED 539s Checking `fingerd'... INFECTED 539s Checking `gpm'... INFECTED 539s Checking `grep'... INFECTED 539s Checking `hdparm'... INFECTED 539s Checking `su'... INFECTED 539s Checking `ifconfig'... INFECTED 539s Checking `inetd'... INFECTED 539s Checking `inetdconf'... INFECTED 539s Checking `identd'... INFECTED 539s Checking `init'... INFECTED 539s Checking `killall'... INFECTED 539s Checking `ldsopreload'... not infected 539s Checking `login'... INFECTED 539s Checking `ls'... INFECTED 539s Checking `lsof'... INFECTED 539s Checking `mail'... INFECTED 539s Checking `mingetty'... INFECTED 539s Checking `netstat'... INFECTED 539s Checking `named'... INFECTED 539s Checking `passwd'... INFECTED 539s Checking `pidof'... INFECTED 539s Checking `pop2'... INFECTED 539s Checking `pop3'... INFECTED 539s Checking `ps'... INFECTED 539s Checking `pstree'... INFECTED 539s Checking `rpcinfo'... INFECTED 539s Checking `rlogind'... INFECTED 539s Checking `rshd'... INFECTED 539s Checking `slogin'... INFECTED 539s Checking `sendmail'... INFECTED 539s Checking `sshd'... INFECTED but disabled 539s Checking `syslogd'... INFECTED 539s Checking `tar'... INFECTED 539s Checking `tcpd'... INFECTED 539s Checking `tcpdump'... INFECTED 539s Checking `top'... INFECTED 539s Checking `telnetd'... INFECTED 539s Checking `timed'... INFECTED 539s Checking `traceroute'... INFECTED 539s Checking `vdir'... INFECTED 539s Checking `w'... INFECTED 539s Checking `write'... INFECTED 539s Checking `aliens'... started 539s Searching for suspicious files in /dev... WARNING 539s 539s WARNING: The following suspicious files were found in /dev: 539s /dev/bad-file 539s 539s Searching for known suspicious directories... WARNING 539s 539s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 539s /var/run/.tmp/ [Not from a Debian package] 539s /var/run/.tmp/y [Not from a Debian package] 539s 539s Searching for known suspicious files... WARNING 539s 539s WARNING: The following known suspicious files were found: 539s /usr/bin/atm [Not from a Debian package] 539s /etc/ld.so.hash [Not from a Debian package] 539s 539s Searching for sniffer's logs... WARNING 539s 539s WARNING: The following potential sniffer's logs were found: 539s /tmp/tcp.log [Not from a Debian package] 539s 539s Searching for HiDrootkit rootkit... WARNING 539s 539s WARNING: Possible HiDrootkit rootkit installed: 539s /var/lib/games/.k/ [Not from a Debian package] 539s 540s Searching for t0rn rootkit... WARNING 540s 540s WARNING: Possible t0rn rootkit installed: 540s /etc/ttyhash [Not from a Debian package] 540s 540s Searching for t0rn v8 (or variation)... WARNING 540s 540s WARNING: Possible t0rn v8 (or variation) rootkit installed: 540s /usr/local/lib/libproc.a [Not from a Debian package] 540s 540s Searching for Lion rootkit... WARNING 540s 540s WARNING: Possible Lion rootkit installed: 540s /bin/mjy [Not from a Debian package] 540s 540s Searching for RSHA rootkit... WARNING 540s 540s WARNING: Possible RSHA rootkit installed: 540s /usr/bin/n3tstat [Not from a Debian package] 540s 540s Searching for RH-Sharpe rootkit... WARNING 540s 540s WARNING: Possible RH-Sharpe rootkit installed: 540s /bin/lps [Not from a Debian package] 540s 540s Searching for Ambient (ark) rootkit... WARNING 540s 540s WARNING: Possible Ambient's rootkit (ark) installed: 540s /usr/lib/.ark? [Not from a Debian package] 540s 541s Searching for suspicious files and dirs... WARNING 541s 541s WARNING: The following suspicious files and directories were found: 541s /usr/lib/... [Not from a Debian package] 541s /usr/lib/.DIR-aaa [Not from a Debian package] 541s /usr/lib/.ark? [Not from a Debian package] 541s /usr/lib/.1DIR [Not from a Debian package] 541s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 541s /usr/lib/.bbb [Not from a Debian package] 541s /usr/lib/...DIR [Not from a Debian package] 541s /usr/lib/.aaa [Not from a Debian package] 541s /usr/lib/.1 [Not from a Debian package] 541s 541s Searching for LPD Worm... WARNING 541s 541s WARNING: Possible LPD worm installed (based on files found) 541s 541s Searching for Ramen Worm rootkit... WARNING 541s 541s WARNING: Possible Ramen Worm rootkit installed: 541s /usr/src/.poop/ [Not from a Debian package] 541s 541s Searching for Maniac rootkit... WARNING 541s 541s WARNING: Possible Maniac rootkit installed: 541s /usr/bin/mailrc [Not from a Debian package] 541s 541s Searching for RK17 rootkit... WARNING 541s 541s WARNING: Possible RK17 rootkit installed: 541s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 541s /usr/lib/number.cgi [Not from a Debian package] 541s 541s Searching for Ducoci rootkit... WARNING 541s 541s WARNING: Possible Ducoci rootkit installed: 541s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 541s 541s Searching for Adore Worm... WARNING 541s 541s WARNING: Possible Adore Worm installed: 541s /usr/bin/red.tar [Not from a Debian package] 541s 541s Searching for ShitC Worm... WARNING 541s 541s WARNING: Possible ShitC Worm installed: 541s /usr/bin/frgy [Not from a Debian package] 541s /usr/bin/dy [Not from a Debian package] 541s 541s Searching for Omega Worm... WARNING 541s 541s WARNING: Possible Omega Worm installed: 541s /dev/chr [Not from a Debian package] 541s 541s Searching for Sadmind/IIS Worm... WARNING 541s 541s WARNING: Possible Sadmin/IIS Worm installed: 541s /dev/cuc [Not from a Debian package] 541s 541s Searching for MonKit... WARNING 541s 541s WARNING: Possible MonKit installed: 541s /usr/lib/libpikapp.a [Not from a Debian package] 541s 541s Searching for Showtee rootkit... WARNING 541s 541s WARNING: Possible Showtee rootkit installed: 541s /usr/include/proc.h [Not from a Debian package] 541s /usr/include/chk.h [Not from a Debian package] 541s 542s Searching for OpticKit... WARNING 542s 542s WARNING: Possible OpticKit installed: 542s /usr/bin/xsf [Not from a Debian package] 542s 542s Searching for T.R.K... WARNING 542s 542s WARNING: Possible T.R.K installed: 542s /usr/bin/xsf [Not from a Debian package] 542s 542s Searching for Mithra rootkit... WARNING 542s 542s WARNING: Possible Mithra installed: 542s /usr/lib/locale/uboot [Not from a Debian package] 542s 542s Searching for OBSD rootkit v1... not tested 542s Searching for LOC rootkit... WARNING 542s 542s WARNING: Possible LOC rootkit installed: 542s /tmp/xp [Not from a Debian package] 542s /usr/sbin/epic [Not from a Debian package] 542s Searching for Romanian rootkit... WARNING 542s 542s WARNING: Possible Romanian rootkit installed: 542s /usr/include/proc.h [Not from a Debian package] 542s 542s Searching for HKRK rootkit... WARNING 542s 542s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 542s 542s Searching for Suckit rootkit... WARNING 542s 542s WARNING: Possible Suckit: 542s /dev/.golf/ 542s 542s Searching for Volc rootkit... WARNING 542s 542s WARNING: Possible Volc rootkit installed: 542s /usr/bin/volc [Not from a Debian package] 542s 542s Searching for Gold2 rootkit... WARNING 542s 542s WARNING: Possible Gold2 rootkit installed: 542s /usr/bin/ishit [Not from a Debian package] 542s 542s Searching for TC2 rootkit... WARNING 542s 542s WARNING: Possible TC2 rootkit installed: 542s /usr/sbin/initcheck [Not from a Debian package] 542s 542s Searching for Anonoying rootkit... WARNING 542s 542s WARNING: Possible Anonoying rootkit installed: 542s /usr/sbin/mech [Not from a Debian package] 542s 542s Searching for ZK rootkit... WARNING 542s 542s WARNING: Possible ZK rootkit installed: 542s /etc/sysconfig/console/load.zk [Not from a Debian package] 542s 542s Searching for ShKit rootkit... WARNING 542s 542s WARNING: Possible ShKit rootkit installed: 542s /etc/ld.so.hash [Not from a Debian package] 542s 542s Searching for AjaKit rootkit... WARNING 542s 542s WARNING: Possible AjaKit rootkit installed: 542s /dev/tux/ [Not from a Debian package] 542s 542s Searching for zaRwT rootkit... WARNING 542s 542s WARNING: Possible zaRwT rootkit installed: 542s /bin/imout [Not from a Debian package] 542s 542s Searching for Madalin rootkit... WARNING 542s 542s WARNING: Possible Madalin rootkit installed: 542s /usr/include/icekey.h [Not from a Debian package] 542s 542s Searching for Fu rootkit... WARNING 542s 542s WARNING: Possible Fu rootkit installed: 542s /sbin/xc [Not from a Debian package] 542s 542s Searching for Kenga3 rootkit... WARNING 542s 542s WARNING: Possible Kenga3 rootkit installed: 542s /usr/include/. ./ [Not from a Debian package] 542s /usr/include/. ./foo [Not from a Debian package] 542s 543s Searching for ESRK rootkit... WARNING 543s 543s WARNING: Possible ESRK rootkit installed: 543s /usr/lib/tcl5.3/ [Not from a Debian package] 543s 543s Searching for rootedoor... WARNING 543s 543s WARNING: Possible rootedoor installed: 543s /usr/sbin/rootedoor [Not from a Debian package] 543s /sbin/rootedoor [Not from a Debian package] 543s /sbin/rootedoor [Not from a Debian package] 543s /usr/sbin/rootedoor [Not from a Debian package] 543s 543s Searching for ENYELKM rootkit... WARNING 543s 543s WARNING: Possible ENYELKM rootkit installed: 543s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 543s 543s Searching for common ssh-scanners... WARNING 543s 543s WARNING: Possible ssh-scanner installed: 543s /var/tmp/vuln.txt [Not from a Debian package] 543s 543s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 543s 543s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 543s 543s Searching for Linux/Ebury 1.6... WARNING 543s 543s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 543s Searching for 64-bit Linux Rootkit... WARNING 543s 543s WARNING: Possible 64-bit Linux Rootkit: 543s /usr/local/hide/ [Not from a Debian package] 543s /usr/local/hide/foo [Not from a Debian package] 543s /etc/rc.local [Not from a Debian package] 543s 543s Searching for 64-bit Linux Rootkit modules... WARNING 543s 543s WARNING: Possible 64-bit rootkit modules installed: 543s /lib/modules/module_init.ko [Not from a Debian package] 543s 543s Searching for Mumblehard... WARNING 543s 543s WARNING: Possible Mumblehard backdoor installed: 543s /var/spool/cron/crontabs/foo [Not from a Debian package] 543s 543s Searching for Backdoor.Linux.Mokes.a... WARNING 543s 543s WARNING: Possible Backdoor.Linux.Mokes.a installed: 543s /tmp/ss0-0 [Not from a Debian package] 543s 543s Searching for Malicious TinyDNS... WARNING 543s 543s WARNING: Possible Malicious TinyDNS installed: 543s /home/ ./ [Not from a Debian package] 543s /home/ ./tinyDNS [Not from a Debian package] 543s 547s Searching for Linux.Xor.DDoS... WARNING 547s 547s WARNING: Possible Linux.Xor.DDoS installed: 547s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 547s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 547s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 547s /tmp/clean/sed [Not from a Debian package] 547s /tmp/clean/ls [Not from a Debian package] 547s /tmp/clean/id [Not from a Debian package] 547s /tmp/clean/uname [Not from a Debian package] 547s /tmp/clean/awk [Not from a Debian package] 547s /tmp/clean/head [Not from a Debian package] 547s /tmp/clean/strings [Not from a Debian package] 547s /tmp/clean/cut [Not from a Debian package] 547s /tmp/clean/netstat [Not from a Debian package] 547s /tmp/clean/ls.orig [Not from a Debian package] 547s /tmp/clean/ss [Not from a Debian package] 547s /tmp/clean/find [Not from a Debian package] 547s /tmp/clean/ps [Not from a Debian package] 547s /tmp/clean/grep.orig [Not from a Debian package] 547s /tmp/clean/xargs [Not from a Debian package] 547s /tmp/clean/dpkg-query [Not from a Debian package] 547s /tmp/clean/dirname [Not from a Debian package] 547s /tmp/clean/echo [Not from a Debian package] 547s /tmp/clean/grep [Not from a Debian package] 547s 547s Searching for Linux.Proxy.1.0... WARNING 547s 547s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 547s 547s Searching for CrossRAT... WARNING 547s 547s WARNING: Possible Malicious CrossRAT installed: 547s /usr/var/mediamgrs.jar [Not from a Debian package] 547s 547s Searching for Hidden Cobra... WARNING 547s 547s WARNING: Possible Malicious Hidden Cobra installed: 547s /tmp/.ICE-unix/engine.so [Not from a Debian package] 547s 547s Searching for Rocke Miner rootkit... WARNING 547s 547s WARNING: Possible Rocke Miner rootkit installed: 547s /etc/xig [Not from a Debian package] 547s 547s Searching for PWNLNX4 lkm rootkit... WARNING 547s 547s WARNING: Possible PWNLNX4 lkm rootkit installed: 547s /var/tmp/.1/ [Not from a Debian package] 547s 547s Searching for PWNLNX6 lkm rootkit... WARNING 547s 547s WARNING: Possible PWNLNX6 lkm rootkit installed: 547s /tmp/suterusu/ [Not from a Debian package] 547s 547s Searching for Umbreon lrk... WARNING 547s 547s WARNING: Possible Malicious UMBREON LRK installed: 547s /usr/share/libc.so.69 [Not from a Debian package] 547s 547s Searching for Kinsing.a backdoor rootkit... WARNING 547s 547s WARNING: Possible Kinsing.a backdoor rootkit installed: 547s /tmp/kdevtmpfsi [Not from a Debian package] 547s 547s Searching for RotaJakiro backdoor rootkit... WARNING 547s 547s WARNING: Possible RotaJakiro backdoor rootkit installed: 547s /bin/systemd-daemon [Not from a Debian package] 547s 547s Searching for Syslogk LKM rootkit... WARNING 547s 547s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 547s 547s Searching for Kovid LKM rootkit... WARNING 547s 547s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 547s 547s Searching for Tsunami DDoS Malware rootkit... WARNING 547s 547s WARNING: Possible Tsunami DDoS Malware rootkit installed: 547s /bin/cls [Not from a Debian package] 547s 547s Searching for Linux BPF Door... WARNING 547s 547s WARNING: Possible Linux BPFDoor Malware installed: 547s /proc/xx/stack 547s 548s Searching for suspect PHP files... WARNING 548s 548s WARNING: The following suspicious PHP files were found: 548s /tmp/name.php 548s /tmp/by-content 548s /tmp/sp ace/aaa' exit 1; " 548s 548s Searching for zero-size shell history files in /root... WARNING 548s 548s WARNING: Zero-size history files: 548s /root/.whatever.history [Not from a Debian package] 548s 548s Searching for hardlinked shell history files in /root... WARNING 548s 548s WARNING: shell history files hardlinked to another file: 548s /root/.whatever.history [Not from a Debian package] 548s 548s Checking `aliens'... finished 548s Checking `asp'... WARNING 548s 548s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 548s 548s Checking `bindshell'... WARNING 548s 548s WARNING: Potential bindshell installed: infected ports: 600 31337 548s 548s Checking `lkm'... started 548s Searching for Adore LKM... not tested 548s Searching for sebek LKM (Adore based)... not tested 548s Searching for knark LKM rootkit... not found 559s Searching for for hidden processes with chkproc... not found 559s Searching for for hidden directories using chkdirs... not found 559s Checking `lkm'... finished 559s Checking `rexedcs'... INFECTED: /usr/bin/in.rexedcs 559s Checking `sniffer'... WARNING 559s 559s WARNING: Output from ifpromisc: 559s lo: not promisc and no packet sniffer sockets 559s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 559s 559s Checking `w55808'... WARNING 559s 559s WARNING: Possible 55808 Worm installed 559s 559s Checking `wted'... not found 559s Checking `scalper'... WARNING 559s 559s WARNING: Possible Scalper Worm installed 559s 559s Checking `slapper'... WARNING 559s 559s WARNING: Possible Slapper Worm installed: 559s /tmp/.bugtraq.c [Not from a Debian package] 559s 559s Checking `z2'... not found 560s Checking `chkutmp'... not found 560s Checking `OSX_RSPLUG'... not tested 560s **** Files in log 560s total 44K 560s drwxr-xr-x 2 root root 4.0K Nov 26 20:48 . 560s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 560s -rw-r--r-- 1 root root 0 Nov 26 20:48 chkrootkit-daily.log 560s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.expected 560s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 560s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 560s *** Test of content of output follows... 560s **** Test for '^ROOTDIR is `/'$' 560s ROOTDIR is `/' 560s OK 560s **** Test for '^Checking `amd'\.\.\. INFECTED$' 560s Checking `amd'... INFECTED 560s OK 560s **** Test for '^Checking `basename'\.\.\. INFECTED$' 560s Checking `basename'... INFECTED 560s OK 560s **** Test for '^Checking `biff'\.\.\. INFECTED$' 560s Checking `biff'... INFECTED 560s OK 560s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 560s Checking `chfn'... INFECTED 560s OK 560s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 560s Checking `chsh'... INFECTED 560s OK 560s **** Test for '^Checking `cron'\.\.\. INFECTED$' 560s Checking `cron'... INFECTED 560s OK 560s **** Test for '^Checking `crontab'\.\.\. WARNING$' 560s Checking `crontab'... WARNING 560s OK 560s **** Test for '^$' 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s 560s OK 560s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 560s WARNING: crontab for nobody found, possible Lupper.Worm. 560s OK 560s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 560s Checking for Lupper.Worm... INFECTED 560s OK 560s **** Test for '^Checking `date'\.\.\. INFECTED$' 560s Checking `date'... INFECTED 560s OK 560s **** Test for '^Checking `du'\.\.\. INFECTED$' 560s Checking `du'... INFECTED 560s OK 560s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 560s Checking `dirname'... INFECTED 560s OK 560s **** Test for '^Checking `echo'\.\.\. INFECTED$' 560s Checking `echo'... INFECTED 560s OK 560s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 560s Checking `egrep'... INFECTED 560s OK 560s **** Test for '^Checking `env'\.\.\. INFECTED$' 560s Checking `env'... INFECTED 560s OK 560s **** Test for '^Checking `find'\.\.\. INFECTED$' 560s Checking `find'... INFECTED 560s OK 560s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 560s Checking `fingerd'... INFECTED 560s OK 560s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 560s Checking `gpm'... INFECTED 560s OK 560s **** Test for '^Checking `grep'\.\.\. INFECTED$' 560s Checking `grep'... INFECTED 560s OK 560s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 560s Checking `hdparm'... INFECTED 560s OK 560s **** Test for '^Checking `su'\.\.\. INFECTED$' 560s Checking `su'... INFECTED 560s OK 560s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 560s Checking `ifconfig'... INFECTED 560s OK 560s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 560s Checking `inetd'... INFECTED 560s OK 560s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 560s Checking `inetdconf'... INFECTED 560s OK 560s **** Test for '^Checking `identd'\.\.\. INFECTED$' 560s Checking `identd'... INFECTED 560s OK 560s **** Test for '^Checking `init'\.\.\. INFECTED$' 560s Checking `init'... INFECTED 560s OK 560s **** Test for '^Checking `killall'\.\.\. INFECTED$' 560s Checking `killall'... INFECTED 560s OK 560s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 560s Checking `ldsopreload'... not infected 560s OK 560s **** Test for '^Checking `login'\.\.\. INFECTED$' 560s Checking `login'... INFECTED 560s OK 560s **** Test for '^Checking `ls'\.\.\. INFECTED$' 560s Checking `ls'... INFECTED 560s OK 560s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 560s Checking `lsof'... INFECTED 560s OK 560s **** Test for '^Checking `mail'\.\.\. INFECTED$' 560s Checking `mail'... INFECTED 560s OK 560s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 560s Checking `mingetty'... INFECTED 560s OK 560s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 560s Checking `netstat'... INFECTED 560s OK 560s **** Test for '^Checking `named'\.\.\. INFECTED$' 560s Checking `named'... INFECTED 560s OK 560s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 560s Checking `passwd'... INFECTED 560s OK 560s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 560s Checking `pidof'... INFECTED 560s OK 560s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 560s Checking `pop2'... INFECTED 560s OK 560s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 560s Checking `pop3'... INFECTED 560s OK 560s **** Test for '^Checking `ps'\.\.\. INFECTED$' 560s Checking `ps'... INFECTED 560s OK 560s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 560s Checking `pstree'... INFECTED 560s OK 560s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 560s Checking `rpcinfo'... INFECTED 560s OK 560s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 560s Checking `rlogind'... INFECTED 560s OK 560s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 560s Checking `rshd'... INFECTED 560s OK 560s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 560s Checking `slogin'... INFECTED 560s OK 560s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 560s Checking `sendmail'... INFECTED 560s OK 560s **** Test for '^Checking `sshd'\.\.\. INFECTED but disabled$' 560s Checking `sshd'... INFECTED but disabled 560s OK 560s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 560s Checking `syslogd'... INFECTED 560s OK 560s **** Test for '^Checking `tar'\.\.\. INFECTED$' 560s Checking `tar'... INFECTED 560s OK 560s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 560s Checking `tcpd'... INFECTED 560s OK 560s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 560s Checking `tcpdump'... INFECTED 560s OK 560s **** Test for '^Checking `top'\.\.\. INFECTED$' 560s Checking `top'... INFECTED 560s OK 560s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 560s Checking `telnetd'... INFECTED 560s OK 560s **** Test for '^Checking `timed'\.\.\. INFECTED$' 560s Checking `timed'... INFECTED 560s OK 560s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 560s Checking `traceroute'... INFECTED 560s OK 560s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 560s Checking `vdir'... INFECTED 560s OK 560s **** Test for '^Checking `w'\.\.\. INFECTED$' 560s Checking `w'... INFECTED 560s OK 560s **** Test for '^Checking `write'\.\.\. INFECTED$' 560s Checking `write'... INFECTED 560s OK 560s **** Test for '^Checking `aliens'\.\.\. started$' 560s Checking `aliens'... started 560s OK 560s **** Test for '^Searching for suspicious files in /dev\.\.\. WARNING$' 560s Searching for suspicious files in /dev... WARNING 560s OK 560s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 560s WARNING: The following suspicious files were found in /dev: 560s OK 560s **** Test for '^/dev/bad-file$' 560s /dev/bad-file 560s OK 560s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 560s Searching for known suspicious directories... WARNING 560s OK 560s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 560s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 560s OK 560s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 560s /var/run/.tmp/ [Not from a Debian package] 560s OK 560s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 560s /var/run/.tmp/y [Not from a Debian package] 560s OK 560s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 560s Searching for known suspicious files... WARNING 560s OK 560s **** Test for '^WARNING: The following known suspicious files were found:$' 560s WARNING: The following known suspicious files were found: 560s OK 560s **** Test for '^/usr/bin/atm \[Not from a Debian package\]$' 560s /usr/bin/atm [Not from a Debian package] 560s OK 560s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 560s /etc/ld.so.hash [Not from a Debian package] 560s /etc/ld.so.hash [Not from a Debian package] 560s OK 560s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 560s Searching for sniffer's logs... WARNING 560s OK 560s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 560s WARNING: The following potential sniffer's logs were found: 560s OK 560s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 560s /tmp/tcp.log [Not from a Debian package] 560s OK 560s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 560s Searching for HiDrootkit rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 560s WARNING: Possible HiDrootkit rootkit installed: 560s OK 560s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 560s /var/lib/games/.k/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 560s Searching for t0rn rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 560s WARNING: Possible t0rn rootkit installed: 560s OK 560s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 560s /etc/ttyhash [Not from a Debian package] 560s OK 560s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. WARNING$' 560s Searching for t0rn v8 (or variation)... WARNING 560s OK 560s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 560s WARNING: Possible t0rn v8 (or variation) rootkit installed: 560s OK 560s **** Test for '^/usr/local/lib/libproc\.a \[Not from a Debian package\]$' 560s /usr/local/lib/libproc.a [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 560s Searching for Lion rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Lion rootkit installed:$' 560s WARNING: Possible Lion rootkit installed: 560s OK 560s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 560s /bin/mjy [Not from a Debian package] 560s OK 560s **** Test for '^Searching for RSHA rootkit\.