0s autopkgtest [20:39:56]: starting date and time: 2024-11-26 20:39:56+0000 0s autopkgtest [20:39:56]: git checkout: 6f3be7a8 Fix armhf LXD image generation for plucky 0s autopkgtest [20:39:56]: host juju-7f2275-prod-proposed-migration-environment-20; command line: /home/ubuntu/autopkgtest/runner/autopkgtest --output-dir /tmp/autopkgtest-work.ksa1rsd6/out --timeout-copy=6000 --setup-commands /home/ubuntu/autopkgtest-cloud/worker-config-production/setup-canonical.sh --apt-pocket=proposed=src:binutils,src:python-apt --apt-upgrade chkrootkit --timeout-short=300 --timeout-copy=20000 --timeout-build=20000 '--env=ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1' -- ssh -s /home/ubuntu/autopkgtest/ssh-setup/nova -- --flavor autopkgtest-s390x --security-groups autopkgtest-juju-7f2275-prod-proposed-migration-environment-20@bos03-s390x-15.secgroup --name adt-plucky-s390x-chkrootkit-20241126-203956-juju-7f2275-prod-proposed-migration-environment-20-c624da37-0333-4ae6-b9ef-9ed83db64919 --image adt/ubuntu-plucky-s390x-server --keyname testbed-juju-7f2275-prod-proposed-migration-environment-20 --net-id=net_prod-proposed-migration-s390x -e TERM=linux -e ''"'"'http_proxy=http://squid.internal:3128'"'"'' -e ''"'"'https_proxy=http://squid.internal:3128'"'"'' -e ''"'"'no_proxy=127.0.0.1,127.0.1.1,login.ubuntu.com,localhost,localdomain,novalocal,internal,archive.ubuntu.com,ports.ubuntu.com,security.ubuntu.com,ddebs.ubuntu.com,changelogs.ubuntu.com,keyserver.ubuntu.com,launchpadlibrarian.net,launchpadcontent.net,launchpad.net,10.24.0.0/24,keystone.ps5.canonical.com,objectstorage.prodstack5.canonical.com'"'"'' --mirror=http://ftpmaster.internal/ubuntu/ 113s autopkgtest [20:41:49]: testbed dpkg architecture: s390x 113s autopkgtest [20:41:49]: testbed apt version: 2.9.8 113s autopkgtest [20:41:49]: @@@@@@@@@@@@@@@@@@@@ test bed setup 114s Get:1 http://ftpmaster.internal/ubuntu plucky-proposed InRelease [73.9 kB] 114s Get:2 http://ftpmaster.internal/ubuntu plucky-proposed/main Sources [54.5 kB] 115s Get:3 http://ftpmaster.internal/ubuntu plucky-proposed/multiverse Sources [14.1 kB] 115s Get:4 http://ftpmaster.internal/ubuntu plucky-proposed/universe Sources [821 kB] 115s Get:5 http://ftpmaster.internal/ubuntu plucky-proposed/restricted Sources [9708 B] 115s Get:6 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x Packages [75.6 kB] 115s Get:7 http://ftpmaster.internal/ubuntu plucky-proposed/restricted s390x Packages [928 B] 115s Get:8 http://ftpmaster.internal/ubuntu plucky-proposed/universe s390x Packages [612 kB] 115s Get:9 http://ftpmaster.internal/ubuntu plucky-proposed/multiverse s390x Packages [6944 B] 115s Fetched 1669 kB in 1s (1968 kB/s) 115s Reading package lists... 117s Reading package lists... 117s Building dependency tree... 117s Reading state information... 117s Calculating upgrade... 118s The following package was automatically installed and is no longer required: 118s libsgutils2-1.46-2 118s Use 'sudo apt autoremove' to remove it. 118s The following NEW packages will be installed: 118s appstream cloud-init-base gir1.2-packagekitglib-1.0 libappstream5 118s libduktape207 libglib2.0-bin libgstreamer1.0-0 libpackagekit-glib2-18 118s libsgutils2-1.48 libstemmer0d packagekit packagekit-tools polkitd 118s python3-distro-info python3-software-properties sgml-base 118s software-properties-common unattended-upgrades xml-core 118s The following packages will be upgraded: 118s apt apt-utils bash binutils binutils-common binutils-s390x-linux-gnu 118s bpftrace cloud-init curl debconf debconf-i18n distro-info dracut-install 118s gir1.2-girepository-2.0 gir1.2-glib-2.0 hostname init init-system-helpers 118s libapt-pkg6.0t64 libaudit-common libaudit1 libbinutils libctf-nobfd0 libctf0 118s libcurl3t64-gnutls libcurl4t64 libgirepository-1.0-1 libglib2.0-0t64 118s libglib2.0-data liblzma5 libpam-modules libpam-modules-bin libpam-runtime 118s libpam0g libperl5.40 libplymouth5 libpolkit-agent-1-0 