\.\. WARNING$' 560s Searching for RSHA rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 560s WARNING: Possible RSHA rootkit installed: 560s OK 560s **** Test for '^/usr/bin/n3tstat \[Not from a Debian package\]$' 560s /usr/bin/n3tstat [Not from a Debian package] 560s OK 560s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 560s Searching for RH-Sharpe rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 560s WARNING: Possible RH-Sharpe rootkit installed: 560s OK 560s **** Test for '^/bin/lps \[Not from a Debian package\]$' 560s /bin/lps [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. WARNING$' 560s Searching for Ambient (ark) rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 560s WARNING: Possible Ambient's rootkit (ark) installed: 560s OK 560s **** Test for '^/usr/lib/\.ark\? \[Not from a Debian package\]$' 560s /usr/lib/.ark? [Not from a Debian package] 560s /usr/lib/.ark? [Not from a Debian package] 560s OK 560s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 560s Searching for suspicious files and dirs... WARNING 560s OK 560s **** Test for '^WARNING: The following suspicious files and directories were found:$' 560s WARNING: The following suspicious files and directories were found: 560s OK 560s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 560s /usr/lib/.1 [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 560s /usr/lib/.aaa [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 560s /usr/lib/.1DIR [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.ark\? \[Not from a Debian package\]$' 560s /usr/lib/.ark? [Not from a Debian package] 560s /usr/lib/.ark? [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 560s /usr/lib/...DIR [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 560s /usr/lib/.bbb [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 560s /usr/lib/.DIR-aaa [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 560s /usr/lib/... [Not from a Debian package] 560s OK 560s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 560s Searching for LPD Worm... WARNING 560s OK 560s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 560s WARNING: Possible LPD worm installed (based on files found) 560s OK 560s **** Test for '^Searching for Ramen Worm rootkit\.\.\. WARNING$' 560s Searching for Ramen Worm rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 560s WARNING: Possible Ramen Worm rootkit installed: 560s OK 560s **** Test for '^/usr/src/\.poop/ \[Not from a Debian package\]$' 560s /usr/src/.poop/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Maniac rootkit\.\.\. WARNING$' 560s Searching for Maniac rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 560s WARNING: Possible Maniac rootkit installed: 560s OK 560s **** Test for '^/usr/bin/mailrc \[Not from a Debian package\]$' 560s /usr/bin/mailrc [Not from a Debian package] 560s OK 560s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 560s Searching for RK17 rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 560s WARNING: Possible RK17 rootkit installed: 560s OK 560s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 560s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 560s OK 560s **** Test for '^/usr/lib/number\.cgi \[Not from a Debian package\]$' 560s /usr/lib/number.cgi [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 560s Searching for Ducoci rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 560s WARNING: Possible Ducoci rootkit installed: 560s OK 560s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 560s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Adore Worm\.\.\. WARNING$' 560s Searching for Adore Worm... WARNING 560s OK 560s **** Test for '^WARNING: Possible Adore Worm installed:$' 560s WARNING: Possible Adore Worm installed: 560s OK 560s **** Test for '^/usr/bin/red\.tar \[Not from a Debian package\]$' 560s /usr/bin/red.tar [Not from a Debian package] 560s OK 560s **** Test for '^Searching for ShitC Worm\.\.\. WARNING$' 560s Searching for ShitC Worm... WARNING 560s OK 560s **** Test for '^WARNING: Possible ShitC Worm installed:$' 560s WARNING: Possible ShitC Worm installed: 560s OK 560s **** Test for '^(/usr)?/bin/dy \[Not from a Debian package\]$' 560s /usr/bin/dy [Not from a Debian package] 560s OK 560s **** Test for '^(/usr)?/bin/frgy \[Not from a Debian package\]$' 560s /usr/bin/frgy [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 560s Searching for Omega Worm... WARNING 560s OK 560s **** Test for '^WARNING: Possible Omega Worm installed:$' 560s WARNING: Possible Omega Worm installed: 560s OK 560s **** Test for '^/dev/chr \[Not from a Debian package\]$' 560s /dev/chr [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 560s Searching for Sadmind/IIS Worm... WARNING 560s OK 560s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 560s WARNING: Possible Sadmin/IIS Worm installed: 560s OK 560s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 560s /dev/cuc [Not from a Debian package] 560s OK 560s **** Test for '^Searching for MonKit\.\.\. WARNING$' 560s Searching for MonKit... WARNING 560s OK 560s **** Test for '^WARNING: Possible MonKit installed:$' 560s WARNING: Possible MonKit installed: 560s OK 560s **** Test for '^/usr/lib/libpikapp\.a \[Not from a Debian package\]$' 560s /usr/lib/libpikapp.a [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Showtee rootkit\.\.\. WARNING$' 560s Searching for Showtee rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 560s WARNING: Possible Showtee rootkit installed: 560s OK 560s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 560s /usr/include/proc.h [Not from a Debian package] 560s /usr/include/proc.h [Not from a Debian package] 560s OK 560s **** Test for '^/usr/include/chk\.h \[Not from a Debian package\]$' 560s /usr/include/chk.h [Not from a Debian package] 560s OK 560s **** Test for '^Searching for OpticKit\.\.\. WARNING$' 560s Searching for OpticKit... WARNING 560s OK 560s **** Test for '^WARNING: Possible OpticKit installed:$' 560s WARNING: Possible OpticKit installed: 560s OK 560s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 560s /usr/bin/xsf [Not from a Debian package] 560s /usr/bin/xsf [Not from a Debian package] 560s OK 560s **** Test for '^Searching for T\.R\.K\.\.\. WARNING$' 560s Searching for T.R.K... WARNING 560s OK 560s **** Test for '^WARNING: Possible T\.R\.K installed:$' 560s WARNING: Possible T.R.K installed: 560s OK 560s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 560s /usr/bin/xsf [Not from a Debian package] 560s /usr/bin/xsf [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Mithra rootkit\.\.\. WARNING$' 560s Searching for Mithra rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Mithra installed:$' 560s WARNING: Possible Mithra installed: 560s OK 560s **** Test for '^/usr/lib/locale/uboot \[Not from a Debian package\]$' 560s /usr/lib/locale/uboot [Not from a Debian package] 560s OK 560s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 560s Searching for OBSD rootkit v1... not tested 560s OK 560s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 560s Searching for LOC rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible LOC rootkit installed:$' 560s WARNING: Possible LOC rootkit installed: 560s OK 560s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 560s /tmp/xp [Not from a Debian package] 560s OK 560s **** Test for '^/usr/sbin/epic \[Not from a Debian package\]$' 560s /usr/sbin/epic [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Romanian rootkit\.\.\. WARNING$' 560s Searching for Romanian rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 560s WARNING: Possible Romanian rootkit installed: 560s OK 560s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 560s /usr/include/proc.h [Not from a Debian package] 560s /usr/include/proc.h [Not from a Debian package] 560s OK 560s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 560s Searching for HKRK rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network \[Not from a Debian package\]$' 560s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 560s Searching for Suckit rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Suckit:$' 560s WARNING: Possible Suckit: 560s OK 560s **** Test for '^/dev/\.golf/$' 560s /dev/.golf/ 560s OK 560s **** Test for '^Searching for Volc rootkit\.\.\. WARNING$' 560s Searching for Volc rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Volc rootkit installed:$' 560s WARNING: Possible Volc rootkit installed: 560s OK 560s **** Test for '^/usr/bin/volc \[Not from a Debian package\]$' 560s /usr/bin/volc [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Gold2 rootkit\.\.\. WARNING$' 560s Searching for Gold2 rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 560s WARNING: Possible Gold2 rootkit installed: 560s OK 560s **** Test for '^/usr/bin/ishit \[Not from a Debian package\]$' 560s /usr/bin/ishit [Not from a Debian package] 560s OK 560s **** Test for '^Searching for TC2 rootkit\.\.\. WARNING$' 560s Searching for TC2 rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 560s WARNING: Possible TC2 rootkit installed: 560s OK 560s **** Test for '^/usr/sbin/initcheck \[Not from a Debian package\]$' 560s /usr/sbin/initcheck [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Anonoying rootkit\.\.\. WARNING$' 560s Searching for Anonoying rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 560s WARNING: Possible Anonoying rootkit installed: 560s OK 560s **** Test for '^/usr/sbin/mech \[Not from a Debian package\]$' 560s /usr/sbin/mech [Not from a Debian package] 560s OK 560s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 560s Searching for ZK rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible ZK rootkit installed:$' 560s WARNING: Possible ZK rootkit installed: 560s OK 560s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 560s /etc/sysconfig/console/load.zk [Not from a Debian package] 560s OK 560s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 560s Searching for ShKit rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 560s WARNING: Possible ShKit rootkit installed: 560s OK 560s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 560s /etc/ld.so.hash [Not from a Debian package] 560s /etc/ld.so.hash [Not from a Debian package] 560s OK 560s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 560s Searching for AjaKit rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 560s WARNING: Possible AjaKit rootkit installed: 560s OK 560s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 560s /dev/tux/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 560s Searching for zaRwT rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 560s WARNING: Possible zaRwT rootkit installed: 560s OK 560s **** Test for '^/bin/imout \[Not from a Debian package\]$' 560s /bin/imout [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Madalin rootkit\.\.\. WARNING$' 560s Searching for Madalin rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 560s WARNING: Possible Madalin rootkit installed: 560s OK 560s **** Test for '^/usr/include/icekey\.h \[Not from a Debian package\]$' 560s /usr/include/icekey.h [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 560s Searching for Fu rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Fu rootkit installed:$' 560s WARNING: Possible Fu rootkit installed: 560s OK 560s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 560s /sbin/xc [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Kenga3 rootkit\.\.\. WARNING$' 560s Searching for Kenga3 rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 560s WARNING: Possible Kenga3 rootkit installed: 560s OK 560s **** Test for '^/usr/include/\. \./ \[Not from a Debian package\]$' 560s /usr/include/. ./ [Not from a Debian package] 560s OK 560s **** Test for '^/usr/include/\. \./foo \[Not from a Debian package\]$' 560s /usr/include/. ./foo [Not from a Debian package] 560s OK 560s **** Test for '^Searching for ESRK rootkit\.\.\. WARNING$' 560s Searching for ESRK rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 560s WARNING: Possible ESRK rootkit installed: 560s OK 560s **** Test for '^/usr/lib/tcl5\.3/ \[Not from a Debian package\]$' 560s /usr/lib/tcl5.3/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 560s Searching for rootedoor... WARNING 560s OK 560s **** Test for '^WARNING: Possible rootedoor installed:$' 560s WARNING: Possible rootedoor installed: 560s OK 560s **** Test for '^/usr/sbin/rootedoor \[Not from a Debian package\]$' 560s /usr/sbin/rootedoor [Not from a Debian package] 560s /usr/sbin/rootedoor [Not from a Debian package] 560s OK 560s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 560s /sbin/rootedoor [Not from a Debian package] 560s /sbin/rootedoor [Not from a Debian package] 560s OK 560s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 560s Searching for ENYELKM rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 560s WARNING: Possible ENYELKM rootkit installed: 560s OK 560s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 560s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 560s Searching for common ssh-scanners... WARNING 560s OK 560s **** Test for '^WARNING: Possible ssh-scanner installed:$' 560s WARNING: Possible ssh-scanner installed: 560s OK 560s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 560s /var/tmp/vuln.txt [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 560s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 560s OK 560s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 560s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 560s OK 560s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 560s Searching for Linux/Ebury 1.6... WARNING 560s OK 560s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 560s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 560s OK 560s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 560s Searching for 64-bit Linux Rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:$' 560s WARNING: Possible 64-bit Linux Rootkit: 560s OK 560s **** Test for '^/usr/local/hide/ \[Not from a Debian package\]$' 560s /usr/local/hide/ [Not from a Debian package] 560s OK 560s **** Test for '^/usr/local/hide/foo \[Not from a Debian package\]$' 560s /usr/local/hide/foo [Not from a Debian package] 560s OK 560s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 560s /etc/rc.local [Not from a Debian package] 560s OK 560s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 560s Searching for 64-bit Linux Rootkit modules... WARNING 560s OK 560s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 560s WARNING: Possible 64-bit rootkit modules installed: 560s OK 560s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 560s /lib/modules/module_init.ko [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 560s Searching for Mumblehard... WARNING 560s OK 560s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 560s WARNING: Possible Mumblehard backdoor installed: 560s OK 560s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 560s /var/spool/cron/crontabs/foo [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 560s Searching for Backdoor.Linux.Mokes.a... WARNING 560s OK 560s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 560s WARNING: Possible Backdoor.Linux.Mokes.a installed: 560s OK 560s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 560s /tmp/ss0-0 [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 560s Searching for Malicious TinyDNS... WARNING 560s OK 560s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 560s WARNING: Possible Malicious TinyDNS installed: 560s OK 560s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 560s /home/ ./ [Not from a Debian package] 560s OK 560s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 560s /home/ ./tinyDNS [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 560s Searching for Linux.Xor.DDoS... WARNING 560s OK 560s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 560s WARNING: Possible Linux.Xor.DDoS installed: 560s OK 560s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 560s /tmp/clean/strings [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 560s /tmp/clean/uname [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 560s /tmp/clean/head [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 560s /tmp/clean/find [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 560s /tmp/clean/echo [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 560s /tmp/clean/netstat [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 560s /tmp/clean/ls [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 560s /tmp/clean/ls.orig [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 560s /tmp/clean/ps [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 560s /tmp/clean/awk [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 560s /tmp/clean/grep [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 560s /tmp/clean/grep.orig [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 560s /tmp/clean/dirname [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 560s /tmp/clean/ss [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 560s /tmp/clean/sed [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 560s /tmp/clean/cut [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 560s /tmp/clean/id [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 560s /tmp/clean/xargs [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 560s /tmp/clean/dpkg-query [Not from a Debian package] 560s OK 560s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 560s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 560s Searching for Linux.Proxy.1.0... WARNING 560s OK 560s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 560s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 560s OK 560s **** Test for '^Searching for CrossRAT\.\.\. WARNING$' 560s Searching for CrossRAT... WARNING 560s OK 560s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 560s WARNING: Possible Malicious CrossRAT installed: 560s OK 560s **** Test for '^/usr/var/mediamgrs\.jar \[Not from a Debian package\]$' 560s /usr/var/mediamgrs.jar [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 560s Searching for Hidden Cobra... WARNING 560s OK 560s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 560s WARNING: Possible Malicious Hidden Cobra installed: 560s OK 560s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 560s /tmp/.ICE-unix/engine.so [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 560s Searching for Rocke Miner rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 560s WARNING: Possible Rocke Miner rootkit installed: 560s OK 560s **** Test for '^/etc/xig \[Not from a Debian package\]$' 560s /etc/xig [Not from a Debian package] 560s OK 560s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 560s Searching for PWNLNX4 lkm rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 560s WARNING: Possible PWNLNX4 lkm rootkit installed: 560s OK 560s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 560s /var/tmp/.1/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 560s Searching for PWNLNX6 lkm rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 560s WARNING: Possible PWNLNX6 lkm rootkit installed: 560s OK 560s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 560s /tmp/suterusu/ [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Umbreon lrk\.\.\. WARNING$' 560s Searching for Umbreon lrk... WARNING 560s OK 560s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 560s WARNING: Possible Malicious UMBREON LRK installed: 560s OK 560s **** Test for '^/usr/share/libc\.so\.69 \[Not from a Debian package\]$' 560s /usr/share/libc.so.69 [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 560s Searching for Kinsing.a backdoor rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 560s WARNING: Possible Kinsing.a backdoor rootkit installed: 560s OK 560s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 560s /tmp/kdevtmpfsi [Not from a Debian package] 560s OK 560s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 560s Searching for RotaJakiro backdoor rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 560s WARNING: Possible RotaJakiro backdoor rootkit installed: 560s OK 560s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 560s /bin/systemd-daemon [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. WARNING$' 560s Searching for Syslogk LKM rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 560s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 560s OK 560s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 560s Searching for Kovid LKM rootkit... WARNING 560s OK 560s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 560s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 560s OK 560s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 560s Searching for Tsunami DDoS Malware rootkit... WARNING 560s OK 560s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 560s WARNING: Possible Tsunami DDoS Malware rootkit installed: 560s OK 560s **** Test for '^/bin/cls \[Not from a Debian package\]$' 560s /bin/cls [Not from a Debian package] 560s OK 560s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 560s Searching for Linux BPF Door... WARNING 560s OK 560s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 560s WARNING: Possible Linux BPFDoor Malware installed: 560s OK 560s **** Test for '^/proc/xx/stack$' 560s /proc/xx/stack 560s OK 560s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 560s Searching for suspect PHP files... WARNING 560s OK 560s **** Test for '^WARNING: The following suspicious PHP files were found:$' 560s WARNING: The following suspicious PHP files were found: 560s OK 560s **** Test for '^/tmp/name\.php$' 560s /tmp/name.php 560s OK 560s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 560s /tmp/sp ace/aaa' exit 1; " 560s OK 560s **** Test for '^/tmp/by-content$' 560s /tmp/by-content 560s OK 560s **** Test for '^Searching for zero-size shell history files in /root\.\.\. WARNING$' 560s Searching for zero-size shell history files in /root... WARNING 560s OK 560s **** Test for '^WARNING: Zero-size history files:$' 560s WARNING: Zero-size history files: 560s OK 560s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 560s /root/.whatever.history [Not from a Debian package] 560s /root/.whatever.history [Not from a Debian package] 560s OK 560s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. WARNING$' 560s Searching for hardlinked shell history files in /root... WARNING 560s OK 560s **** Test for '^WARNING: shell history files hardlinked to another file:$' 560s WARNING: shell history files hardlinked to another file: 560s OK 560s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 560s /root/.whatever.history [Not from a Debian package] 560s /root/.whatever.history [Not from a Debian package] 560s OK 560s **** Test for '^Checking `aliens'\.\.\. finished$' 560s Checking `aliens'... finished 560s OK 560s **** Test for '^Checking `asp'\.\.\. WARNING$' 560s Checking `asp'... WARNING 560s OK 560s **** Test for '^WARNING: Possible Ramen Worm installed in /etc/inetd\.conf$' 560s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 560s OK 560s **** Test for '^Checking `bindshell'\.\.\. WARNING$' 560s Checking `bindshell'... WARNING 560s OK 560s **** Test for '^WARNING: Potential bindshell installed: infected ports: 600 31337$' 560s WARNING: Potential bindshell installed: infected ports: 600 31337 560s OK 560s **** Test for '^Checking `lkm'\.\.\. started$' 560s Checking `lkm'... started 560s OK 560s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 560s Searching for Adore LKM... not tested 560s OK 560s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 560s Searching for sebek LKM (Adore based)... not tested 560s OK 560s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 560s Searching for knark LKM rootkit... not found 560s OK 560s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 560s Searching for for hidden processes with chkproc... not found 560s OK 560s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 560s Searching for for hidden directories using chkdirs... not found 560s OK 560s **** Test for '^Checking `lkm'\.\.\. finished$' 560s Checking `lkm'... finished 560s OK 560s **** Test for '^Checking `rexedcs'\.\.\. INFECTED: /usr/bin/in\.rexedcs$' 560s Checking `rexedcs'... INFECTED: /usr/bin/in.rexedcs 560s OK 560s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 560s Checking `sniffer'... WARNING 560s OK 560s **** Test for '^WARNING: Output from ifpromisc:$' 560s WARNING: Output from ifpromisc: 560s OK 560s **** Test for '^lo: not promisc and no packet sniffer sockets$' 560s lo: not promisc and no packet sniffer sockets 560s OK 560s **** Test for '^Checking `w55808'\.\.\. WARNING$' 560s Checking `w55808'... WARNING 560s OK 560s **** Test for '^WARNING: Possible 55808 Worm installed$' 560s WARNING: Possible 55808 Worm installed 560s OK 560s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 560s Checking `wted'... not found 560s OK 560s **** Test for '^Checking `scalper'\.\.\. WARNING$' 560s Checking `scalper'... WARNING 560s OK 560s **** Test for '^WARNING: Possible Scalper Worm installed$' 560s WARNING: Possible Scalper Worm installed 560s OK 560s **** Test for '^Checking `slapper'\.\.\. WARNING$' 560s Checking `slapper'... WARNING 560s OK 560s **** Test for '^WARNING: Possible Slapper Worm installed:$' 560s WARNING: Possible Slapper Worm installed: 560s OK 560s **** Test for '^/tmp/\.bugtraq\.c \[Not from a Debian package\]$' 560s /tmp/.bugtraq.c [Not from a Debian package] 560s OK 560s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 560s Checking `z2'... not found 560s OK 560s **** Test for '^Checking `chkutmp'\.\.\.' 560s Checking `chkutmp'... not found 560s OK 560s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 560s Checking `OSX_RSPLUG'... not tested 560s OK 560s ** PASS: Testing: all-tests-can-find-something-01 (chkrootkit -p /tmp/clean) done: PASS 560s *** Unexpected (unmatched) lines follow (for info): 560s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 560s ** Testing: all-tests-can-find-something-02-quiet (chkrootkit -p /tmp/clean -q) ... 560s *** Output 560s Checking `amd'... INFECTED 560s Checking `basename'... INFECTED 560s Checking `biff'... INFECTED 560s Checking `chfn'... INFECTED 560s Checking `chsh'... INFECTED 560s Checking `cron'... INFECTED 560s WARNING: crontab for nobody found, possible Lupper.Worm. 560s Checking for Lupper.Worm... INFECTED 560s Checking `crontab'... INFECTED 560s Checking `date'... INFECTED 560s Checking `du'... INFECTED 560s Checking `dirname'... INFECTED 560s Checking `echo'... INFECTED 560s Checking `egrep'... INFECTED 560s Checking `env'... INFECTED 560s Checking `find'... INFECTED 561s Checking `fingerd'... INFECTED 561s Checking `gpm'... INFECTED 561s Checking `grep'... INFECTED 561s Checking `hdparm'... INFECTED 561s Checking `su'... INFECTED 561s Checking `ifconfig'... INFECTED 561s Checking `inetd'... INFECTED 561s Checking `inetdconf'... INFECTED 561s Checking `identd'... INFECTED 561s Checking `init'... INFECTED 561s Checking `killall'... INFECTED 561s Checking `login'... INFECTED 561s Checking `ls'... INFECTED 561s Checking `lsof'... INFECTED 561s Checking `mail'... INFECTED 561s Checking `mingetty'... INFECTED 561s Checking `netstat'... INFECTED 561s Checking `named'... INFECTED 561s Checking `passwd'... INFECTED 561s Checking `pidof'... INFECTED 561s Checking `pop2'... INFECTED 561s Checking `pop3'... INFECTED 561s Checking `ps'... INFECTED 561s Checking `pstree'... INFECTED 561s Checking `rpcinfo'... INFECTED 561s Checking `rlogind'... INFECTED 561s Checking `rshd'... INFECTED 561s Checking `slogin'... INFECTED 561s Checking `sendmail'... INFECTED 561s Checking `syslogd'... INFECTED 561s Checking `tar'... INFECTED 561s Checking `tcpd'... INFECTED 561s Checking `tcpdump'... INFECTED 561s Checking `top'... INFECTED 561s Checking `telnetd'... INFECTED 561s Checking `timed'... INFECTED 561s Checking `traceroute'... INFECTED 561s Checking `vdir'... INFECTED 561s Checking `w'... INFECTED 561s Checking `write'... INFECTED 561s WARNING: The following suspicious files were found in /dev: 561s /dev/bad-file 561s 561s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 561s /var/run/.tmp/ [Not from a Debian package] 561s /var/run/.tmp/y [Not from a Debian package] 561s 561s WARNING: The following known suspicious files were found: 561s /usr/bin/atm [Not from a Debian package] 561s /etc/ld.so.hash [Not from a Debian package] 561s 561s WARNING: The following potential sniffer's logs were found: 561s /tmp/tcp.log [Not from a Debian package] 561s 561s WARNING: Possible HiDrootkit rootkit installed: 561s /var/lib/games/.k/ [Not from a Debian package] 561s 561s WARNING: Possible t0rn rootkit installed: 561s /etc/ttyhash [Not from a Debian package] 561s 561s WARNING: Possible t0rn v8 (or variation) rootkit installed: 561s /usr/local/lib/libproc.a [Not from a Debian package] 561s 561s WARNING: Possible Lion rootkit installed: 561s /bin/mjy [Not from a Debian package] 561s 561s WARNING: Possible RSHA rootkit installed: 561s /usr/bin/n3tstat [Not from a Debian package] 561s 562s WARNING: Possible RH-Sharpe rootkit installed: 562s /bin/lps [Not from a Debian package] 562s 562s WARNING: Possible Ambient's rootkit (ark) installed: 562s /usr/lib/.ark? [Not from a Debian package] 562s 562s WARNING: The following suspicious files and directories were found: 562s /usr/lib/... [Not from a Debian package] 562s /usr/lib/.DIR-aaa [Not from a Debian package] 562s /usr/lib/.ark? [Not from a Debian package] 562s /usr/lib/.1DIR [Not from a Debian package] 562s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 562s /usr/lib/.bbb [Not from a Debian package] 562s /usr/lib/...DIR [Not from a Debian package] 562s /usr/lib/.aaa [Not from a Debian package] 562s /usr/lib/.1 [Not from a Debian package] 562s 562s WARNING: Possible LPD worm installed (based on files found) 562s 562s WARNING: Possible Ramen Worm rootkit installed: 562s /usr/src/.poop/ [Not from a Debian package] 562s 562s WARNING: Possible Maniac rootkit installed: 562s /usr/bin/mailrc [Not from a Debian package] 562s 563s WARNING: Possible RK17 rootkit installed: 563s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 563s /usr/lib/number.cgi [Not from a Debian package] 563s 563s WARNING: Possible Ducoci rootkit installed: 563s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 563s 563s WARNING: Possible Adore Worm installed: 563s /usr/bin/red.tar [Not from a Debian package] 563s 563s WARNING: Possible ShitC Worm installed: 563s /usr/bin/frgy [Not from a Debian package] 563s /usr/bin/dy [Not from a Debian package] 563s 563s WARNING: Possible Omega Worm installed: 563s /dev/chr [Not from a Debian package] 563s 563s WARNING: Possible Sadmin/IIS Worm installed: 563s /dev/cuc [Not from a Debian package] 563s 563s WARNING: Possible MonKit installed: 563s /usr/lib/libpikapp.a [Not from a Debian package] 563s 563s WARNING: Possible Showtee rootkit installed: 563s /usr/include/proc.h [Not from a Debian package] 563s /usr/include/chk.h [Not from a Debian package] 563s 563s WARNING: Possible OpticKit installed: 563s /usr/bin/xsf [Not from a Debian package] 563s 563s WARNING: Possible T.R.K installed: 563s /usr/bin/xsf [Not from a Debian package] 563s 563s WARNING: Possible Mithra installed: 563s /usr/lib/locale/uboot [Not from a Debian package] 563s 564s WARNING: Possible LOC rootkit installed: 564s /tmp/xp [Not from a Debian package] 564s /usr/sbin/epic [Not from a Debian package] 564s WARNING: Possible Romanian rootkit installed: 564s /usr/include/proc.h [Not from a Debian package] 564s 564s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 564s 564s WARNING: Possible Suckit: 564s /dev/.golf/ 564s 564s WARNING: Possible Volc rootkit installed: 564s /usr/bin/volc [Not from a Debian package] 564s 564s WARNING: Possible Gold2 rootkit installed: 564s /usr/bin/ishit [Not from a Debian package] 564s 564s WARNING: Possible TC2 rootkit installed: 564s /usr/sbin/initcheck [Not from a Debian package] 564s 564s WARNING: Possible Anonoying rootkit installed: 564s /usr/sbin/mech [Not from a Debian package] 564s 564s WARNING: Possible ZK rootkit installed: 564s /etc/sysconfig/console/load.zk [Not from a Debian package] 564s 564s WARNING: Possible ShKit rootkit installed: 564s /etc/ld.so.hash [Not from a Debian package] 564s 564s WARNING: Possible AjaKit rootkit installed: 564s /dev/tux/ [Not from a Debian package] 564s 564s WARNING: Possible zaRwT rootkit installed: 564s /bin/imout [Not from a Debian package] 564s 564s WARNING: Possible Madalin rootkit installed: 564s /usr/include/icekey.h [Not from a Debian package] 564s 564s WARNING: Possible Fu rootkit installed: 564s /sbin/xc [Not from a Debian package] 564s 564s WARNING: Possible Kenga3 rootkit installed: 564s /usr/include/. ./ [Not from a Debian package] 564s /usr/include/. ./foo [Not from a Debian package] 564s 564s WARNING: Possible ESRK rootkit installed: 564s /usr/lib/tcl5.3/ [Not from a Debian package] 564s 565s WARNING: Possible rootedoor installed: 565s /usr/sbin/rootedoor [Not from a Debian package] 565s /sbin/rootedoor [Not from a Debian package] 565s /sbin/rootedoor [Not from a Debian package] 565s /usr/sbin/rootedoor [Not from a Debian package] 565s 565s WARNING: Possible ENYELKM rootkit installed: 565s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 565s 565s WARNING: Possible ssh-scanner installed: 565s /var/tmp/vuln.txt [Not from a Debian package] 565s 565s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 565s 565s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 565s WARNING: Possible 64-bit Linux Rootkit: 565s /usr/local/hide/ [Not from a Debian package] 565s /usr/local/hide/foo [Not from a Debian package] 565s /etc/rc.local [Not from a Debian package] 565s 565s WARNING: Possible 64-bit rootkit modules installed: 565s /lib/modules/module_init.ko [Not from a Debian package] 565s 565s WARNING: Possible Mumblehard backdoor installed: 565s /var/spool/cron/crontabs/foo [Not from a Debian package] 565s 565s WARNING: Possible Backdoor.Linux.Mokes.a installed: 565s /tmp/ss0-0 [Not from a Debian package] 565s 565s WARNING: Possible Malicious TinyDNS installed: 565s /home/ ./ [Not from a Debian package] 565s /home/ ./tinyDNS [Not from a Debian package] 565s 568s WARNING: Possible Linux.Xor.DDoS installed: 568s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 568s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 568s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 568s /tmp/clean/sed [Not from a Debian package] 568s /tmp/clean/ls [Not from a Debian package] 568s /tmp/clean/id [Not from a Debian package] 568s /tmp/clean/uname [Not from a Debian package] 568s /tmp/clean/awk [Not from a Debian package] 568s /tmp/clean/head [Not from a Debian package] 568s /tmp/clean/strings [Not from a Debian package] 568s /tmp/clean/cut [Not from a Debian package] 568s /tmp/clean/netstat [Not from a Debian package] 568s /tmp/clean/ls.orig [Not from a Debian package] 568s /tmp/clean/ss [Not from a Debian package] 568s /tmp/clean/find [Not from a Debian package] 568s /tmp/clean/ps [Not from a Debian package] 568s /tmp/clean/grep.orig [Not from a Debian package] 568s /tmp/clean/xargs [Not from a Debian package] 568s /tmp/clean/dpkg-query [Not from a Debian package] 568s /tmp/clean/dirname [Not from a Debian package] 568s /tmp/clean/echo [Not from a Debian package] 568s /tmp/clean/grep [Not from a Debian package] 568s 568s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 568s 568s WARNING: Possible Malicious CrossRAT installed: 568s /usr/var/mediamgrs.jar [Not from a Debian package] 568s 568s WARNING: Possible Malicious Hidden Cobra installed: 568s /tmp/.ICE-unix/engine.so [Not from a Debian package] 568s 568s WARNING: Possible Rocke Miner rootkit installed: 568s /etc/xig [Not from a Debian package] 568s 568s WARNING: Possible PWNLNX4 lkm rootkit installed: 568s /var/tmp/.1/ [Not from a Debian package] 568s 569s WARNING: Possible PWNLNX6 lkm rootkit installed: 569s /tmp/suterusu/ [Not from a Debian package] 569s 569s WARNING: Possible Malicious UMBREON LRK installed: 569s /usr/share/libc.so.69 [Not from a Debian package] 569s 569s WARNING: Possible Kinsing.a backdoor rootkit installed: 569s /tmp/kdevtmpfsi [Not from a Debian package] 569s 569s WARNING: Possible RotaJakiro backdoor rootkit installed: 569s /bin/systemd-daemon [Not from a Debian package] 569s 569s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 569s 569s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 569s 569s WARNING: Possible Tsunami DDoS Malware rootkit installed: 569s /bin/cls [Not from a Debian package] 569s 569s WARNING: Possible Linux BPFDoor Malware installed: 569s /proc/xx/stack 569s 570s WARNING: The following suspicious PHP files were found: 570s /tmp/name.php 570s /tmp/by-content 570s /tmp/sp ace/aaa' exit 1; " 570s 570s WARNING: Zero-size history files: 570s /root/.whatever.history [Not from a Debian package] 570s 570s WARNING: shell history files hardlinked to another file: 570s /root/.whatever.history [Not from a Debian package] 570s 570s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 570s 570s WARNING: Potential bindshell installed: infected ports: 600 31337 570s 582s INFECTED: /usr/bin/in.rexedcs 582s WARNING: Output from ifpromisc: 582s ens3: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[544]) 582s 582s WARNING: Possible 55808 Worm installed 582s 582s WARNING: Possible Scalper Worm installed 582s 582s WARNING: Possible Slapper Worm installed: 582s /tmp/.bugtraq.c [Not from a Debian package] 582s 582s **** Files in log 582s total 44K 582s drwxr-xr-x 2 root root 4.0K Nov 26 20:48 . 582s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 582s -rw-r--r-- 1 root root 0 Nov 26 20:48 chkrootkit-daily.log 582s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.expected 582s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 582s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 582s *** Test of content of output follows... 582s **** Test for '^Checking `amd'\.\.\. INFECTED$' 582s Checking `amd'... INFECTED 582s OK 582s **** Test for '^Checking `basename'\.\.\. INFECTED$' 582s Checking `basename'... INFECTED 582s OK 582s **** Test for '^Checking `biff'\.\.\. INFECTED$' 582s Checking `biff'... INFECTED 582s OK 582s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 582s Checking `chfn'... INFECTED 582s OK 582s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 582s Checking `chsh'... INFECTED 582s OK 582s **** Test for '^Checking `cron'\.\.\. INFECTED$' 582s Checking `cron'... INFECTED 582s OK 582s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 582s Checking for Lupper.Worm... INFECTED 582s OK 582s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 582s WARNING: crontab for nobody found, possible Lupper.Worm. 582s OK 582s **** Test for '^Checking `crontab'\.\.\. INFECTED$' 582s Checking `crontab'... INFECTED 582s OK 582s **** Test for '^Checking `date'\.\.\. INFECTED$' 582s Checking `date'... INFECTED 582s OK 582s **** Test for '^Checking `du'\.\.\. INFECTED$' 582s Checking `du'... INFECTED 582s OK 582s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 582s Checking `dirname'... INFECTED 582s OK 582s **** Test for '^Checking `echo'\.\.\. INFECTED$' 582s Checking `echo'... INFECTED 582s OK 582s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 582s Checking `egrep'... INFECTED 582s OK 582s **** Test for '^Checking `env'\.\.\. INFECTED$' 582s Checking `env'... INFECTED 582s OK 582s **** Test for '^Checking `find'\.\.\. INFECTED$' 582s Checking `find'... INFECTED 582s OK 582s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 582s Checking `fingerd'... INFECTED 582s OK 582s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 582s Checking `gpm'... INFECTED 582s OK 582s **** Test for '^Checking `grep'\.\.\. INFECTED$' 582s Checking `grep'... INFECTED 582s OK 582s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 582s Checking `hdparm'... INFECTED 582s OK 582s **** Test for '^Checking `su'\.\.\. INFECTED$' 582s Checking `su'... INFECTED 582s OK 582s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 582s Checking `ifconfig'... INFECTED 582s OK 582s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 582s Checking `inetd'... INFECTED 582s OK 582s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 582s Checking `inetdconf'... INFECTED 582s OK 582s **** Test for '^Checking `identd'\.\.\. INFECTED$' 582s Checking `identd'... INFECTED 582s OK 582s **** Test for '^Checking `init'\.\.\. INFECTED$' 582s Checking `init'... INFECTED 582s OK 582s **** Test for '^Checking `killall'\.\.\. INFECTED$' 582s Checking `killall'... INFECTED 582s OK 582s **** Test for '^Checking `login'\.\.\. INFECTED$' 582s Checking `login'... INFECTED 582s OK 582s **** Test for '^Checking `ls'\.\.\. INFECTED$' 582s Checking `ls'... INFECTED 582s OK 582s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 582s Checking `lsof'... INFECTED 582s OK 582s **** Test for '^Checking `mail'\.\.\. INFECTED$' 582s Checking `mail'... INFECTED 582s OK 582s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 582s Checking `mingetty'... INFECTED 582s OK 582s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 582s Checking `netstat'... INFECTED 582s OK 582s **** Test for '^Checking `named'\.\.\. INFECTED$' 582s Checking `named'... INFECTED 582s OK 582s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 582s Checking `passwd'... INFECTED 582s OK 582s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 582s Checking `pidof'... INFECTED 582s OK 582s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 582s Checking `pop2'... INFECTED 582s OK 582s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 582s Checking `pop3'... INFECTED 582s OK 582s **** Test for '^Checking `ps'\.\.\. INFECTED$' 582s Checking `ps'... INFECTED 582s OK 582s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 582s Checking `pstree'... INFECTED 582s OK 582s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 582s Checking `rpcinfo'... INFECTED 582s OK 582s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 582s Checking `rlogind'... INFECTED 582s OK 582s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 582s Checking `rshd'... INFECTED 582s OK 582s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 582s Checking `slogin'... INFECTED 582s OK 582s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 582s Checking `sendmail'... INFECTED 582s OK 582s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 582s Checking `syslogd'... INFECTED 582s OK 582s **** Test for '^Checking `tar'\.\.\. INFECTED$' 582s Checking `tar'... INFECTED 582s OK 582s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 582s Checking `tcpd'... INFECTED 582s OK 582s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 582s Checking `tcpdump'... INFECTED 582s OK 582s **** Test for '^Checking `top'\.\.\. INFECTED$' 582s Checking `top'... INFECTED 582s OK 582s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 582s Checking `telnetd'... INFECTED 582s OK 582s **** Test for '^Checking `timed'\.\.\. INFECTED$' 582s Checking `timed'... INFECTED 582s OK 582s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 582s Checking `traceroute'... INFECTED 582s OK 582s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 582s Checking `vdir'... INFECTED 582s OK 582s **** Test for '^Checking `w'\.\.\. INFECTED$' 582s Checking `w'... INFECTED 582s OK 582s **** Test for '^Checking `write'\.\.\. INFECTED$' 582s Checking `write'... INFECTED 582s OK 582s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 582s WARNING: The following suspicious files were found in /dev: 582s OK 582s **** Test for '^/dev/bad-file$' 582s /dev/bad-file 582s OK 582s **** Test for '^$' 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s 582s OK 582s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 582s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 582s OK 582s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 582s /var/run/.tmp/ [Not from a Debian package] 582s OK 582s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 582s /var/run/.tmp/y [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: The following known suspicious files were found:$' 582s WARNING: The following known suspicious files were found: 582s OK 582s **** Test for '^/usr/bin/atm \[Not from a Debian package\]$' 582s /usr/bin/atm [Not from a Debian package] 582s OK 582s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 582s /etc/ld.so.hash [Not from a Debian package] 582s /etc/ld.so.hash [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 582s WARNING: The following potential sniffer's logs were found: 582s OK 582s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 582s /tmp/tcp.log [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 582s WARNING: Possible HiDrootkit rootkit installed: 582s OK 582s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 582s /var/lib/games/.k/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 582s WARNING: Possible t0rn rootkit installed: 582s OK 582s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 582s /etc/ttyhash [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 582s WARNING: Possible t0rn v8 (or variation) rootkit installed: 582s OK 582s **** Test for '^/usr/local/lib/libproc\.a \[Not from a Debian package\]$' 582s /usr/local/lib/libproc.a [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Lion rootkit installed:$' 582s WARNING: Possible Lion rootkit installed: 582s OK 582s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 582s /bin/mjy [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 582s WARNING: Possible RSHA rootkit installed: 582s OK 582s **** Test for '^/usr/bin/n3tstat \[Not from a Debian package\]$' 582s /usr/bin/n3tstat [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 582s WARNING: Possible RH-Sharpe rootkit installed: 582s OK 582s **** Test for '^/bin/lps \[Not from a Debian package\]$' 582s /bin/lps [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 582s WARNING: Possible Ambient's rootkit (ark) installed: 582s OK 582s **** Test for '^/usr/lib/\.ark\? \[Not from a Debian package\]$' 582s /usr/lib/.ark? [Not from a Debian package] 582s /usr/lib/.ark? [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: The following suspicious files and directories were found:$' 582s WARNING: The following suspicious files and directories were found: 582s OK 582s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 582s /usr/lib/.1 [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 582s /usr/lib/.aaa [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 582s /usr/lib/.1DIR [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.ark\? \[Not from a Debian package\]$' 582s /usr/lib/.ark? [Not from a Debian package] 582s /usr/lib/.ark? [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 582s /usr/lib/...DIR [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 582s /usr/lib/.bbb [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 582s /usr/lib/.DIR-aaa [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 582s /usr/lib/... [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 582s WARNING: Possible LPD worm installed (based on files found) 582s OK 582s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 582s WARNING: Possible Ramen Worm rootkit installed: 582s OK 582s **** Test for '^/usr/src/\.poop/ \[Not from a Debian package\]$' 582s /usr/src/.poop/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 582s WARNING: Possible Maniac rootkit installed: 582s OK 582s **** Test for '^/usr/bin/mailrc \[Not from a Debian package\]$' 582s /usr/bin/mailrc [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 582s WARNING: Possible RK17 rootkit installed: 582s OK 582s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 582s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 582s OK 582s **** Test for '^/usr/lib/number\.cgi \[Not from a Debian package\]$' 582s /usr/lib/number.cgi [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 582s WARNING: Possible Ducoci rootkit installed: 582s OK 582s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 582s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Adore Worm installed:$' 582s WARNING: Possible Adore Worm installed: 582s OK 582s **** Test for '^/usr/bin/red\.tar \[Not from a Debian package\]$' 582s /usr/bin/red.tar [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ShitC Worm installed:$' 582s WARNING: Possible ShitC Worm installed: 582s OK 582s **** Test for '^(/usr)?/bin/dy \[Not from a Debian package\]$' 582s /usr/bin/dy [Not from a Debian package] 582s OK 582s **** Test for '^(/usr)?/bin/frgy \[Not from a Debian package\]$' 582s /usr/bin/frgy [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Omega Worm installed:$' 582s WARNING: Possible Omega Worm installed: 582s OK 582s **** Test for '^/dev/chr \[Not from a Debian package\]$' 582s /dev/chr [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 582s WARNING: Possible Sadmin/IIS Worm installed: 582s OK 582s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 582s /dev/cuc [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible MonKit installed:$' 582s WARNING: Possible MonKit installed: 582s OK 582s **** Test for '^/usr/lib/libpikapp\.a \[Not from a Debian package\]$' 582s /usr/lib/libpikapp.a [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 582s WARNING: Possible Showtee rootkit installed: 582s OK 582s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 582s /usr/include/proc.h [Not from a Debian package] 582s /usr/include/proc.h [Not from a Debian package] 582s OK 582s **** Test for '^/usr/include/chk\.h \[Not from a Debian package\]$' 582s /usr/include/chk.h [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible OpticKit installed:$' 582s WARNING: Possible OpticKit installed: 582s OK 582s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 582s /usr/bin/xsf [Not from a Debian package] 582s /usr/bin/xsf [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible T\.R\.K installed:$' 582s WARNING: Possible T.R.K installed: 582s OK 582s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 582s /usr/bin/xsf [Not from a Debian package] 582s /usr/bin/xsf [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Mithra installed:$' 582s WARNING: Possible Mithra installed: 582s OK 582s **** Test for '^/usr/lib/locale/uboot \[Not from a Debian package\]$' 582s /usr/lib/locale/uboot [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible LOC rootkit installed:$' 582s WARNING: Possible LOC rootkit installed: 582s OK 582s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 582s /tmp/xp [Not from a Debian package] 582s OK 582s **** Test for '^/usr/sbin/epic \[Not from a Debian package\]$' 582s /usr/sbin/epic [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 582s WARNING: Possible Romanian rootkit installed: 582s OK 582s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 582s /usr/include/proc.h [Not from a Debian package] 582s /usr/include/proc.h [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc\.d/init\.d/network \[Not from a Debian package\]$' 582s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Suckit:$' 582s WARNING: Possible Suckit: 582s OK 582s **** Test for '^/dev/\.golf/$' 582s /dev/.golf/ 582s OK 582s **** Test for '^WARNING: Possible Volc rootkit installed:$' 582s WARNING: Possible Volc rootkit installed: 582s OK 582s **** Test for '^/usr/bin/volc \[Not from a Debian package\]$' 582s /usr/bin/volc [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 582s WARNING: Possible Gold2 rootkit installed: 582s OK 582s **** Test for '^/usr/bin/ishit \[Not from a Debian package\]$' 582s /usr/bin/ishit [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 582s WARNING: Possible TC2 rootkit installed: 582s OK 582s **** Test for '^/usr/sbin/initcheck \[Not from a Debian package\]$' 582s /usr/sbin/initcheck [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 582s WARNING: Possible Anonoying rootkit installed: 582s OK 582s **** Test for '^/usr/sbin/mech \[Not from a Debian package\]$' 582s /usr/sbin/mech [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ZK rootkit installed:$' 582s WARNING: Possible ZK rootkit installed: 582s OK 582s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 582s /etc/sysconfig/console/load.zk [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 582s WARNING: Possible ShKit rootkit installed: 582s OK 582s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 582s /etc/ld.so.hash [Not from a Debian package] 582s /etc/ld.so.hash [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 582s WARNING: Possible AjaKit rootkit installed: 582s OK 582s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 582s /dev/tux/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 582s WARNING: Possible zaRwT rootkit installed: 582s OK 582s **** Test for '^/bin/imout \[Not from a Debian package\]$' 582s /bin/imout [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 582s WARNING: Possible Madalin rootkit installed: 582s OK 582s **** Test for '^/usr/include/icekey\.h \[Not from a Debian package\]$' 582s /usr/include/icekey.h [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Fu rootkit installed:$' 582s WARNING: Possible Fu rootkit installed: 582s OK 582s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 582s /sbin/xc [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 582s WARNING: Possible Kenga3 rootkit installed: 582s OK 582s **** Test for '^/usr/include/\. \./ \[Not from a Debian package\]$' 582s /usr/include/. ./ [Not from a Debian package] 582s OK 582s **** Test for '^/usr/include/\. \./foo \[Not from a Debian package\]$' 582s /usr/include/. ./foo [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 582s WARNING: Possible ESRK rootkit installed: 582s OK 582s **** Test for '^/usr/lib/tcl5\.3/ \[Not from a Debian package\]$' 582s /usr/lib/tcl5.3/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible rootedoor installed:$' 582s WARNING: Possible rootedoor installed: 582s OK 582s **** Test for '^/usr/sbin/rootedoor \[Not from a Debian package\]$' 582s /usr/sbin/rootedoor [Not from a Debian package] 582s /usr/sbin/rootedoor [Not from a Debian package] 582s OK 582s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 582s /sbin/rootedoor [Not from a Debian package] 582s /sbin/rootedoor [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 582s WARNING: Possible ENYELKM rootkit installed: 582s OK 582s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 582s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible ssh-scanner installed:$' 582s WARNING: Possible ssh-scanner installed: 582s OK 582s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 582s /var/tmp/vuln.txt [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 582s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 582s OK 582s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 582s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 582s OK 582s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 582s WARNING: Possible 64-bit Linux Rootkit: 582s OK 582s **** Test for '^/usr/local/hide/ \[Not from a Debian package\]$' 582s /usr/local/hide/ [Not from a Debian package] 582s OK 582s **** Test for '^/usr/local/hide/foo \[Not from a Debian package\]$' 582s /usr/local/hide/foo [Not from a Debian package] 582s OK 582s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 582s /etc/rc.local [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 582s WARNING: Possible 64-bit rootkit modules installed: 582s OK 582s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 582s /lib/modules/module_init.ko [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 582s WARNING: Possible Mumblehard backdoor installed: 582s OK 582s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 582s /var/spool/cron/crontabs/foo [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 582s WARNING: Possible Backdoor.Linux.Mokes.a installed: 582s OK 582s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 582s /tmp/ss0-0 [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 582s WARNING: Possible Malicious TinyDNS installed: 582s OK 582s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 582s /home/ ./ [Not from a Debian package] 582s OK 582s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 582s /home/ ./tinyDNS [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 582s WARNING: Possible Linux.Xor.DDoS installed: 582s OK 582s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 582s /tmp/clean/strings [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 582s /tmp/clean/uname [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 582s /tmp/clean/head [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 582s /tmp/clean/find [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 582s /tmp/clean/echo [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 582s /tmp/clean/netstat [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 582s /tmp/clean/ls [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 582s /tmp/clean/ls.orig [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 582s /tmp/clean/ps [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 582s /tmp/clean/awk [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 582s /tmp/clean/grep [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 582s /tmp/clean/grep.orig [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 582s /tmp/clean/dirname [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 582s /tmp/clean/ss [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 582s /tmp/clean/sed [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 582s /tmp/clean/cut [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 582s /tmp/clean/id [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 582s /tmp/clean/xargs [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 582s /tmp/clean/dpkg-query [Not from a Debian package] 582s OK 582s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 582s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 582s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 582s OK 582s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 582s WARNING: Possible Malicious CrossRAT installed: 582s OK 582s **** Test for '^/usr/var/mediamgrs\.jar \[Not from a Debian package\]$' 582s /usr/var/mediamgrs.jar [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 582s WARNING: Possible Malicious Hidden Cobra installed: 582s OK 582s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 582s /tmp/.ICE-unix/engine.so [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 582s WARNING: Possible Rocke Miner rootkit installed: 582s OK 582s **** Test for '^/etc/xig \[Not from a Debian package\]$' 582s /etc/xig [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 582s WARNING: Possible PWNLNX4 lkm rootkit installed: 582s OK 582s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 582s /var/tmp/.1/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 582s WARNING: Possible PWNLNX6 lkm rootkit installed: 582s OK 582s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 582s /tmp/suterusu/ [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 582s WARNING: Possible Malicious UMBREON LRK installed: 582s OK 582s **** Test for '^/usr/share/libc\.so\.69 \[Not from a Debian package\]$' 582s /usr/share/libc.so.69 [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 582s WARNING: Possible Kinsing.a backdoor rootkit installed: 582s OK 582s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 582s /tmp/kdevtmpfsi [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 582s WARNING: Possible RotaJakiro backdoor rootkit installed: 582s OK 582s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 582s /bin/systemd-daemon [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 582s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 582s OK 582s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 582s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 582s OK 582s **** Test for 'WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 582s WARNING: Possible Tsunami DDoS Malware rootkit installed: 582s OK 582s **** Test for '^/bin/cls \[Not from a Debian package\]$' 582s /bin/cls [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 582s WARNING: Possible Linux BPFDoor Malware installed: 582s OK 582s **** Test for '^/proc/xx/stack$' 582s /proc/xx/stack 582s OK 582s **** Test for '^WARNING: The following suspicious PHP files were found:$' 582s WARNING: The following suspicious PHP files were found: 582s OK 582s **** Test for '^/tmp/name\.php$' 582s /tmp/name.php 582s OK 582s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 582s /tmp/sp ace/aaa' exit 1; " 582s OK 582s **** Test for '^/tmp/by-content$' 582s /tmp/by-content 582s OK 582s **** Test for '^WARNING: Zero-size history files:$' 582s WARNING: Zero-size history files: 582s OK 582s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 582s /root/.whatever.history [Not from a Debian package] 582s /root/.whatever.history [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: shell history files hardlinked to another file:$' 582s WARNING: shell history files hardlinked to another file: 582s OK 582s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 582s /root/.whatever.history [Not from a Debian package] 582s /root/.whatever.history [Not from a Debian package] 582s OK 582s **** Test for '^WARNING: Possible Ramen Worm installed in /etc/inetd\.conf$' 582s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 582s OK 582s **** Test for '^WARNING: Potential bindshell installed: infected ports: 600 31337$' 582s WARNING: Potential bindshell installed: infected ports: 600 31337 582s OK 582s **** Test for '^INFECTED: /usr/bin/in\.rexedcs$' 582s INFECTED: /usr/bin/in.rexedcs 582s OK 582s **** Test for '^WARNING: Output from ifpromisc:$' 582s WARNING: Output from ifpromisc: 582s OK 582s **** Test for '^WARNING: Possible 55808 Worm installed$' 582s WARNING: Possible 55808 Worm installed 582s OK 582s **** Test for '^WARNING: Possible Scalper Worm installed$' 582s WARNING: Possible Scalper Worm installed 582s OK 582s **** Test for '^WARNING: Possible Slapper Worm installed:$' 582s WARNING: Possible Slapper Worm installed: 582s OK 582s **** Test for '^/tmp/\.bugtraq\.c \[Not from a Debian package\]$' 582s /tmp/.bugtraq.c [Not from a Debian package] 582s OK 582s ** PASS: Testing: all-tests-can-find-something-02-quiet (chkrootkit -p /tmp/clean -q) done: PASS 582s *** Unexpected (unmatched) lines follow (for info): 582s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 582s ** Testing: exclude-results-with-minus-e-option (chkrootkit -p /tmp/clean -e /usr/* aliens) ... 582s *** Output 582s ROOTDIR is `/' 582s Checking `aliens'... started 582s Searching for suspicious files in /dev... WARNING 582s 582s WARNING: The following suspicious files were found in /dev: 582s /dev/bad-file 582s 582s Searching for known suspicious directories... WARNING 582s 582s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 582s /var/run/.tmp/ [Not from a Debian package] 582s /var/run/.tmp/y [Not from a Debian package] 582s 582s Searching for known suspicious files... WARNING 582s 582s WARNING: The following known suspicious files were found: 582s /etc/ld.so.hash [Not from a Debian package] 582s 582s Searching for sniffer's logs... WARNING 582s 582s WARNING: The following potential sniffer's logs were found: 582s /tmp/tcp.log [Not from a Debian package] 582s 583s Searching for HiDrootkit rootkit... WARNING 583s 583s WARNING: Possible HiDrootkit rootkit installed: 583s /var/lib/games/.k/ [Not from a Debian package] 583s 583s Searching for t0rn rootkit... WARNING 583s 583s WARNING: Possible t0rn rootkit installed: 583s /etc/ttyhash [Not from a Debian package] 583s 583s Searching for t0rn v8 (or variation)... not found 583s Searching for Lion rootkit... WARNING 583s 583s WARNING: Possible Lion rootkit installed: 583s /bin/mjy [Not from a Debian package] 583s 583s Searching for RSHA rootkit... not found 583s Searching for RH-Sharpe rootkit... WARNING 583s 583s WARNING: Possible RH-Sharpe rootkit installed: 583s /bin/lps [Not from a Debian package] 583s 583s Searching for Ambient (ark) rootkit... not found 583s Searching for suspicious files and dirs... not found 583s Searching for LPD Worm... WARNING 583s 583s WARNING: Possible LPD worm installed (based on files found) 583s 583s Searching for Ramen Worm rootkit... not found 583s Searching for Maniac rootkit... not found 583s Searching for RK17 rootkit... WARNING 583s 583s WARNING: Possible RK17 rootkit installed: 583s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 583s 583s Searching for Ducoci rootkit... WARNING 583s 583s WARNING: Possible Ducoci rootkit installed: 583s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 583s 583s Searching for Adore Worm... not found 583s Searching for ShitC Worm... not found 583s Searching for Omega Worm... WARNING 583s 583s WARNING: Possible Omega Worm installed: 583s /dev/chr [Not from a Debian package] 583s 583s Searching for Sadmind/IIS Worm... WARNING 583s 583s WARNING: Possible Sadmin/IIS Worm installed: 583s /dev/cuc [Not from a Debian package] 583s 583s Searching for MonKit... not found 583s Searching for Showtee rootkit... not found 583s Searching for OpticKit... not found 583s Searching for T.R.K... not found 583s Searching for Mithra rootkit... not found 583s Searching for OBSD rootkit v1... not tested 583s Searching for LOC rootkit... WARNING 583s 583s WARNING: Possible LOC rootkit installed: 583s /tmp/xp [Not from a Debian package] 583s Searching for Romanian rootkit... not found 583s Searching for HKRK rootkit... WARNING 583s 583s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 583s 583s Searching for Suckit rootkit... WARNING 583s 583s WARNING: Possible Suckit: 583s /dev/.golf/ 583s 583s Searching for Volc rootkit... not found 583s Searching for Gold2 rootkit... not found 583s Searching for TC2 rootkit... not found 583s Searching for Anonoying rootkit... not found 583s Searching for ZK rootkit... WARNING 583s 583s WARNING: Possible ZK rootkit installed: 583s /etc/sysconfig/console/load.zk [Not from a Debian package] 583s 583s Searching for ShKit rootkit... WARNING 583s 583s WARNING: Possible ShKit rootkit installed: 583s /etc/ld.so.hash [Not from a Debian package] 583s 583s Searching for AjaKit rootkit... WARNING 583s 583s WARNING: Possible AjaKit rootkit installed: 583s /dev/tux/ [Not from a Debian package] 583s 583s Searching for zaRwT rootkit... WARNING 583s 583s WARNING: Possible zaRwT rootkit installed: 583s /bin/imout [Not from a Debian package] 583s 583s Searching for Madalin rootkit... not found 583s Searching for Fu rootkit... WARNING 583s 583s WARNING: Possible Fu rootkit installed: 583s /sbin/xc [Not from a Debian package] 583s 583s Searching for Kenga3 rootkit... not found 583s Searching for ESRK rootkit... not found 584s Searching for rootedoor... WARNING 584s 584s WARNING: Possible rootedoor installed: 584s /sbin/rootedoor [Not from a Debian package] 584s /sbin/rootedoor [Not from a Debian package] 584s 584s Searching for ENYELKM rootkit... WARNING 584s 584s WARNING: Possible ENYELKM rootkit installed: 584s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 584s 584s Searching for common ssh-scanners... WARNING 584s 584s WARNING: Possible ssh-scanner installed: 584s /var/tmp/vuln.txt [Not from a Debian package] 584s 584s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 584s 584s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 584s 584s Searching for Linux/Ebury 1.6... WARNING 584s 584s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 584s Searching for 64-bit Linux Rootkit... WARNING 584s 584s WARNING: Possible 64-bit Linux Rootkit: 584s /etc/rc.local [Not from a Debian package] 584s 584s Searching for 64-bit Linux Rootkit modules... WARNING 584s 584s WARNING: Possible 64-bit rootkit modules installed: 584s /lib/modules/module_init.ko [Not from a Debian package] 584s 584s Searching for Mumblehard... WARNING 584s 584s WARNING: Possible Mumblehard backdoor installed: 584s /var/spool/cron/crontabs/foo [Not from a Debian package] 584s 584s Searching for Backdoor.Linux.Mokes.a... WARNING 584s 584s WARNING: Possible Backdoor.Linux.Mokes.a installed: 584s /tmp/ss0-0 [Not from a Debian package] 584s 584s Searching for Malicious TinyDNS... WARNING 584s 584s WARNING: Possible Malicious TinyDNS installed: 584s /home/ ./ [Not from a Debian package] 584s /home/ ./tinyDNS [Not from a Debian package] 584s 587s Searching for Linux.Xor.DDoS... WARNING 587s 587s WARNING: Possible Linux.Xor.DDoS installed: 587s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/build.TMx/src/check_php [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/autopkgtest-reboot [Not from a Debian package] 587s /tmp/autopkgtest.fRYZGo/wrapper.sh [Not from a Debian package] 587s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 587s /tmp/clean/sed [Not from a Debian package] 587s /tmp/clean/ls [Not from a Debian package] 587s /tmp/clean/id [Not from a Debian package] 587s /tmp/clean/uname [Not from a Debian package] 587s /tmp/clean/awk [Not from a Debian package] 587s /tmp/clean/head [Not from a Debian package] 587s /tmp/clean/strings [Not from a Debian package] 587s /tmp/clean/cut [Not from a Debian package] 587s /tmp/clean/netstat [Not from a Debian package] 587s /tmp/clean/ls.orig [Not from a Debian package] 587s /tmp/clean/ss [Not from a Debian package] 587s /tmp/clean/find [Not from a Debian package] 587s /tmp/clean/ps [Not from a Debian package] 587s /tmp/clean/grep.orig [Not from a Debian package] 587s /tmp/clean/xargs [Not from a Debian package] 587s /tmp/clean/dpkg-query [Not from a Debian package] 587s /tmp/clean/dirname [Not from a Debian package] 587s /tmp/clean/echo [Not from a Debian package] 587s /tmp/clean/grep [Not from a Debian package] 587s 587s Searching for Linux.Proxy.1.0... WARNING 587s 587s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 587s 587s Searching for CrossRAT... not found 587s Searching for Hidden Cobra... WARNING 587s 587s WARNING: Possible Malicious Hidden Cobra installed: 587s /tmp/.ICE-unix/engine.so [Not from a Debian package] 587s 587s Searching for Rocke Miner rootkit... WARNING 587s 587s WARNING: Possible Rocke Miner rootkit installed: 587s /etc/xig [Not from a Debian package] 587s 587s Searching for PWNLNX4 lkm rootkit... WARNING 587s 587s WARNING: Possible PWNLNX4 lkm rootkit installed: 587s /var/tmp/.1/ [Not from a Debian package] 587s 588s Searching for PWNLNX6 lkm rootkit... WARNING 588s 588s WARNING: Possible PWNLNX6 lkm rootkit installed: 588s /tmp/suterusu/ [Not from a Debian package] 588s 588s Searching for Umbreon lrk... not found 588s Searching for Kinsing.a backdoor rootkit... WARNING 588s 588s WARNING: Possible Kinsing.a backdoor rootkit installed: 588s /tmp/kdevtmpfsi [Not from a Debian package] 588s 588s Searching for RotaJakiro backdoor rootkit... WARNING 588s 588s WARNING: Possible RotaJakiro backdoor rootkit installed: 588s /bin/systemd-daemon [Not from a Debian package] 588s 588s Searching for Syslogk LKM rootkit... WARNING 588s 588s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 588s 588s Searching for Kovid LKM rootkit... WARNING 588s 588s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 588s 588s Searching for Tsunami DDoS Malware rootkit... WARNING 588s 588s WARNING: Possible Tsunami DDoS Malware rootkit installed: 588s /bin/cls [Not from a Debian package] 588s 588s Searching for Linux BPF Door... WARNING 588s 588s WARNING: Possible Linux BPFDoor Malware installed: 588s /proc/xx/stack 588s 589s Searching for suspect PHP files... WARNING 589s 589s WARNING: The following suspicious PHP files were found: 589s /tmp/name.php 589s /tmp/by-content 589s /tmp/sp ace/aaa' exit 1; " 589s 589s Searching for zero-size shell history files in /root... WARNING 589s 589s WARNING: Zero-size history files: 589s /root/.whatever.history [Not from a Debian package] 589s 589s Searching for hardlinked shell history files in /root... WARNING 589s 589s WARNING: shell history files hardlinked to another file: 589s /root/.whatever.history [Not from a Debian package] 589s 589s Checking `aliens'... finished 589s **** Files in log 589s total 44K 589s drwxr-xr-x 2 root root 4.0K Nov 26 20:48 . 589s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 589s -rw-r--r-- 1 root root 0 Nov 26 20:48 chkrootkit-daily.log 589s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.expected 589s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 589s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 589s *** Test of content of output follows... 589s **** Test for '^ROOTDIR is `/'$' 589s ROOTDIR is `/' 589s OK 589s **** Test for '^Checking `aliens'\.\.\. started$' 589s Checking `aliens'... started 589s OK 589s **** Test for '^Searching for suspicious files in /dev\.\.\. WARNING$' 589s Searching for suspicious files in /dev... WARNING 589s OK 589s **** Test for '^$' 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s 589s OK 589s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 589s WARNING: The following suspicious files were found in /dev: 589s OK 589s **** Test for '^/dev/bad-file$' 589s /dev/bad-file 589s OK 589s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 589s Searching for known suspicious directories... WARNING 589s OK 589s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 589s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 589s OK 589s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 589s /var/run/.tmp/ [Not from a Debian package] 589s OK 589s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 589s /var/run/.tmp/y [Not from a Debian package] 589s OK 589s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 589s Searching for known suspicious files... WARNING 589s OK 589s **** Test for '^WARNING: The following known suspicious files were found:$' 589s WARNING: The following known suspicious files were found: 589s OK 589s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 589s /etc/ld.so.hash [Not from a Debian package] 589s /etc/ld.so.hash [Not from a Debian package] 589s OK 589s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 589s Searching for sniffer's logs... WARNING 589s OK 589s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 589s WARNING: The following potential sniffer's logs were found: 589s OK 589s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 589s /tmp/tcp.log [Not from a Debian package] 589s OK 589s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 589s Searching for HiDrootkit rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 589s WARNING: Possible HiDrootkit rootkit installed: 589s OK 589s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 589s /var/lib/games/.k/ [Not from a Debian package] 589s OK 589s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 589s Searching for t0rn rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 589s WARNING: Possible t0rn rootkit installed: 589s OK 589s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 589s /etc/ttyhash [Not from a Debian package] 589s OK 589s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 589s Searching for t0rn v8 (or variation)... not found 589s OK 589s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 589s Searching for Lion rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Lion rootkit installed:$' 589s WARNING: Possible Lion rootkit installed: 589s OK 589s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 589s /bin/mjy [Not from a Debian package] 589s OK 589s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 589s Searching for RSHA rootkit... not found 589s OK 589s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 589s Searching for RH-Sharpe rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 589s WARNING: Possible RH-Sharpe rootkit installed: 589s OK 589s **** Test for '^/bin/lps \[Not from a Debian package\]$' 589s /bin/lps [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 589s Searching for Ambient (ark) rootkit... not found 589s OK 589s **** Test for '^Searching for suspicious files and dirs\.\.\. not found$' 589s Searching for suspicious files and dirs... not found 589s OK 589s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 589s Searching for LPD Worm... WARNING 589s OK 589s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 589s WARNING: Possible LPD worm installed (based on files found) 589s OK 589s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 589s Searching for Ramen Worm rootkit... not found 589s OK 589s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 589s Searching for Maniac rootkit... not found 589s OK 589s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 589s Searching for RK17 rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 589s WARNING: Possible RK17 rootkit installed: 589s OK 589s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 589s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 589s Searching for Ducoci rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 589s WARNING: Possible Ducoci rootkit installed: 589s OK 589s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 589s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Adore Worm\.\.\. not found$' 589s Searching for Adore Worm... not found 589s OK 589s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 589s Searching for ShitC Worm... not found 589s OK 589s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 589s Searching for Omega Worm... WARNING 589s OK 589s **** Test for '^WARNING: Possible Omega Worm installed:$' 589s WARNING: Possible Omega Worm installed: 589s OK 589s **** Test for '^/dev/chr \[Not from a Debian package\]$' 589s /dev/chr [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 589s Searching for Sadmind/IIS Worm... WARNING 589s OK 589s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 589s WARNING: Possible Sadmin/IIS Worm installed: 589s OK 589s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 589s /dev/cuc [Not from a Debian package] 589s OK 589s **** Test for '^Searching for MonKit\.\.\. not found$' 589s Searching for MonKit... not found 589s OK 589s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 589s Searching for Showtee rootkit... not found 589s OK 589s **** Test for '^Searching for OpticKit\.\.\. not found$' 589s Searching for OpticKit... not found 589s OK 589s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 589s Searching for T.R.K... not found 589s OK 589s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 589s Searching for Mithra rootkit... not found 589s OK 589s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 589s Searching for OBSD rootkit v1... not tested 589s OK 589s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 589s Searching for LOC rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible LOC rootkit installed:$' 589s WARNING: Possible LOC rootkit installed: 589s OK 589s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 589s /tmp/xp [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 589s Searching for Romanian rootkit... not found 589s OK 589s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 589s Searching for HKRK rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc\.d/init\.d/network \[Not from a Debian package\]$' 589s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 589s Searching for Suckit rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Suckit:$' 589s WARNING: Possible Suckit: 589s OK 589s **** Test for '^/dev/\.golf/$' 589s /dev/.golf/ 589s OK 589s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 589s Searching for Volc rootkit... not found 589s OK 589s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 589s Searching for Gold2 rootkit... not found 589s OK 589s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 589s Searching for TC2 rootkit... not found 589s OK 589s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 589s Searching for Anonoying rootkit... not found 589s OK 589s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 589s Searching for ZK rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible ZK rootkit installed:$' 589s WARNING: Possible ZK rootkit installed: 589s OK 589s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 589s /etc/sysconfig/console/load.zk [Not from a Debian package] 589s OK 589s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 589s Searching for ShKit rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 589s WARNING: Possible ShKit rootkit installed: 589s OK 589s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 589s /etc/ld.so.hash [Not from a Debian package] 589s /etc/ld.so.hash [Not from a Debian package] 589s OK 589s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 589s Searching for AjaKit rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 589s WARNING: Possible AjaKit rootkit installed: 589s OK 589s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 589s /dev/tux/ [Not from a Debian package] 589s OK 589s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 589s Searching for zaRwT rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 589s WARNING: Possible zaRwT rootkit installed: 589s OK 589s **** Test for '^/bin/imout \[Not from a Debian package\]$' 589s /bin/imout [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 589s Searching for Madalin rootkit... not found 589s OK 589s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 589s Searching for Fu rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Fu rootkit installed:$' 589s WARNING: Possible Fu rootkit installed: 589s OK 589s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 589s /sbin/xc [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 589s Searching for Kenga3 rootkit... not found 589s OK 589s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 589s Searching for ESRK rootkit... not found 589s OK 589s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 589s Searching for rootedoor... WARNING 589s OK 589s **** Test for '^WARNING: Possible rootedoor installed:$' 589s WARNING: Possible rootedoor installed: 589s OK 589s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 589s /sbin/rootedoor [Not from a Debian package] 589s /sbin/rootedoor [Not from a Debian package] 589s OK 589s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 589s Searching for ENYELKM rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 589s WARNING: Possible ENYELKM rootkit installed: 589s OK 589s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 589s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 589s OK 589s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 589s Searching for common ssh-scanners... WARNING 589s OK 589s **** Test for '^WARNING: Possible ssh-scanner installed:$' 589s WARNING: Possible ssh-scanner installed: 589s OK 589s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 589s /var/tmp/vuln.txt [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 589s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 589s OK 589s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 589s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 589s OK 589s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 589s Searching for Linux/Ebury 1.6... WARNING 589s OK 589s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 589s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [From Debian package: libkeyutils1:amd64] 589s OK 589s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 589s Searching for 64-bit Linux Rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 589s WARNING: Possible 64-bit Linux Rootkit: 589s OK 589s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 589s /etc/rc.local [Not from a Debian package] 589s OK 589s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 589s Searching for 64-bit Linux Rootkit modules... WARNING 589s OK 589s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 589s WARNING: Possible 64-bit rootkit modules installed: 589s OK 589s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 589s /lib/modules/module_init.ko [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 589s Searching for Mumblehard... WARNING 589s OK 589s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 589s WARNING: Possible Mumblehard backdoor installed: 589s OK 589s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 589s /var/spool/cron/crontabs/foo [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 589s Searching for Backdoor.Linux.Mokes.a... WARNING 589s OK 589s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 589s WARNING: Possible Backdoor.Linux.Mokes.a installed: 589s OK 589s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 589s /tmp/ss0-0 [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 589s Searching for Malicious TinyDNS... WARNING 589s OK 589s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 589s WARNING: Possible Malicious TinyDNS installed: 589s OK 589s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 589s /home/ ./ [Not from a Debian package] 589s OK 589s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 589s /home/ ./tinyDNS [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 589s Searching for Linux.Xor.DDoS... WARNING 589s OK 589s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 589s WARNING: Possible Linux.Xor.DDoS installed: 589s OK 589s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 589s /tmp/clean/strings [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 589s /tmp/clean/uname [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 589s /tmp/clean/head [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 589s /tmp/clean/find [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 589s /tmp/clean/echo [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 589s /tmp/clean/netstat [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 589s /tmp/clean/ls [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 589s /tmp/clean/ls.orig [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 589s /tmp/clean/ps [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 589s /tmp/clean/awk [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 589s /tmp/clean/grep [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 589s /tmp/clean/grep.orig [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 589s /tmp/clean/dirname [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 589s /tmp/clean/ss [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 589s /tmp/clean/sed [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 589s /tmp/clean/cut [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 589s /tmp/clean/id [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 589s /tmp/clean/xargs [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 589s /tmp/clean/dpkg-query [Not from a Debian package] 589s OK 589s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 589s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 589s Searching for Linux.Proxy.1.0... WARNING 589s OK 589s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 589s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 589s OK 589s **** Test for '^Searching for CrossRAT\.\.\. not found$' 589s Searching for CrossRAT... not found 589s OK 589s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 589s Searching for Hidden Cobra... WARNING 589s OK 589s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 589s WARNING: Possible Malicious Hidden Cobra installed: 589s OK 589s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 589s /tmp/.ICE-unix/engine.so [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 589s Searching for Rocke Miner rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 589s WARNING: Possible Rocke Miner rootkit installed: 589s OK 589s **** Test for '^/etc/xig \[Not from a Debian package\]$' 589s /etc/xig [Not from a Debian package] 589s OK 589s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 589s Searching for PWNLNX4 lkm rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 589s WARNING: Possible PWNLNX4 lkm rootkit installed: 589s OK 589s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 589s /var/tmp/.1/ [Not from a Debian package] 589s OK 589s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 589s Searching for PWNLNX6 lkm rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 589s WARNING: Possible PWNLNX6 lkm rootkit installed: 589s OK 589s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 589s /tmp/suterusu/ [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 589s Searching for Umbreon lrk... not found 589s OK 589s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 589s Searching for Kinsing.a backdoor rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 589s WARNING: Possible Kinsing.a backdoor rootkit installed: 589s OK 589s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 589s /tmp/kdevtmpfsi [Not from a Debian package] 589s OK 589s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 589s Searching for RotaJakiro backdoor rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 589s WARNING: Possible RotaJakiro backdoor rootkit installed: 589s OK 589s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 589s /bin/systemd-daemon [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. WARNING$' 589s Searching for Syslogk LKM rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 589s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 589s OK 589s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 589s Searching for Kovid LKM rootkit... WARNING 589s OK 589s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 589s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 589s OK 589s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 589s Searching for Tsunami DDoS Malware rootkit... WARNING 589s OK 589s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 589s WARNING: Possible Tsunami DDoS Malware rootkit installed: 589s OK 589s **** Test for '^/bin/cls \[Not from a Debian package\]$' 589s /bin/cls [Not from a Debian package] 589s OK 589s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 589s Searching for Linux BPF Door... WARNING 589s OK 589s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 589s WARNING: Possible Linux BPFDoor Malware installed: 589s OK 589s **** Test for '^/proc/xx/stack$' 589s /proc/xx/stack 589s OK 589s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 589s Searching for suspect PHP files... WARNING 589s OK 589s **** Test for '^WARNING: The following suspicious PHP files were found:$' 589s WARNING: The following suspicious PHP files were found: 589s OK 589s **** Test for '^/tmp/name\.php$' 589s /tmp/name.php 589s OK 589s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 589s /tmp/sp ace/aaa' exit 1; " 589s OK 589s **** Test for '^/tmp/by-content$' 589s /tmp/by-content 589s OK 589s **** Test for '^Searching for zero-size shell history files in /root\.\.\. WARNING$' 589s Searching for zero-size shell history files in /root... WARNING 589s OK 589s **** Test for '^WARNING: Zero-size history files:$' 589s WARNING: Zero-size history files: 589s OK 589s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 589s /root/.whatever.history [Not from a Debian package] 589s /root/.whatever.history [Not from a Debian package] 589s OK 589s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. WARNING$' 589s Searching for hardlinked shell history files in /root... WARNING 589s OK 589s **** Test for '^WARNING: shell history files hardlinked to another file:$' 589s WARNING: shell history files hardlinked to another file: 589s OK 589s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 589s /root/.whatever.history [Not from a Debian package] 589s /root/.whatever.history [Not from a Debian package] 589s OK 589s **** Test for '^Checking `aliens'\.\.\. finished$' 589s Checking `aliens'... finished 589s OK 589s ** PASS: Testing: exclude-results-with-minus-e-option (chkrootkit -p /tmp/clean -e /usr/* aliens) done: PASS 589s * Testing the -r option 589s Symlink ROOT_DIR created: /tmp/CHKROOTKIT_ROOT 589s lrwxrwxrwx 1 root root 1 Nov 26 20:49 /tmp/CHKROOTKIT_ROOT -> / 589s ** Testing: setting-rootdir (chkrootkit -p /tmp/clean -r /tmp/CHKROOTKIT_ROOT) ... 589s *** Output 589s ROOTDIR is `/tmp/CHKROOTKIT_ROOT/' 589s Checking `amd'... INFECTED 589s Checking `basename'... INFECTED 589s Checking `biff'... INFECTED 589s Checking `chfn'... INFECTED 589s Checking `chsh'... INFECTED 589s Checking `cron'... INFECTED 589s Checking `crontab'... WARNING 589s WARNING: crontab for nobody found, possible Lupper.Worm. 589s Checking for Lupper.Worm... INFECTED 589s Checking `date'... INFECTED 589s Checking `du'... INFECTED 589s Checking `dirname'... INFECTED 589s Checking `echo'... INFECTED 589s Checking `egrep'... INFECTED 589s Checking `env'... INFECTED 589s Checking `find'... INFECTED 589s Checking `fingerd'... INFECTED 589s Checking `gpm'... INFECTED 589s Checking `grep'... INFECTED 589s Checking `hdparm'... INFECTED 589s Checking `su'... INFECTED 589s Checking `ifconfig'... INFECTED 589s Checking `inetd'... INFECTED 589s Checking `inetdconf'... INFECTED 589s Checking `identd'... INFECTED 589s Checking `init'... INFECTED 589s Checking `killall'... INFECTED 589s Checking `ldsopreload'... not infected 589s Checking `login'... INFECTED 589s Checking `ls'... INFECTED 589s Checking `lsof'... INFECTED 589s Checking `mail'... INFECTED 589s Checking `mingetty'... INFECTED 589s Checking `netstat'... INFECTED 589s Checking `named'... INFECTED 589s Checking `passwd'... INFECTED 589s Checking `pidof'... INFECTED 589s Checking `pop2'... INFECTED 589s Checking `pop3'... INFECTED 589s Checking `ps'... INFECTED 589s Checking `pstree'... INFECTED 589s Checking `rpcinfo'... INFECTED 589s Checking `rlogind'... INFECTED 590s Checking `rshd'... INFECTED 590s Checking `slogin'... INFECTED 590s Checking `sendmail'... INFECTED 590s Checking `sshd'... INFECTED but disabled 590s Checking `syslogd'... INFECTED 590s Checking `tar'... INFECTED 590s Checking `tcpd'... INFECTED 590s Checking `tcpdump'... INFECTED 590s Checking `top'... INFECTED 590s Checking `telnetd'... INFECTED 590s Checking `timed'... INFECTED 590s Checking `traceroute'... INFECTED 590s Checking `vdir'... INFECTED 590s Checking `w'... INFECTED 590s Checking `write'... INFECTED 590s Checking `aliens'... started 590s Searching for suspicious files in /tmp/CHKROOTKIT_ROOT/dev... WARNING 590s 590s WARNING: The following suspicious files were found in /tmp/CHKROOTKIT_ROOT/dev: 590s /tmp/CHKROOTKIT_ROOT/dev/bad-file 590s 590s Searching for known suspicious directories... WARNING 590s 590s WARNING: Suspect directory /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ found. Looking for sniffer logs: 590s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ 590s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/y 590s 590s Searching for known suspicious files... WARNING 590s 590s WARNING: The following known suspicious files were found: 590s /tmp/CHKROOTKIT_ROOT/usr/bin/atm 590s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 590s 591s Searching for sniffer's logs... WARNING 591s 591s WARNING: The following potential sniffer's logs were found: 591s /tmp/CHKROOTKIT_ROOT/tmp/tcp.log 591s 592s Searching for HiDrootkit rootkit... WARNING 592s 592s WARNING: Possible HiDrootkit rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/var/lib/games/.k/ 592s 592s Searching for t0rn rootkit... WARNING 592s 592s WARNING: Possible t0rn rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/etc/ttyhash 592s 592s Searching for t0rn v8 (or variation)... WARNING 592s 592s WARNING: Possible t0rn v8 (or variation) rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/local/lib/libproc.a 592s 592s Searching for Lion rootkit... WARNING 592s 592s WARNING: Possible Lion rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/bin/mjy 592s 592s Searching for RSHA rootkit... WARNING 592s 592s WARNING: Possible RSHA rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/n3tstat 592s 592s Searching for RH-Sharpe rootkit... WARNING 592s 592s WARNING: Possible RH-Sharpe rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/bin/lps 592s 592s Searching for Ambient (ark) rootkit... WARNING 592s 592s WARNING: Possible Ambient's rootkit (ark) installed: 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s 592s Searching for suspicious files and dirs... WARNING 592s 592s WARNING: The following suspicious files and directories were found: 592s /tmp/CHKROOTKIT_ROOT/usr/lib/... 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.DIR-aaa 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.1DIR 592s /tmp/CHKROOTKIT_ROOT/usr/lib/modules/6.11.0-8-generic/vdso/.build-id 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.bbb 592s /tmp/CHKROOTKIT_ROOT/usr/lib/...DIR 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.aaa 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.1 592s 592s Searching for LPD Worm... WARNING 592s 592s WARNING: Possible LPD worm installed (based on files found) 592s 592s Searching for Ramen Worm rootkit... WARNING 592s 592s WARNING: Possible Ramen Worm rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/src/.poop/ 592s 592s Searching for Maniac rootkit... WARNING 592s 592s WARNING: Possible Maniac rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/mailrc 592s 592s Searching for RK17 rootkit... WARNING 592s 592s WARNING: Possible RK17 rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus.cgi 592s /tmp/CHKROOTKIT_ROOT/usr/lib/number.cgi 592s 592s Searching for Ducoci rootkit... WARNING 592s 592s WARNING: Possible Ducoci rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last.cgi 592s 592s Searching for Adore Worm... WARNING 592s 592s WARNING: Possible Adore Worm installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/red.tar 592s 592s Searching for ShitC Worm... WARNING 592s 592s WARNING: Possible ShitC Worm installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/frgy 592s /tmp/CHKROOTKIT_ROOT/usr/bin/dy 592s 592s Searching for Omega Worm... WARNING 592s 592s WARNING: Possible Omega Worm installed: 592s /tmp/CHKROOTKIT_ROOT/dev/chr 592s 592s Searching for Sadmind/IIS Worm... WARNING 592s 592s WARNING: Possible Sadmin/IIS Worm installed: 592s /tmp/CHKROOTKIT_ROOT/dev/cuc 592s 592s Searching for MonKit... WARNING 592s 592s WARNING: Possible MonKit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/lib/libpikapp.a 592s 592s Searching for Showtee rootkit... WARNING 592s 592s WARNING: Possible Showtee rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s /tmp/CHKROOTKIT_ROOT/usr/include/chk.h 592s 592s Searching for OpticKit... WARNING 592s 592s WARNING: Possible OpticKit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s 592s Searching for T.R.K... WARNING 592s 592s WARNING: Possible T.R.K installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s 592s Searching for Mithra rootkit... WARNING 592s 592s WARNING: Possible Mithra installed: 592s /tmp/CHKROOTKIT_ROOT/usr/lib/locale/uboot 592s 592s Searching for OBSD rootkit v1... not tested 592s Searching for LOC rootkit... WARNING 592s 592s WARNING: Possible LOC rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/xp 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/epic 592s Searching for Romanian rootkit... WARNING 592s 592s WARNING: Possible Romanian rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s 592s Searching for HKRK rootkit... WARNING 592s 592s WARNING: Possible HKRK rootkit installed in /tmp/CHKROOTKIT_ROOT/etc/rc.d/init.d/network 592s 592s Searching for Suckit rootkit... WARNING 592s 592s WARNING: Possible Suckit: 592s /tmp/CHKROOTKIT_ROOT/dev/.golf/ 592s 592s Searching for Volc rootkit... WARNING 592s 592s WARNING: Possible Volc rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/volc 592s 592s Searching for Gold2 rootkit... WARNING 592s 592s WARNING: Possible Gold2 rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/bin/ishit 592s 592s Searching for TC2 rootkit... WARNING 592s 592s WARNING: Possible TC2 rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/initcheck 592s 592s Searching for Anonoying rootkit... WARNING 592s 592s WARNING: Possible Anonoying rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/mech 592s 592s Searching for ZK rootkit... WARNING 592s 592s WARNING: Possible ZK rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/etc/sysconfig/console/load.zk 592s 592s Searching for ShKit rootkit... WARNING 592s 592s WARNING: Possible ShKit rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 592s 592s Searching for AjaKit rootkit... WARNING 592s 592s WARNING: Possible AjaKit rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/dev/tux/ 592s 592s Searching for zaRwT rootkit... WARNING 592s 592s WARNING: Possible zaRwT rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/bin/imout 592s 592s Searching for Madalin rootkit... WARNING 592s 592s WARNING: Possible Madalin rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/include/icekey.h 592s 592s Searching for Fu rootkit... WARNING 592s 592s WARNING: Possible Fu rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/sbin/xc 592s 592s Searching for Kenga3 rootkit... WARNING 592s 592s WARNING: Possible Kenga3 rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/include/. ./ 592s /tmp/CHKROOTKIT_ROOT/usr/include/. ./foo 592s 592s Searching for ESRK rootkit... WARNING 592s 592s WARNING: Possible ESRK rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/usr/lib/tcl5.3/ 592s 592s Searching for rootedoor... WARNING 592s 592s WARNING: Possible rootedoor installed: 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 592s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 592s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 592s 592s Searching for ENYELKM rootkit... WARNING 592s 592s WARNING: Possible ENYELKM rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/etc/.enyelkmOCULTAR.ko/ 592s 592s Searching for common ssh-scanners... WARNING 592s 592s WARNING: Possible ssh-scanner installed: 592s /tmp/CHKROOTKIT_ROOT/var/tmp/vuln.txt 592s 592s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 592s 592s WARNING: /tmp/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 592s 592s Searching for Linux/Ebury 1.6... WARNING 592s 592s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /tmp/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils.so.1 592s Searching for 64-bit Linux Rootkit... WARNING 592s 592s WARNING: Possible 64-bit Linux Rootkit: 592s /tmp/CHKROOTKIT_ROOT/usr/local/hide/ 592s /tmp/CHKROOTKIT_ROOT/usr/local/hide/foo 592s /tmp/CHKROOTKIT_ROOT/etc/rc.local 592s 592s Searching for 64-bit Linux Rootkit modules... WARNING 592s 592s WARNING: Possible 64-bit rootkit modules installed: 592s /tmp/CHKROOTKIT_ROOT/lib/modules/module_init.ko 592s 592s Searching for Mumblehard... WARNING 592s 592s WARNING: Possible Mumblehard backdoor installed: 592s /tmp/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo 592s 592s Searching for Backdoor.Linux.Mokes.a... WARNING 592s 592s WARNING: Possible Backdoor.Linux.Mokes.a installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/ss0-0 592s 592s Searching for Malicious TinyDNS... WARNING 592s 592s WARNING: Possible Malicious TinyDNS installed: 592s /tmp/CHKROOTKIT_ROOT/home/ ./ 592s /tmp/CHKROOTKIT_ROOT/home/ ./tinyDNS 592s 592s Searching for Linux.Xor.DDoS... WARNING 592s 592s WARNING: Possible Linux.Xor.DDoS installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/autopkgtest-reboot-prepare 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/13_exitcode.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/04_backslashes.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/16_php.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/21_fix_loc_function.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/09_excludes.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/19_openssh.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/02_workingdir.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/26_improve-info-help-display.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/08_unidentified.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/03_linedup_reports.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/06_quiet.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/17_Suckitfalse.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/debian/rules 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/test-chkrootkit 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/debian/tests/find-debs-that-are-enhanced 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/debian/chkrootkit-daily 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/check_if_debian 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/build.TMx/src/check_php 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/autopkgtest-reboot 592s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.fRYZGo/wrapper.sh 592s /tmp/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/sed 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/id 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/uname 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/awk 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/head 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/strings 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/cut 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/netstat 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls.orig 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ss 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/find 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ps 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep.orig 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/xargs 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/dpkg-query 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/dirname 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/echo 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep 592s 592s Searching for Linux.Proxy.1.0... WARNING 592s 592s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 592s 592s Searching for CrossRAT... WARNING 592s 592s WARNING: Possible Malicious CrossRAT installed: 592s /tmp/CHKROOTKIT_ROOT/usr/var/mediamgrs.jar 592s 592s Searching for Hidden Cobra... WARNING 592s 592s WARNING: Possible Malicious Hidden Cobra installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/.ICE-unix/engine.so 592s 592s Searching for Rocke Miner rootkit... WARNING 592s 592s WARNING: Possible Rocke Miner rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/etc/xig 592s 592s Searching for PWNLNX4 lkm rootkit... WARNING 592s 592s WARNING: Possible PWNLNX4 lkm rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/var/tmp/.1/ 592s 592s Searching for PWNLNX6 lkm rootkit... WARNING 592s 592s WARNING: Possible PWNLNX6 lkm rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/suterusu/ 592s 592s Searching for Umbreon lrk... WARNING 592s 592s WARNING: Possible Malicious UMBREON LRK installed: 592s /tmp/CHKROOTKIT_ROOT/usr/share/libc.so.69 592s 592s Searching for Kinsing.a backdoor rootkit... WARNING 592s 592s WARNING: Possible Kinsing.a backdoor rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/kdevtmpfsi 592s 592s Searching for RotaJakiro backdoor rootkit... WARNING 592s 592s WARNING: Possible RotaJakiro backdoor rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/bin/systemd-daemon 592s 592s Searching for Syslogk LKM rootkit... not tested 592s Searching for Kovid LKM rootkit... WARNING 592s 592s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /tmp/CHKROOTKIT_ROOT/proc/kovid 592s 592s Searching for Tsunami DDoS Malware rootkit... WARNING 592s 592s WARNING: Possible Tsunami DDoS Malware rootkit installed: 592s /tmp/CHKROOTKIT_ROOT/bin/cls 592s 592s Searching for Linux BPF Door... WARNING 592s 592s WARNING: Possible Linux BPFDoor Malware installed: 592s /proc/xx/stack 592s 592s Searching for suspect PHP files... WARNING 592s 592s WARNING: The following suspicious PHP files were found: 592s /tmp/CHKROOTKIT_ROOT/tmp/name.php 592s /tmp/CHKROOTKIT_ROOT/tmp/by-content 592s /tmp/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; " 592s 592s Searching for zero-size shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 592s 592s WARNING: Zero-size history files: 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s 592s Searching for hardlinked shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 592s 592s WARNING: shell history files hardlinked to another file: 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s 592s Checking `aliens'... finished 592s Checking `asp'... WARNING 592s 592s WARNING: Possible Ramen Worm installed in /tmp/CHKROOTKIT_ROOT/etc/inetd.conf 592s 592s Checking `bindshell'... not tested 592s Checking `lkm'... started 592s Searching for Adore LKM... not tested 592s Searching for sebek LKM (Adore based)... not tested 592s Searching for knark LKM rootkit... not found 592s Searching for for hidden processes with chkproc... not tested 592s Searching for for hidden directories using chkdirs... not found 592s Checking `lkm'... finished 592s Checking `rexedcs'... INFECTED: /tmp/CHKROOTKIT_ROOT/usr/bin/in.rexedcs 592s Checking `sniffer'... not tested 592s Checking `w55808'... WARNING 592s 592s WARNING: Possible 55808 Worm installed 592s 592s Checking `wted'... not found 592s Checking `scalper'... WARNING 592s 592s WARNING: Possible Scalper Worm installed 592s 592s Checking `slapper'... WARNING 592s 592s WARNING: Possible Slapper Worm installed: 592s /tmp/CHKROOTKIT_ROOT/tmp/.bugtraq.c 592s 592s Checking `z2'... not found 592s Checking `chkutmp'... not tested 592s Checking `OSX_RSPLUG'... not tested 592s **** Files in log 592s total 44K 592s drwxr-xr-x 2 root root 4.0K Nov 26 20:48 . 592s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:41 .. 592s -rw-r--r-- 1 root root 0 Nov 26 20:48 chkrootkit-daily.log 592s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.expected 592s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today 592s -rw-r--r-- 1 root root 11K Nov 26 20:48 log.today.raw 592s *** Test of content of output follows... 592s **** Test for '^ROOTDIR is `/[^ ]+/CHKROOTKIT_ROOT/'$' 592s ROOTDIR is `/tmp/CHKROOTKIT_ROOT/' 592s OK 592s **** Test for '^Checking `amd'\.\.\. INFECTED$' 592s Checking `amd'... INFECTED 592s OK 592s **** Test for '^Checking `basename'\.\.\. INFECTED$' 592s Checking `basename'... INFECTED 592s OK 592s **** Test for '^Checking `biff'\.\.\. INFECTED$' 592s Checking `biff'... INFECTED 592s OK 592s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 592s Checking `chfn'... INFECTED 592s OK 592s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 592s Checking `chsh'... INFECTED 592s OK 592s **** Test for '^Checking `cron'\.\.\. INFECTED$' 592s Checking `cron'... INFECTED 592s OK 592s **** Test for '^Checking `crontab'\.\.\. WARNING$' 592s Checking `crontab'... WARNING 592s OK 592s **** Test for '^$' 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s 592s OK 592s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 592s WARNING: crontab for nobody found, possible Lupper.Worm. 592s OK 592s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 592s Checking for Lupper.Worm... INFECTED 592s OK 592s **** Test for '^Checking `date'\.\.\. INFECTED$' 592s Checking `date'... INFECTED 592s OK 592s **** Test for '^Checking `du'\.\.\. INFECTED$' 592s Checking `du'... INFECTED 592s OK 592s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 592s Checking `dirname'... INFECTED 592s OK 592s **** Test for '^Checking `echo'\.\.\. INFECTED$' 592s Checking `echo'... INFECTED 592s OK 592s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 592s Checking `egrep'... INFECTED 592s OK 592s **** Test for '^Checking `env'\.\.\. INFECTED$' 592s Checking `env'... INFECTED 592s OK 592s **** Test for '^Checking `find'\.\.\. INFECTED$' 592s Checking `find'... INFECTED 592s OK 592s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 592s Checking `fingerd'... INFECTED 592s OK 592s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 592s Checking `gpm'... INFECTED 592s OK 592s **** Test for '^Checking `grep'\.\.\. INFECTED$' 592s Checking `grep'... INFECTED 592s OK 592s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 592s Checking `hdparm'... INFECTED 592s OK 592s **** Test for '^Checking `su'\.\.\. INFECTED$' 592s Checking `su'... INFECTED 592s OK 592s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 592s Checking `ifconfig'... INFECTED 592s OK 592s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 592s Checking `inetd'... INFECTED 592s OK 592s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 592s Checking `inetdconf'... INFECTED 592s OK 592s **** Test for '^Checking `identd'\.\.\. INFECTED$' 592s Checking `identd'... INFECTED 592s OK 592s **** Test for '^Checking `init'\.\.\. INFECTED$' 592s Checking `init'... INFECTED 592s OK 592s **** Test for '^Checking `killall'\.\.\. INFECTED$' 592s Checking `killall'... INFECTED 592s OK 592s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 592s Checking `ldsopreload'... not infected 592s OK 592s **** Test for '^Checking `login'\.\.\. INFECTED$' 592s Checking `login'... INFECTED 592s OK 592s **** Test for '^Checking `ls'\.\.\. INFECTED$' 592s Checking `ls'... INFECTED 592s OK 592s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 592s Checking `lsof'... INFECTED 592s OK 592s **** Test for '^Checking `mail'\.\.\. INFECTED$' 592s Checking `mail'... INFECTED 592s OK 592s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 592s Checking `mingetty'... INFECTED 592s OK 592s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 592s Checking `netstat'... INFECTED 592s OK 592s **** Test for '^Checking `named'\.\.\. INFECTED$' 592s Checking `named'... INFECTED 592s OK 592s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 592s Checking `passwd'... INFECTED 592s OK 592s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 592s Checking `pidof'... INFECTED 592s OK 592s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 592s Checking `pop2'... INFECTED 592s OK 592s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 592s Checking `pop3'... INFECTED 592s OK 592s **** Test for '^Checking `ps'\.\.\. INFECTED$' 592s Checking `ps'... INFECTED 592s OK 592s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 592s Checking `pstree'... INFECTED 592s OK 592s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 592s Checking `rpcinfo'... INFECTED 592s OK 592s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 592s Checking `rlogind'... INFECTED 592s OK 592s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 592s Checking `rshd'... INFECTED 592s OK 592s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 592s Checking `slogin'... INFECTED 592s OK 592s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 592s Checking `sendmail'... INFECTED 592s OK 592s **** Test for '^Checking `sshd'\.\.\. INFECTED but disabled$' 592s Checking `sshd'... INFECTED but disabled 592s OK 592s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 592s Checking `syslogd'... INFECTED 592s OK 592s **** Test for '^Checking `tar'\.\.\. INFECTED$' 592s Checking `tar'... INFECTED 592s OK 592s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 592s Checking `tcpd'... INFECTED 592s OK 592s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 592s Checking `tcpdump'... INFECTED 592s OK 592s **** Test for '^Checking `top'\.\.\. INFECTED$' 592s Checking `top'... INFECTED 592s OK 592s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 592s Checking `telnetd'... INFECTED 592s OK 592s **** Test for '^Checking `timed'\.\.\. INFECTED$' 592s Checking `timed'... INFECTED 592s OK 592s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 592s Checking `traceroute'... INFECTED 592s OK 592s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 592s Checking `vdir'... INFECTED 592s OK 592s **** Test for '^Checking `w'\.\.\. INFECTED$' 592s Checking `w'... INFECTED 592s OK 592s **** Test for '^Checking `write'\.\.\. INFECTED$' 592s Checking `write'... INFECTED 592s OK 592s **** Test for '^Checking `aliens'\.\.\. started$' 592s Checking `aliens'... started 592s OK 592s **** Test for '^Searching for suspicious files in /[^ ]+/CHKROOTKIT_ROOT/dev\.\.\. +WARNING$' 592s Searching for suspicious files in /tmp/CHKROOTKIT_ROOT/dev... WARNING 592s OK 592s **** Test for '^WARNING: The following suspicious files were found in /[^ ]+/CHKROOTKIT_ROOT/dev:$' 592s WARNING: The following suspicious files were found in /tmp/CHKROOTKIT_ROOT/dev: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/bad-file$' 592s /tmp/CHKROOTKIT_ROOT/dev/bad-file 592s OK 592s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 592s Searching for known suspicious directories... WARNING 592s OK 592s **** Test for '^WARNING: Suspect directory /[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/ found\. Looking for sniffer logs:$' 592s WARNING: Suspect directory /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ found. Looking for sniffer logs: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/$' 592s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/y$' 592s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/y 592s OK 592s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 592s Searching for known suspicious files... WARNING 592s OK 592s **** Test for '^WARNING: The following known suspicious files were found:$' 592s WARNING: The following known suspicious files were found: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/atm$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/atm 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$' 592s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 592s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 592s OK 592s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 592s Searching for sniffer's logs... WARNING 592s OK 592s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 592s WARNING: The following potential sniffer's logs were found: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/tcp\.log$' 592s /tmp/CHKROOTKIT_ROOT/tmp/tcp.log 592s OK 592s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 592s Searching for HiDrootkit rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 592s WARNING: Possible HiDrootkit rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/lib/games/\.k/$' 592s /tmp/CHKROOTKIT_ROOT/var/lib/games/.k/ 592s OK 592s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 592s Searching for t0rn rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 592s WARNING: Possible t0rn rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ttyhash$' 592s /tmp/CHKROOTKIT_ROOT/etc/ttyhash 592s OK 592s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. WARNING$' 592s Searching for t0rn v8 (or variation)... WARNING 592s OK 592s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 592s WARNING: Possible t0rn v8 (or variation) rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/lib/libproc\.a$' 592s /tmp/CHKROOTKIT_ROOT/usr/local/lib/libproc.a 592s OK 592s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 592s Searching for Lion rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Lion rootkit installed:$' 592s WARNING: Possible Lion rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/mjy$' 592s /tmp/CHKROOTKIT_ROOT/bin/mjy 592s OK 592s **** Test for '^Searching for RSHA rootkit\.\.\. WARNING$' 592s Searching for RSHA rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 592s WARNING: Possible RSHA rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/n3tstat$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/n3tstat 592s OK 592s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 592s Searching for RH-Sharpe rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 592s WARNING: Possible RH-Sharpe rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/lps$' 592s /tmp/CHKROOTKIT_ROOT/bin/lps 592s OK 592s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. WARNING$' 592s Searching for Ambient (ark) rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 592s WARNING: Possible Ambient's rootkit (ark) installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/\.ark\?$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s OK 592s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 592s Searching for suspicious files and dirs... WARNING 592s OK 592s **** Test for '^WARNING: The following suspicious files and directories were found:$' 592s WARNING: The following suspicious files and directories were found: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.1 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.aaa$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.aaa 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1DIR$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.1DIR 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.ark\?$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.DIR$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/...DIR 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.bbb$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.bbb 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.DIR-aaa$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/.DIR-aaa 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/... 592s OK 592s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 592s Searching for LPD Worm... WARNING 592s OK 592s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 592s WARNING: Possible LPD worm installed (based on files found) 592s OK 592s **** Test for '^Searching for Ramen Worm rootkit\.\.\. WARNING$' 592s Searching for Ramen Worm rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 592s WARNING: Possible Ramen Worm rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/src/\.poop/$' 592s /tmp/CHKROOTKIT_ROOT/usr/src/.poop/ 592s OK 592s **** Test for '^Searching for Maniac rootkit\.\.\. WARNING$' 592s Searching for Maniac rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 592s WARNING: Possible Maniac rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/mailrc$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/mailrc 592s OK 592s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 592s Searching for RK17 rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 592s WARNING: Possible RK17 rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus\.cgi$' 592s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus.cgi 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/number\.cgi$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/number.cgi 592s OK 592s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 592s Searching for Ducoci rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 592s WARNING: Possible Ducoci rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last\.cgi$' 592s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last.cgi 592s OK 592s **** Test for '^Searching for Adore Worm\.\.\. WARNING$' 592s Searching for Adore Worm... WARNING 592s OK 592s **** Test for '^WARNING: Possible Adore Worm installed:$' 592s WARNING: Possible Adore Worm installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/red\.tar$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/red.tar 592s OK 592s **** Test for '^Searching for ShitC Worm\.\.\. WARNING$' 592s Searching for ShitC Worm... WARNING 592s OK 592s **** Test for '^WARNING: Possible ShitC Worm installed:$' 592s WARNING: Possible ShitC Worm installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/dy$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/dy 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/frgy$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/frgy 592s OK 592s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 592s Searching for Omega Worm... WARNING 592s OK 592s **** Test for '^WARNING: Possible Omega Worm installed:$' 592s WARNING: Possible Omega Worm installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/chr$' 592s /tmp/CHKROOTKIT_ROOT/dev/chr 592s OK 592s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 592s Searching for Sadmind/IIS Worm... WARNING 592s OK 592s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 592s WARNING: Possible Sadmin/IIS Worm installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/cuc$' 592s /tmp/CHKROOTKIT_ROOT/dev/cuc 592s OK 592s **** Test for '^Searching for MonKit\.\.\. WARNING$' 592s Searching for MonKit... WARNING 592s OK 592s **** Test for '^WARNING: Possible MonKit installed:$' 592s WARNING: Possible MonKit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/libpikapp\.a$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/libpikapp.a 592s OK 592s **** Test for '^Searching for Showtee rootkit\.\.\. WARNING$' 592s Searching for Showtee rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 592s WARNING: Possible Showtee rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/chk\.h$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/chk.h 592s OK 592s **** Test for '^Searching for OpticKit\.\.\. WARNING$' 592s Searching for OpticKit... WARNING 592s OK 592s **** Test for '^WARNING: Possible OpticKit installed:$' 592s WARNING: Possible OpticKit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s OK 592s **** Test for '^Searching for T\.R\.K\.\.\. WARNING$' 592s Searching for T.R.K... WARNING 592s OK 592s **** Test for '^WARNING: Possible T\.R\.K installed:$' 592s WARNING: Possible T.R.K installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 592s OK 592s **** Test for '^Searching for Mithra rootkit\.\.\. WARNING$' 592s Searching for Mithra rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Mithra installed:$' 592s WARNING: Possible Mithra installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/locale/uboot$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/locale/uboot 592s OK 592s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 592s Searching for OBSD rootkit v1... not tested 592s OK 592s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 592s Searching for LOC rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible LOC rootkit installed:$' 592s WARNING: Possible LOC rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/xp$' 592s /tmp/CHKROOTKIT_ROOT/tmp/xp 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/epic$' 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/epic 592s OK 592s **** Test for '^Searching for Romanian rootkit\.\.\. WARNING$' 592s Searching for Romanian rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 592s WARNING: Possible Romanian rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 592s OK 592s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 592s Searching for HKRK rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible HKRK rootkit installed in /[^ ]+/CHKROOTKIT_ROOT/etc/rc\.d/init\.d/network$' 592s WARNING: Possible HKRK rootkit installed in /tmp/CHKROOTKIT_ROOT/etc/rc.d/init.d/network 592s OK 592s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 592s Searching for Suckit rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Suckit:$' 592s WARNING: Possible Suckit: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/\.golf/$' 592s /tmp/CHKROOTKIT_ROOT/dev/.golf/ 592s OK 592s **** Test for '^Searching for Volc rootkit\.\.\. WARNING$' 592s Searching for Volc rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Volc rootkit installed:$' 592s WARNING: Possible Volc rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/volc$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/volc 592s OK 592s **** Test for '^Searching for Gold2 rootkit\.\.\. WARNING$' 592s Searching for Gold2 rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 592s WARNING: Possible Gold2 rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/ishit$' 592s /tmp/CHKROOTKIT_ROOT/usr/bin/ishit 592s OK 592s **** Test for '^Searching for TC2 rootkit\.\.\. WARNING$' 592s Searching for TC2 rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 592s WARNING: Possible TC2 rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/initcheck$' 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/initcheck 592s OK 592s **** Test for '^Searching for Anonoying rootkit\.\.\. WARNING$' 592s Searching for Anonoying rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 592s WARNING: Possible Anonoying rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/mech$' 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/mech 592s OK 592s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 592s Searching for ZK rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible ZK rootkit installed:$' 592s WARNING: Possible ZK rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/sysconfig/console/load\.zk$' 592s /tmp/CHKROOTKIT_ROOT/etc/sysconfig/console/load.zk 592s OK 592s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 592s Searching for ShKit rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 592s WARNING: Possible ShKit rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$' 592s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 592s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 592s OK 592s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 592s Searching for AjaKit rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 592s WARNING: Possible AjaKit rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/tux/$' 592s /tmp/CHKROOTKIT_ROOT/dev/tux/ 592s OK 592s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 592s Searching for zaRwT rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 592s WARNING: Possible zaRwT rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/imout$' 592s /tmp/CHKROOTKIT_ROOT/bin/imout 592s OK 592s **** Test for '^Searching for Madalin rootkit\.\.\. WARNING$' 592s Searching for Madalin rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 592s WARNING: Possible Madalin rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/icekey\.h$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/icekey.h 592s OK 592s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 592s Searching for Fu rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Fu rootkit installed:$' 592s WARNING: Possible Fu rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/sbin/xc$' 592s /tmp/CHKROOTKIT_ROOT/sbin/xc 592s OK 592s **** Test for '^Searching for Kenga3 rootkit\.\.\. WARNING$' 592s Searching for Kenga3 rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 592s WARNING: Possible Kenga3 rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/. ./ 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./foo$' 592s /tmp/CHKROOTKIT_ROOT/usr/include/. ./foo 592s OK 592s **** Test for '^Searching for ESRK rootkit\.\.\. WARNING$' 592s Searching for ESRK rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 592s WARNING: Possible ESRK rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/tcl5\.3/$' 592s /tmp/CHKROOTKIT_ROOT/usr/lib/tcl5.3/ 592s OK 592s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 592s Searching for rootedoor... WARNING 592s OK 592s **** Test for '^WARNING: Possible rootedoor installed:$' 592s WARNING: Possible rootedoor installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/rootedoor$' 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 592s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/sbin/rootedoor$' 592s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 592s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 592s OK 592s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 592s Searching for ENYELKM rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 592s WARNING: Possible ENYELKM rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/\.enyelkmOCULTAR\.ko/$' 592s /tmp/CHKROOTKIT_ROOT/etc/.enyelkmOCULTAR.ko/ 592s OK 592s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 592s Searching for common ssh-scanners... WARNING 592s OK 592s **** Test for '^WARNING: Possible ssh-scanner installed:$' 592s WARNING: Possible ssh-scanner installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/vuln\.txt$' 592s /tmp/CHKROOTKIT_ROOT/var/tmp/vuln.txt 592s OK 592s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 592s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 592s OK 592s **** Test for '^WARNING: /[^ ]+/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 592s WARNING: /tmp/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 592s OK 592s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 592s Searching for Linux/Ebury 1.6... WARNING 592s OK 592s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /[^ ]+/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils\.so\.1$' 592s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /tmp/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils.so.1 592s OK 592s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 592s Searching for 64-bit Linux Rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 592s WARNING: Possible 64-bit Linux Rootkit: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/$' 592s /tmp/CHKROOTKIT_ROOT/usr/local/hide/ 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/foo$' 592s /tmp/CHKROOTKIT_ROOT/usr/local/hide/foo 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/rc\.local$' 592s /tmp/CHKROOTKIT_ROOT/etc/rc.local 592s OK 592s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 592s Searching for 64-bit Linux Rootkit modules... WARNING 592s OK 592s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 592s WARNING: Possible 64-bit rootkit modules installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/lib/modules/module_init\.ko$' 592s /tmp/CHKROOTKIT_ROOT/lib/modules/module_init.ko 592s OK 592s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 592s Searching for Mumblehard... WARNING 592s OK 592s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 592s WARNING: Possible Mumblehard backdoor installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo$' 592s /tmp/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo 592s OK 592s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 592s Searching for Backdoor.Linux.Mokes.a... WARNING 592s OK 592s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 592s WARNING: Possible Backdoor.Linux.Mokes.a installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/ss0-0$' 592s /tmp/CHKROOTKIT_ROOT/tmp/ss0-0 592s OK 592s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 592s Searching for Malicious TinyDNS... WARNING 592s OK 592s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 592s WARNING: Possible Malicious TinyDNS installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/home/ \./$' 592s /tmp/CHKROOTKIT_ROOT/home/ ./ 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/home/ \./tinyDNS$' 592s /tmp/CHKROOTKIT_ROOT/home/ ./tinyDNS 592s OK 592s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 592s Searching for Linux.Xor.DDoS... WARNING 592s OK 592s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 592s WARNING: Possible Linux.Xor.DDoS installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/strings$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/strings 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/uname$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/uname 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/head$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/head 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/find$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/find 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/echo$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/echo 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/netstat$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/netstat 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls\.orig$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls.orig 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ps$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ps 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/awk$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/awk 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep\.orig$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep.orig 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dirname$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/dirname 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ss$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/ss 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/sed$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/sed 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/cut$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/cut 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/id$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/id 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/xargs$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/xargs 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dpkg-query$' 592s /tmp/CHKROOTKIT_ROOT/tmp/clean/dpkg-query 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive$' 592s /tmp/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive 592s OK 592s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 592s Searching for Linux.Proxy.1.0... WARNING 592s OK 592s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 592s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 592s OK 592s **** Test for '^Searching for CrossRAT\.\.\. WARNING$' 592s Searching for CrossRAT... WARNING 592s OK 592s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 592s WARNING: Possible Malicious CrossRAT installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/var/mediamgrs\.jar$' 592s /tmp/CHKROOTKIT_ROOT/usr/var/mediamgrs.jar 592s OK 592s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 592s Searching for Hidden Cobra... WARNING 592s OK 592s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 592s WARNING: Possible Malicious Hidden Cobra installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.ICE-unix/engine\.so$' 592s /tmp/CHKROOTKIT_ROOT/tmp/.ICE-unix/engine.so 592s OK 592s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 592s Searching for Rocke Miner rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 592s WARNING: Possible Rocke Miner rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/xig$' 592s /tmp/CHKROOTKIT_ROOT/etc/xig 592s OK 592s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 592s Searching for PWNLNX4 lkm rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 592s WARNING: Possible PWNLNX4 lkm rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/\.1/$' 592s /tmp/CHKROOTKIT_ROOT/var/tmp/.1/ 592s OK 592s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 592s Searching for PWNLNX6 lkm rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 592s WARNING: Possible PWNLNX6 lkm rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/suterusu/$' 592s /tmp/CHKROOTKIT_ROOT/tmp/suterusu/ 592s OK 592s **** Test for '^Searching for Umbreon lrk\.\.\. WARNING$' 592s Searching for Umbreon lrk... WARNING 592s OK 592s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 592s WARNING: Possible Malicious UMBREON LRK installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/share/libc\.so\.69$' 592s /tmp/CHKROOTKIT_ROOT/usr/share/libc.so.69 592s OK 592s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 592s Searching for Kinsing.a backdoor rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 592s WARNING: Possible Kinsing.a backdoor rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/kdevtmpfsi$' 592s /tmp/CHKROOTKIT_ROOT/tmp/kdevtmpfsi 592s OK 592s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 592s Searching for RotaJakiro backdoor rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 592s WARNING: Possible RotaJakiro backdoor rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/systemd-daemon$' 592s /tmp/CHKROOTKIT_ROOT/bin/systemd-daemon 592s OK 592s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not tested$' 592s Searching for Syslogk LKM rootkit... not tested 592s OK 592s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 592s Searching for Kovid LKM rootkit... WARNING 592s OK 592s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /[^ ]+/CHKROOTKIT_ROOT/proc/kovid$' 592s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /tmp/CHKROOTKIT_ROOT/proc/kovid 592s OK 592s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 592s Searching for Tsunami DDoS Malware rootkit... WARNING 592s OK 592s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 592s WARNING: Possible Tsunami DDoS Malware rootkit installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/cls$' 592s /tmp/CHKROOTKIT_ROOT/bin/cls 592s OK 592s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 592s Searching for Linux BPF Door... WARNING 592s OK 592s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 592s WARNING: Possible Linux BPFDoor Malware installed: 592s OK 592s **** Test for '^/proc/xx/stack$' 592s /proc/xx/stack 592s OK 592s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 592s Searching for suspect PHP files... WARNING 592s OK 592s **** Test for '^WARNING: The following suspicious PHP files were found:$' 592s WARNING: The following suspicious PHP files were found: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/name\.php$' 592s /tmp/CHKROOTKIT_ROOT/tmp/name.php 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; "' 592s /tmp/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; " 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/by-content$' 592s /tmp/CHKROOTKIT_ROOT/tmp/by-content 592s OK 592s **** Test for '^Searching for zero-size shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$' 592s Searching for zero-size shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 592s OK 592s **** Test for '^WARNING: Zero-size history files:$' 592s WARNING: Zero-size history files: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$' 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s OK 592s **** Test for '^Searching for hardlinked shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$' 592s Searching for hardlinked shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 592s OK 592s **** Test for '^WARNING: shell history files hardlinked to another file:$' 592s WARNING: shell history files hardlinked to another file: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$' 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 592s OK 592s **** Test for '^Checking `aliens'\.\.\. finished$' 592s Checking `aliens'... finished 592s OK 592s **** Test for '^Checking `asp'\.\.\. WARNING$' 592s Checking `asp'... WARNING 592s OK 592s **** Test for '^WARNING: Possible Ramen Worm installed in /[^ ]+/CHKROOTKIT_ROOT/etc/inetd\.conf$' 592s WARNING: Possible Ramen Worm installed in /tmp/CHKROOTKIT_ROOT/etc/inetd.conf 592s OK 592s **** Test for '^Checking `bindshell'\.\.\. not tested$' 592s Checking `bindshell'... not tested 592s OK 592s **** Test for '^Checking `lkm'\.\.\. started$' 592s Checking `lkm'... started 592s OK 592s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 592s Searching for Adore LKM... not tested 592s OK 592s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 592s Searching for sebek LKM (Adore based)... not tested 592s OK 592s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 592s Searching for knark LKM rootkit... not found 592s OK 592s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not tested$' 592s Searching for for hidden processes with chkproc... not tested 592s OK 592s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 592s Searching for for hidden directories using chkdirs... not found 592s OK 592s **** Test for '^Checking `lkm'\.\.\. finished$' 592s Checking `lkm'... finished 592s OK 592s **** Test for '^Checking `rexedcs'\.\.\. INFECTED: /[^ ]+/CHKROOTKIT_ROOT/usr/bin/in\.rexedcs$' 592s Checking `rexedcs'... INFECTED: /tmp/CHKROOTKIT_ROOT/usr/bin/in.rexedcs 592s OK 592s **** Test for '^Checking `sniffer'\.\.\. not tested$' 592s Checking `sniffer'... not tested 592s OK 592s **** Test for '^Checking `w55808'\.\.\. WARNING$' 592s Checking `w55808'... WARNING 592s OK 592s **** Test for '^WARNING: Possible 55808 Worm installed$' 592s WARNING: Possible 55808 Worm installed 592s OK 592s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 592s Checking `wted'... not found 592s OK 592s **** Test for '^Checking `scalper'\.\.\. WARNING$' 592s Checking `scalper'... WARNING 592s OK 592s **** Test for '^WARNING: Possible Scalper Worm installed$' 592s WARNING: Possible Scalper Worm installed 592s OK 592s **** Test for '^Checking `slapper'\.\.\. WARNING$' 592s Checking `slapper'... WARNING 592s OK 592s **** Test for '^WARNING: Possible Slapper Worm installed:$' 592s WARNING: Possible Slapper Worm installed: 592s OK 592s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.bugtraq\.c$' 592s /tmp/CHKROOTKIT_ROOT/tmp/.bugtraq.c 592s OK 592s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 592s Checking `z2'... not found 592s OK 592s **** Test for '^Checking `chkutmp'\.\.\. not tested$' 592s Checking `chkutmp'... not tested 592s OK 592s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 592s Checking `OSX_RSPLUG'... not tested 592s OK 592s ** PASS: Testing: setting-rootdir (chkrootkit -p /tmp/clean -r /tmp/CHKROOTKIT_ROOT) done: PASS 592s *** Unexpected (unmatched) lines follow (for info): 592s /tmp/CHKROOTKIT_ROOT/usr/lib/modules/6.11.0-8-generic/vdso/.build-id 592s * Resetting 592s Removing symlink: /tmp/CHKROOTKIT_ROOT 592s replace /etc/rc.local with /etc/rc.local.pre-rootkit 592s /etc/rc.local 592s replace /etc/passwd with /etc/passwd.pre-rootkit 592s /etc/passwd 592s /etc/passwd- 592s replace /etc/inetd.conf with /etc/inetd.conf.pre-rootkit 592s /etc/inetd.conf 592s replace /lib/x86_64-linux-gnu/libkeyutils.so.1 with /lib/x86_64-linux-gnu/libkeyutils.so.1.pre-rootkit 592s /lib/x86_64-linux-gnu/libkeyutils.so.1 592s /lib/x86_64-linux-gnu/libkeyutils.so.1.10 592s kill: /usr/bin/atm 592s /tmp/clean/ls.orig: cannot access '/usr/bin/atm*': No such file or directory 592s kill: /tmp/tcp.log 592s /tmp/clean/ls.orig: cannot access '/tmp/tcp.log*': No such file or directory 592s kill: /var/lib/games/.k/foo 592s /tmp/clean/ls.orig: cannot access '/var/lib/games/.k/foo*': No such file or directory 592s kill: /usr/src/.poop/foo 592s /tmp/clean/ls.orig: cannot access '/usr/src/.poop/foo*': No such file or directory 592s kill: /dev/.golf/foo 592s /tmp/clean/ls.orig: cannot access '/dev/.golf/foo*': No such file or directory 592s kill: /dev/tux/foo 592s /tmp/clean/ls.orig: cannot access '/dev/tux/foo*': No such file or directory 592s kill: /usr/include/. ./foo 592s /tmp/clean/ls.orig: cannot access '/usr/include/. ./foo*': No such file or directory 592s kill: /usr/lib/tcl5.3/foo 592s /tmp/clean/ls.orig: cannot access '/usr/lib/tcl5.3/foo*': No such file or directory 592s kill: /etc/ttyhash 592s /tmp/clean/ls.orig: cannot access '/etc/ttyhash*': No such file or directory 592s kill: /usr/local/lib/libproc.a 592s /usr/local/lib/libproc.a* 592s kill: /bin/mjy 592s /tmp/clean/ls.orig: cannot access '/bin/mjy*': No such file or directory 592s kill: /usr/bin/n3tstat 592s /tmp/clean/ls.orig: cannot access '/usr/bin/n3tstat*': No such file or directory 592s kill: /bin/lps 592s /tmp/clean/ls.orig: cannot access '/bin/lps*': No such file or directory 592s kill: /usr/lib/.ark? 592s /tmp/clean/ls.orig: cannot access '/usr/lib/.ark?*': No such file or directory 592s kill: /usr/lib/number.cgi 592s /tmp/clean/ls.orig: cannot access '/usr/lib/number.cgi*': No such file or directory 592s kill: /www/httpd/cgi-bin/last.cgi 592s /tmp/clean/ls.orig: cannot access '/www/httpd/cgi-bin/last.cgi*': No such file or directory 592s kill: /usr/bin/red.tar 592s /tmp/clean/ls.orig: cannot access '/usr/bin/red.tar*': No such file or directory 592s kill: /bin/dy 592s /tmp/clean/ls.orig: cannot access '/bin/dy*': No such file or directory 592s kill: /dev/chr 592s /tmp/clean/ls.orig: cannot access '/dev/chr*': No such file or directory 592s kill: /dev/cucl 592s /tmp/clean/ls.orig: cannot access '/dev/cucl*': No such file or directory 592s kill: /usr/include/chk.h 592s /tmp/clean/ls.orig: cannot access '/usr/include/chk.h*': No such file or directory 592s kill: /usr/bin/xsf 592s /tmp/clean/ls.orig: cannot access '/usr/bin/xsf*': No such file or directory 592s kill: /usr/lib/locale/uboot 592s /tmp/clean/ls.orig: cannot access '/usr/lib/locale/uboot*': No such file or directory 592s kill: /tmp/xp 592s /tmp/clean/ls.orig: cannot access '/tmp/xp*': No such file or directory 592s kill: /usr/bin/volc 592s /tmp/clean/ls.orig: cannot access '/usr/bin/volc*': No such file or directory 592s kill: /usr/include/proc.h 592s /usr/include/proc.h* 592s kill: /etc/rc.d/init.d/network 592s /tmp/clean/ls.orig: cannot access '/etc/rc.d/init.d/network*': No such file or directory 592s kill: /usr/bin/ishit 592s /tmp/clean/ls.orig: cannot access '/usr/bin/ishit*': No such file or directory 592s kill: /usr/sbin/initcheck 592s /tmp/clean/ls.orig: cannot access '/usr/sbin/initcheck*': No such file or directory 592s kill: /usr/sbin/mech 592s /tmp/clean/ls.orig: cannot access '/usr/sbin/mech*': No such file or directory 592s kill: /etc/sysconfig/console/load.zk 592s /tmp/clean/ls.orig: cannot access '/etc/sysconfig/console/load.zk*': No such file or directory 592s kill: /etc/ld.so.hash 592s /tmp/clean/ls.orig: cannot access '/etc/ld.so.hash*': No such file or directory 592s kill: /bin/imout 592s /tmp/clean/ls.orig: cannot access '/bin/imout*': No such file or directory 592s kill: /usr/include/icekey.h 592s /tmp/clean/ls.orig: cannot access '/usr/include/icekey.h*': No such file or directory 592s kill: /sbin/xc 592s /tmp/clean/ls.orig: cannot access '/sbin/xc*': No such file or directory 592s kill: /sbin/rootedoor 592s /tmp/clean/ls.orig: cannot access '/sbin/rootedoor*': No such file or directory 592s kill: /etc/.enyelkmOCULTAR.ko/foo 592s /tmp/clean/ls.orig: cannot access '/etc/.enyelkmOCULTAR.ko/foo*': No such file or directory 592s kill: /var/tmp/vuln.txt 592s /tmp/clean/ls.orig: cannot access '/var/tmp/vuln.txt*': No such file or directory 592s kill: /usr/local/hide/foo 592s /tmp/clean/ls.orig: cannot access '/usr/local/hide/foo*': No such file or directory 592s kill: /lib/modules/module_init.ko 592s /tmp/clean/ls.orig: cannot access '/lib/modules/module_init.ko*': No such file or directory 592s kill: /tmp/ss0-0 592s /tmp/clean/ls.orig: cannot access '/tmp/ss0-0*': No such file or directory 592s kill: /usr/var/mediamgrs.jar 592s /tmp/clean/ls.orig: cannot access '/usr/var/mediamgrs.jar*': No such file or directory 592s kill: /tmp/.ICE-unix/engine.so 592s /tmp/clean/ls.orig: cannot access '/tmp/.ICE-unix/engine.so*': No such file or directory 592s kill: /etc/xig 592s /tmp/clean/ls.orig: cannot access '/etc/xig*': No such file or directory 592s kill: /var/tmp/.1/x 592s /tmp/clean/ls.orig: cannot access '/var/tmp/.1/x*': No such file or directory 592s kill: /var/run/.tmp/y 592s /tmp/clean/ls.orig: cannot access '/var/run/.tmp/y*': No such file or directory 592s kill: /tmp/suterusu/pwnlnx6 592s /tmp/clean/ls.orig: cannot access '/tmp/suterusu/pwnlnx6*': No such file or directory 592s kill: /usr/share/libc.so.69 592s /tmp/clean/ls.orig: cannot access '/usr/share/libc.so.69*': No such file or directory 592s kill: /tmp/kdevtmpfsi 592s /tmp/clean/ls.orig: cannot access '/tmp/kdevtmpfsi*': No such file or directory 592s kill: /bin/systemd-daemon 592s /tmp/clean/ls.orig: cannot access '/bin/systemd-daemon*': No such file or directory 592s kill: /syslogk 592s /tmp/clean/ls.orig: cannot access '/syslogk*': No such file or directory 592s kill: /root/.whatever.history 592s /root/.whatever.history.hardlink 592s kill: /root/.whatever.history.hardlink 592s /tmp/clean/ls.orig: cannot access '/root/.whatever.history.hardlink*': No such file or directory 592s kill: /tmp/name.php 592s /tmp/clean/ls.orig: cannot access '/tmp/name.php*': No such file or directory 592s kill: /bin/.ps 592s /tmp/clean/ls.orig: cannot access '/bin/.ps*': No such file or directory 592s kill: /usr/bin/mailrc 592s /tmp/clean/ls.orig: cannot access '/usr/bin/mailrc*': No such file or directory 592s kill: /www/httpd/cgi-bin/bogus.cgi 592s /tmp/clean/ls.orig: cannot access '/www/httpd/cgi-bin/bogus.cgi*': No such file or directory 592s kill: /bin/frgy 592s /tmp/clean/ls.orig: cannot access '/bin/frgy*': No such file or directory 592s kill: /dev/cuc 592s /tmp/clean/ls.orig: cannot access '/dev/cuc*': No such file or directory 592s kill: /usr/lib/libpikapp.a 592s /tmp/clean/ls.orig: cannot access '/usr/lib/libpikapp.a*': No such file or directory 592s kill: /var/spool/cron/crontabs/foo 592s /tmp/clean/ls.orig: cannot access '/var/spool/cron/crontabs/foo*': No such file or directory 592s kill: /sbin/ssh 592s /sbin/sshd 592s /sbin/sshd.orig 592s /sbin/sshd.to_replace 592s kill: /dev/bad-file 592s /tmp/clean/ls.orig: cannot access '/dev/bad-file*': No such file or directory 592s kill: /home/ ./tinyDNS 592s /tmp/clean/ls.orig: cannot access '/home/ ./tinyDNS*': No such file or directory 592s kill: /tmp/by-content 592s /tmp/clean/ls.orig: cannot access '/tmp/by-content*': No such file or directory 592s kill: /bin/in.rexedcs 592s /tmp/clean/ls.orig: cannot access '/bin/in.rexedcs*': No such file or directory 592s kill: /tmp/.uua 592s /tmp/clean/ls.orig: cannot access '/tmp/.uua*': No such file or directory 592s kill: /tmp/.bugtraq.c 592s /tmp/clean/ls.orig: cannot access '/tmp/.bugtraq.c*': No such file or directory 592s kill: /tmp/.../r 592s /tmp/clean/ls.orig: cannot access '/tmp/.../r*': No such file or directory 592s kill: /bin/cls 592s /tmp/clean/ls.orig: cannot access '/bin/cls*': No such file or directory 592s kill: /tmp/sp ace/aaa' exit 1; " 592s /tmp/clean/ls.orig: cannot access '/tmp/sp ace/aaa'\'' exit 1; "*': No such file or directory 592s TO_REPLACE: restoring /usr/sbin/amd with /usr/sbin/amd.to_replace 592s /usr/sbin/amd 592s TO_REPLACE: restoring /usr/bin/basename with /usr/bin/basename.to_replace 592s /usr/bin/basename 592s TO_REPLACE: restoring /usr/sbin/biff with /usr/sbin/biff.to_replace 592s /usr/sbin/biff 592s TO_REPLACE: restoring /usr/bin/chfn with /usr/bin/chfn.to_replace 592s /usr/bin/chfn 592s TO_REPLACE: restoring /usr/bin/chsh with /usr/bin/chsh.to_replace 592s /usr/bin/chsh 592s TO_REPLACE: restoring /usr/sbin/cron with /usr/sbin/cron.to_replace 592s /usr/sbin/cron 592s /usr/sbin/cron.orig 592s TO_REPLACE: restoring /usr/bin/date with /usr/bin/date.to_replace 592s /usr/bin/date 592s TO_REPLACE: restoring /usr/bin/du with /usr/bin/du.to_replace 592s /usr/bin/du 592s /usr/bin/dumpkeys 592s TO_REPLACE: restoring /usr/bin/dirname with /usr/bin/dirname.to_replace 592s /usr/bin/dirname 592s TO_REPLACE: restoring /usr/bin/echo with /usr/bin/echo.to_replace 592s /usr/bin/echo 592s TO_REPLACE: restoring /usr/bin/egrep with /usr/bin/egrep.to_replace 592s /usr/bin/egrep 592s TO_REPLACE: restoring /usr/bin/env with /usr/bin/env.to_replace 592s /usr/bin/env 592s /usr/bin/envsubst 592s TO_REPLACE: restoring /usr/bin/find with /usr/bin/find.to_replace 592s /usr/bin/find 592s /usr/bin/findmnt 592s TO_REPLACE: restoring /usr/sbin/fingerd with /usr/sbin/fingerd.to_replace 592s /usr/sbin/fingerd 592s TO_REPLACE: restoring /usr/sbin/gpm with /usr/sbin/gpm.to_replace 592s /usr/sbin/gpm 592s TO_REPLACE: restoring /usr/bin/grep with /usr/bin/grep.to_replace 592s /usr/bin/grep 592s TO_REPLACE: restoring /usr/sbin/hdparm with /usr/sbin/hdparm.to_replace 592s /usr/sbin/hdparm 592s /usr/sbin/hdparm.orig 592s TO_REPLACE: restoring /usr/bin/su with /usr/bin/su.to_replace 592s /usr/bin/su 592s /usr/bin/sudo 592s /usr/bin/sudoedit 592s /usr/bin/sudoreplay 592s /usr/bin/sum 592s TO_REPLACE: restoring /usr/sbin/ifconfig with /usr/sbin/ifconfig.to_replace 592s /usr/sbin/ifconfig 592s TO_REPLACE: restoring /usr/sbin/inetd with /usr/sbin/inetd.to_replace 592s /usr/sbin/inetd 592s /usr/sbin/inetdconf 592s TO_REPLACE: restoring /usr/sbin/in.identd with /usr/sbin/in.identd.to_replace 592s /usr/sbin/in.identd 592s TO_REPLACE: restoring /usr/lib/systemd/systemd with /usr/lib/systemd/systemd.to_replace 592s /usr/lib/systemd/systemd 592s /usr/lib/systemd/systemd-backlight 592s /usr/lib/systemd/systemd-battery-check 592s /usr/lib/systemd/systemd-binfmt 592s /usr/lib/systemd/systemd-boot-check-no-failures 592s /usr/lib/systemd/systemd-bsod 592s /usr/lib/systemd/systemd-cgroups-agent 592s /usr/lib/systemd/systemd-cryptsetup 592s /usr/lib/systemd/systemd-executor 592s /usr/lib/systemd/systemd-fsck 592s /usr/lib/systemd/systemd-fsckd 592s /usr/lib/systemd/systemd-growfs 592s /usr/lib/systemd/systemd-hibernate-resume 592s /usr/lib/systemd/systemd-hostnamed 592s /usr/lib/systemd/systemd-initctl 592s /usr/lib/systemd/systemd-integritysetup 592s /usr/lib/systemd/systemd-journald 592s /usr/lib/systemd/systemd-localed 592s /usr/lib/systemd/systemd-logind 592s /usr/lib/systemd/systemd-makefs 592s /usr/lib/systemd/systemd-measure 592s /usr/lib/systemd/systemd-modules-load 592s /usr/lib/systemd/systemd-network-generator 592s /usr/lib/systemd/systemd-networkd 592s /usr/lib/systemd/systemd-networkd-wait-online 592s /usr/lib/systemd/systemd-pcrextend 592s /usr/lib/systemd/systemd-pcrlock 592s /usr/lib/systemd/systemd-pstore 592s /usr/lib/systemd/systemd-quotacheck 592s /usr/lib/systemd/systemd-random-seed 592s /usr/lib/systemd/systemd-remount-fs 592s /usr/lib/systemd/systemd-reply-password 592s /usr/lib/systemd/systemd-resolved 592s /usr/lib/systemd/systemd-rfkill 592s /usr/lib/systemd/systemd-shutdown 592s /usr/lib/systemd/systemd-sleep 592s /usr/lib/systemd/systemd-socket-proxyd 592s /usr/lib/systemd/systemd-ssh-proxy 592s /usr/lib/systemd/systemd-storagetm 592s /usr/lib/systemd/systemd-sulogin-shell 592s /usr/lib/systemd/systemd-sysctl 592s /usr/lib/systemd/systemd-sysroot-fstab-check 592s /usr/lib/systemd/systemd-sysv-install 592s /usr/lib/systemd/systemd-time-wait-sync 592s /usr/lib/systemd/systemd-timedated 592s /usr/lib/systemd/systemd-timesyncd 592s /usr/lib/systemd/systemd-tpm2-setup 592s /usr/lib/systemd/systemd-udevd 592s /usr/lib/systemd/systemd-update-done 592s /usr/lib/systemd/systemd-update-utmp 592s /usr/lib/systemd/systemd-user-runtime-dir 592s /usr/lib/systemd/systemd-user-sessions 592s /usr/lib/systemd/systemd-veritysetup 592s /usr/lib/systemd/systemd-volatile-root 592s /usr/lib/systemd/systemd-xdg-autostart-condition 592s /usr/lib/systemd/systemd.orig 592s TO_REPLACE: restoring /usr/bin/killall with /usr/bin/killall.to_replace 592s /usr/bin/killall 592s /usr/bin/killall.orig 592s TO_REPLACE: restoring /usr/bin/login with /usr/bin/login.to_replace 592s /usr/bin/login 592s /usr/bin/loginctl 592s TO_REPLACE: restoring /usr/bin/ls with /usr/bin/ls.to_replace 592s /usr/bin/ls 592s /usr/bin/lsattr 592s /usr/bin/lsb_release 592s /usr/bin/lsblk 592s /usr/bin/lscpu 592s /usr/bin/lshw 592s /usr/bin/lsinitramfs 592s /usr/bin/lsipc 592s /usr/bin/lslocks 592s /usr/bin/lslogins 592s /usr/bin/lsmem 592s /usr/bin/lsmod 592s /usr/bin/lsns 592s /usr/bin/lsof 592s /usr/bin/lsof.orig 592s /usr/bin/lsof.to_replace 592s /usr/bin/lspci 592s /usr/bin/lspgpot 592s /usr/bin/lspower 592s /usr/bin/lsusb 592s TO_REPLACE: restoring /usr/bin/lsof with /usr/bin/lsof.to_replace 592s /usr/bin/lsof 592s /usr/bin/lsof.orig 592s TO_REPLACE: restoring /usr/sbin/mail with /usr/sbin/mail.to_replace 592s /usr/sbin/mail 592s TO_REPLACE: restoring /usr/sbin/mingetty with /usr/sbin/mingetty.to_replace 592s /usr/sbin/mingetty 592s TO_REPLACE: restoring /usr/bin/netstat with /usr/bin/netstat.to_replace 592s /usr/bin/netstat 592s TO_REPLACE: restoring /usr/sbin/named with /usr/sbin/named.to_replace 592s /usr/sbin/named 592s TO_REPLACE: restoring /usr/bin/passwd with /usr/bin/passwd.to_replace 592s /usr/bin/passwd 592s TO_REPLACE: restoring /usr/sbin/killall5 with /usr/sbin/killall5.to_replace 592s /usr/sbin/killall5 592s TO_REPLACE: restoring /usr/sbin/in.pop2d with /usr/sbin/in.pop2d.to_replace 592s /usr/sbin/in.pop2d 592s TO_REPLACE: restoring /usr/sbin/in.pop3d with /usr/sbin/in.pop3d.to_replace 592s /usr/sbin/in.pop3d 592s TO_REPLACE: restoring /usr/bin/ps with /usr/bin/ps.to_replace 592s /usr/bin/ps 592s /usr/bin/psfaddtable 592s /usr/bin/psfgettable 592s /usr/bin/psfstriptable 592s /usr/bin/psfxtable 592s /usr/bin/pslog 592s /usr/bin/pstree 592s /usr/bin/pstree.orig 592s /usr/bin/pstree.to_replace 592s /usr/bin/pstree.x11 592s TO_REPLACE: restoring /usr/bin/pstree with /usr/bin/pstree.to_replace 592s /usr/bin/pstree 592s /usr/bin/pstree.orig 592s /usr/bin/pstree.x11 592s TO_REPLACE: restoring /usr/sbin/rpcinfo with /usr/sbin/rpcinfo.to_replace 592s /usr/sbin/rpcinfo 592s TO_REPLACE: restoring /usr/bin/ssh with /usr/bin/ssh.to_replace 592s /usr/bin/ssh 592s /usr/bin/ssh-add 592s /usr/bin/ssh-agent 592s /usr/bin/ssh-argv0 592s /usr/bin/ssh-copy-id 592s /usr/bin/ssh-import-id 592s /usr/bin/ssh-import-id-gh 592s /usr/bin/ssh-import-id-lp 592s /usr/bin/ssh-keygen 592s /usr/bin/ssh-keyscan 592s /usr/bin/ssh.orig 592s TO_REPLACE: restoring /usr/sbin/sendmail with /usr/sbin/sendmail.to_replace 592s /usr/sbin/sendmail 592s TO_REPLACE: restoring /usr/sbin/sshd with /usr/sbin/sshd.to_replace 592s /usr/sbin/sshd 592s /usr/sbin/sshd.orig 592s TO_REPLACE: restoring /usr/sbin/syslogd with /usr/sbin/syslogd.to_replace 592s /usr/sbin/syslogd 592s TO_REPLACE: restoring /usr/bin/tar with /usr/bin/tar.to_replace 592s /usr/bin/tar 592s TO_REPLACE: restoring /usr/sbin/tcpd with /usr/sbin/tcpd.to_replace 592s /usr/sbin/tcpd 592s /usr/sbin/tcpdrop-bpfcc 592s /usr/sbin/tcpdrop.bt 592s TO_REPLACE: restoring /usr/bin/top with /usr/bin/top.to_replace 592s /usr/bin/top 592s TO_REPLACE: restoring /usr/sbin/telnetd with /usr/sbin/telnetd.to_replace 592s /usr/sbin/telnetd 592s TO_REPLACE: restoring /usr/sbin/timed with /usr/sbin/timed.to_replace 592s /usr/sbin/timed 592s TO_REPLACE: restoring /usr/sbin/traceroute with /usr/sbin/traceroute.to_replace 592s /usr/sbin/traceroute 592s TO_REPLACE: restoring /usr/bin/vdir with /usr/bin/vdir.to_replace 592s /usr/bin/vdir 592s TO_REPLACE: restoring /usr/bin/w with /usr/bin/w.to_replace 592s /usr/bin/w 592s /usr/bin/wall 592s /usr/bin/watch 592s /usr/bin/watchgnupg 592s /usr/bin/wc 592s /usr/bin/wcurl 592s /usr/bin/wdctl 592s /usr/bin/wget 592s /usr/bin/whatis 592s /usr/bin/whereis 592s /usr/bin/which 592s /usr/bin/which.debianutils 592s /usr/bin/whiptail 592s /usr/bin/who 592s /usr/bin/whoami 592s /usr/bin/wifi-status 592s /usr/bin/write 592s /usr/bin/write.orig 592s /usr/bin/write.to_replace 592s TO_REPLACE: restoring /usr/bin/write with /usr/bin/write.to_replace 592s /usr/bin/write 592s /usr/bin/write.orig 592s TO_REPLACE: restoring /usr/bin/crontab with /usr/bin/crontab.to_replace 592s /usr/bin/crontab 592s /usr/bin/crontab.orig 592s TO_DELETE: rm /usr/sbin/in.rlogind 592s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.rlogind*': No such file or directory 592s TO_DELETE: rm /usr/sbin/asp 592s /tmp/clean/ls.orig: cannot access '/usr/sbin/asp*': No such file or directory 592s TO_DELETE: rm /usr/sbin/epic 592s /tmp/clean/ls.orig: cannot access '/usr/sbin/epic*': No such file or directory 592s MOVED: replace /usr/sbin/cron with /usr/sbin/cron.orig 592s /usr/sbin/cron 592s MOVED: replace /usr/bin/crontab with /usr/bin/crontab.orig 592s /usr/bin/crontab 592s MOVED: replace /usr/sbin/hdparm with /usr/sbin/hdparm.orig 592s /usr/sbin/hdparm 592s MOVED: replace /etc/hdparm.conf with /etc/hdparm.conf.orig 593s /etc/hdparm.conf 593s MOVED: replace /usr/lib/systemd/systemd with /usr/lib/systemd/systemd.orig 593s /usr/lib/systemd/systemd 593s /usr/lib/systemd/systemd-backlight 593s /usr/lib/systemd/systemd-battery-check 593s /usr/lib/systemd/systemd-binfmt 593s /usr/lib/systemd/systemd-boot-check-no-failures 593s /usr/lib/systemd/systemd-bsod 593s /usr/lib/systemd/systemd-cgroups-agent 593s /usr/lib/systemd/systemd-cryptsetup 593s /usr/lib/systemd/systemd-executor 593s /usr/lib/systemd/systemd-fsck 593s /usr/lib/systemd/systemd-fsckd 593s /usr/lib/systemd/systemd-growfs 593s /usr/lib/systemd/systemd-hibernate-resume 593s /usr/lib/systemd/systemd-hostnamed 593s /usr/lib/systemd/systemd-initctl 593s /usr/lib/systemd/systemd-integritysetup 593s /usr/lib/systemd/systemd-journald 593s /usr/lib/systemd/systemd-localed 593s /usr/lib/systemd/systemd-logind 593s /usr/lib/systemd/systemd-makefs 593s /usr/lib/systemd/systemd-measure 593s /usr/lib/systemd/systemd-modules-load 593s /usr/lib/systemd/systemd-network-generator 593s /usr/lib/systemd/systemd-networkd 593s /usr/lib/systemd/systemd-networkd-wait-online 593s /usr/lib/systemd/systemd-pcrextend 593s /usr/lib/systemd/systemd-pcrlock 593s /usr/lib/systemd/systemd-pstore 593s /usr/lib/systemd/systemd-quotacheck 593s /usr/lib/systemd/systemd-random-seed 593s /usr/lib/systemd/systemd-remount-fs 593s /usr/lib/systemd/systemd-reply-password 593s /usr/lib/systemd/systemd-resolved 593s /usr/lib/systemd/systemd-rfkill 593s /usr/lib/systemd/systemd-shutdown 593s /usr/lib/systemd/systemd-sleep 593s /usr/lib/systemd/systemd-socket-proxyd 593s /usr/lib/systemd/systemd-ssh-proxy 593s /usr/lib/systemd/systemd-storagetm 593s /usr/lib/systemd/systemd-sulogin-shell 593s /usr/lib/systemd/systemd-sysctl 593s /usr/lib/systemd/systemd-sysroot-fstab-check 593s /usr/lib/systemd/systemd-sysv-install 593s /usr/lib/systemd/systemd-time-wait-sync 593s /usr/lib/systemd/systemd-timedated 593s /usr/lib/systemd/systemd-timesyncd 593s /usr/lib/systemd/systemd-tpm2-setup 593s /usr/lib/systemd/systemd-udevd 593s /usr/lib/systemd/systemd-update-done 593s /usr/lib/systemd/systemd-update-utmp 593s /usr/lib/systemd/systemd-user-runtime-dir 593s /usr/lib/systemd/systemd-user-sessions 593s /usr/lib/systemd/systemd-veritysetup 593s /usr/lib/systemd/systemd-volatile-root 593s /usr/lib/systemd/systemd-xdg-autostart-condition 593s MOVED: replace /usr/bin/killall with /usr/bin/killall.orig 593s /usr/bin/killall 593s MOVED: replace /usr/bin/lsof with /usr/bin/lsof.orig 593s /usr/bin/lsof 593s MOVED: replace /usr/bin/write with /usr/bin/write.orig 593s /usr/bin/write 593s MOVED: replace /usr/bin/pstree with /usr/bin/pstree.orig 593s /usr/bin/pstree 593s /usr/bin/pstree.x11 593s MOVED: replace /usr/bin/ssh with /usr/bin/ssh.orig 593s /usr/bin/ssh 593s /usr/bin/ssh-add 593s /usr/bin/ssh-agent 593s /usr/bin/ssh-argv0 593s /usr/bin/ssh-copy-id 593s /usr/bin/ssh-import-id 593s /usr/bin/ssh-import-id-gh 593s /usr/bin/ssh-import-id-lp 593s /usr/bin/ssh-keygen 593s /usr/bin/ssh-keyscan 593s MOVED: replace /usr/sbin/sshd with /usr/sbin/sshd.orig 593s /usr/sbin/sshd 593s MOVED: replace /usr/bin/tcpdump with /usr/bin/tcpdump.orig 593s /usr/bin/tcpdump 593s MADE: rm /usr/sbin/amd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/amd*': No such file or directory 593s MADE: rm /etc/amd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/amd.conf*': No such file or directory 593s MADE: rm /usr/sbin/biff 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/biff*': No such file or directory 593s MADE: rm /etc/biff.conf 593s /tmp/clean/ls.orig: cannot access '/etc/biff.conf*': No such file or directory 593s MADE: rm /etc/cron.conf 593s /tmp/clean/ls.orig: cannot access '/etc/cron.conf*': No such file or directory 593s MADE: rm /etc/crontab.conf 593s /tmp/clean/ls.orig: cannot access '/etc/crontab.conf*': No such file or directory 593s MADE: rm /usr/sbin/fingerd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/fingerd*': No such file or directory 593s MADE: rm /etc/fingerd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/fingerd.conf*': No such file or directory 593s MADE: rm /usr/sbin/in.fingerd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.fingerd*': No such file or directory 593s MADE: rm /etc/in.fingerd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/in.fingerd.conf*': No such file or directory 593s MADE: rm /usr/sbin/gpm 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/gpm*': No such file or directory 593s MADE: rm /etc/gpm.conf 593s /tmp/clean/ls.orig: cannot access '/etc/gpm.conf*': No such file or directory 593s MADE: rm /usr/sbin/inetd 593s /usr/sbin/inetdconf 593s MADE: rm /etc/inetd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/inetd.conf*': No such file or directory 593s MADE: rm /usr/sbin/in.identd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.identd*': No such file or directory 593s MADE: rm /etc/in.identd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/in.identd.conf*': No such file or directory 593s MADE: rm /usr/sbin/inetdconf 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/inetdconf*': No such file or directory 593s MADE: rm /etc/inetdconf.conf 593s /tmp/clean/ls.orig: cannot access '/etc/inetdconf.conf*': No such file or directory 593s MADE: rm /etc/init.conf 593s /tmp/clean/ls.orig: cannot access '/etc/init.conf*': No such file or directory 593s MADE: rm /etc/killall.conf 593s /tmp/clean/ls.orig: cannot access '/etc/killall.conf*': No such file or directory 593s MADE: rm /etc/lsof.conf 593s /tmp/clean/ls.orig: cannot access '/etc/lsof.conf*': No such file or directory 593s MADE: rm /usr/sbin/mail 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/mail*': No such file or directory 593s MADE: rm /etc/mail.conf 593s /tmp/clean/ls.orig: cannot access '/etc/mail.conf*': No such file or directory 593s MADE: rm /usr/sbin/mingetty 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/mingetty*': No such file or directory 593s MADE: rm /etc/mingetty.conf 593s /tmp/clean/ls.orig: cannot access '/etc/mingetty.conf*': No such file or directory 593s MADE: rm /usr/sbin/named 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/named*': No such file or directory 593s MADE: rm /etc/named.conf 593s /tmp/clean/ls.orig: cannot access '/etc/named.conf*': No such file or directory 593s MADE: rm /usr/sbin/in.pop2d 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.pop2d*': No such file or directory 593s MADE: rm /etc/in.pop2d.conf 593s /tmp/clean/ls.orig: cannot access '/etc/in.pop2d.conf*': No such file or directory 593s MADE: rm /usr/sbin/in.pop3d 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.pop3d*': No such file or directory 593s MADE: rm /etc/in.pop3d.conf 593s /tmp/clean/ls.orig: cannot access '/etc/in.pop3d.conf*': No such file or directory 593s MADE: rm /etc/write.conf 593s /tmp/clean/ls.orig: cannot access '/etc/write.conf*': No such file or directory 593s MADE: rm /etc/pstree.conf 593s /tmp/clean/ls.orig: cannot access '/etc/pstree.conf*': No such file or directory 593s MADE: rm /usr/sbin/rpcinfo 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/rpcinfo*': No such file or directory 593s MADE: rm /etc/rpcinfo.conf 593s /tmp/clean/ls.orig: cannot access '/etc/rpcinfo.conf*': No such file or directory 593s MADE: rm /usr/sbin/rlogind 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/rlogind*': No such file or directory 593s MADE: rm /etc/rlogind.conf 593s /tmp/clean/ls.orig: cannot access '/etc/rlogind.conf*': No such file or directory 593s MADE: rm /usr/sbin/in.rshd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.rshd*': No such file or directory 593s MADE: rm /etc/in.rshd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/in.rshd.conf*': No such file or directory 593s MADE: rm /etc/slogin.conf 593s /tmp/clean/ls.orig: cannot access '/etc/slogin.conf*': No such file or directory 593s MADE: rm /usr/sbin/sendmail 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/sendmail*': No such file or directory 593s MADE: rm /etc/sendmail.conf 593s /tmp/clean/ls.orig: cannot access '/etc/sendmail.conf*': No such file or directory 593s MADE: rm /etc/sshd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/sshd.conf*': No such file or directory 593s MADE: rm /usr/sbin/syslogd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/syslogd*': No such file or directory 593s MADE: rm /etc/syslogd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/syslogd.conf*': No such file or directory 593s MADE: rm /usr/sbin/tcpd 593s /usr/sbin/tcpdrop-bpfcc 593s /usr/sbin/tcpdrop.bt 593s MADE: rm /etc/tcpd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/tcpd.conf*': No such file or directory 593s MADE: rm /etc/tcpdump.conf 593s /tmp/clean/ls.orig: cannot access '/etc/tcpdump.conf*': No such file or directory 593s MADE: rm /usr/sbin/telnetd 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/telnetd*': No such file or directory 593s MADE: rm /etc/telnetd.conf 593s /tmp/clean/ls.orig: cannot access '/etc/telnetd.conf*': No such file or directory 593s MADE: rm /usr/sbin/timed 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/timed*': No such file or directory 593s MADE: rm /etc/timed.conf 593s /tmp/clean/ls.orig: cannot access '/etc/timed.conf*': No such file or directory 593s MADE: rm /usr/sbin/traceroute 593s /tmp/clean/ls.orig: cannot access '/usr/sbin/traceroute*': No such file or directory 593s MADE: rm /etc/traceroute.conf 593s /tmp/clean/ls.orig: cannot access '/etc/traceroute.conf*': No such file or directory 593s done 593s * Closing down the testsuite 593s Restoring /etc/chkrootkit/chkrootkit.conf from /etc/chkrootkit/chkrootkit.conf.orig 593s Restoring /etc/chkrootkit/chkrootkit.ignore from /etc/chkrootkit/chkrootkit.ignore.orig 593s DONE 593s * test-chkrootkit: FAIL 593s autopkgtest [20:49:19]: test test-chkrootkit: -----------------------] 594s test-chkrootkit FAIL non-zero exit status 1 594s autopkgtest [20:49:20]: test test-chkrootkit: - - - - - - - - - - results - - - - - - - - - - 594s autopkgtest [20:49:20]: test test-chkrootkit: - - - - - - - - - - stderr - - - - - - - - - - 594s cat: /etc/chkrootkit/chkrootkit.conf: No such file or directory 594s autopkgtest [20:49:20]: @@@@@@@@@@@@@@@@@@@@ summary 594s test-chkrootkit FAIL non-zero exit status 1 606s nova [W] Skipping flock for amd64 606s Creating nova instance adt-plucky-amd64-chkrootkit-20241126-203926-juju-7f2275-prod-proposed-migration-environment-20-e67a09b1-db68-44aa-94a0-edb0d6be0246 from image adt/ubuntu-plucky-amd64-server-20241119.img (UUID 2e5306de-7efa-448c-bc27-5518979e66f0)...