libpolkit-gobject-1-0 118s libselinux1 libsemanage-common libsemanage2 libsframe1 linux-base 118s lto-disabled-list lxd-installer openssh-client openssh-server 118s openssh-sftp-server perl perl-base perl-modules-5.40 pinentry-curses 118s plymouth plymouth-theme-ubuntu-text python-apt-common python3-apt 118s python3-blinker python3-debconf python3-jsonschema-specifications 118s python3-rpds-py python3-yaml sg3-utils sg3-utils-udev 118s ubuntu-kernel-accessories ubuntu-minimal ubuntu-standard vim-common vim-tiny 118s wget xxd xz-utils 118s 71 upgraded, 19 newly installed, 0 to remove and 0 not upgraded. 118s Need to get 32.3 MB of archives. 118s After this operation, 13.0 MB of additional disk space will be used. 118s Get:1 http://ftpmaster.internal/ubuntu plucky/main s390x bash s390x 5.2.32-1ubuntu2 [845 kB] 118s Get:2 http://ftpmaster.internal/ubuntu plucky/main s390x hostname s390x 3.25 [11.2 kB] 118s Get:3 http://ftpmaster.internal/ubuntu plucky/main s390x libperl5.40 s390x 5.40.0-8 [4986 kB] 118s Get:4 http://ftpmaster.internal/ubuntu plucky/main s390x perl s390x 5.40.0-8 [262 kB] 118s Get:5 http://ftpmaster.internal/ubuntu plucky/main s390x perl-base s390x 5.40.0-8 [1971 kB] 119s Get:6 http://ftpmaster.internal/ubuntu plucky/main s390x perl-modules-5.40 all 5.40.0-8 [3214 kB] 119s Get:7 http://ftpmaster.internal/ubuntu plucky/main s390x init-system-helpers all 1.67ubuntu1 [39.1 kB] 119s Get:8 http://ftpmaster.internal/ubuntu plucky/main s390x liblzma5 s390x 5.6.3-1 [145 kB] 119s Get:9 http://ftpmaster.internal/ubuntu plucky/main s390x libapt-pkg6.0t64 s390x 2.9.14ubuntu1 [1091 kB] 119s Get:10 http://ftpmaster.internal/ubuntu plucky/main s390x apt s390x 2.9.14ubuntu1 [1375 kB] 119s Get:11 http://ftpmaster.internal/ubuntu plucky/main s390x apt-utils s390x 2.9.14ubuntu1 [215 kB] 119s Get:12 http://ftpmaster.internal/ubuntu plucky/main s390x libaudit-common all 1:4.0.2-2ubuntu1 [6578 B] 119s Get:13 http://ftpmaster.internal/ubuntu plucky/main s390x libaudit1 s390x 1:4.0.2-2ubuntu1 [52.5 kB] 119s Get:14 http://ftpmaster.internal/ubuntu plucky/main s390x debconf-i18n all 1.5.87ubuntu1 [204 kB] 119s Get:15 http://ftpmaster.internal/ubuntu plucky/main s390x python3-debconf all 1.5.87ubuntu1 [4156 B] 119s Get:16 http://ftpmaster.internal/ubuntu plucky/main s390x debconf all 1.5.87ubuntu1 [124 kB] 119s Get:17 http://ftpmaster.internal/ubuntu plucky/main s390x libpam0g s390x 1.5.3-7ubuntu4 [70.0 kB] 119s Get:18 http://ftpmaster.internal/ubuntu plucky/main s390x libselinux1 s390x 3.7-3ubuntu1 [85.2 kB] 119s Get:19 http://ftpmaster.internal/ubuntu plucky/main s390x libpam-modules-bin s390x 1.5.3-7ubuntu4 [56.2 kB] 119s Get:20 http://ftpmaster.internal/ubuntu plucky/main s390x libpam-modules s390x 1.5.3-7ubuntu4 [294 kB] 119s Get:21 http://ftpmaster.internal/ubuntu plucky/main s390x init s390x 1.67ubuntu1 [6428 B] 119s Get:22 http://ftpmaster.internal/ubuntu plucky/main s390x openssh-sftp-server s390x 1:9.9p1-3ubuntu2 [38.2 kB] 119s Get:23 http://ftpmaster.internal/ubuntu plucky/main s390x openssh-server s390x 1:9.9p1-3ubuntu2 [552 kB] 119s Get:24 http://ftpmaster.internal/ubuntu plucky/main s390x openssh-client s390x 1:9.9p1-3ubuntu2 [955 kB] 119s Get:25 http://ftpmaster.internal/ubuntu plucky/main s390x libpam-runtime all 1.5.3-7ubuntu4 [40.8 kB] 119s Get:26 http://ftpmaster.internal/ubuntu plucky/main s390x sgml-base all 1.31 [11.4 kB] 119s Get:27 http://ftpmaster.internal/ubuntu plucky/main s390x libsemanage-common all 3.7-2build1 [7186 B] 119s Get:28 http://ftpmaster.internal/ubuntu plucky/main s390x libsemanage2 s390x 3.7-2build1 [97.1 kB] 119s Get:29 http://ftpmaster.internal/ubuntu plucky/main s390x distro-info s390x 1.12 [20.0 kB] 119s Get:30 http://ftpmaster.internal/ubuntu plucky/main s390x gir1.2-girepository-2.0 s390x 1.82.0-2 [25.0 kB] 119s Get:31 http://ftpmaster.internal/ubuntu plucky/main s390x gir1.2-glib-2.0 s390x 2.82.2-3 [180 kB] 119s Get:32 http://ftpmaster.internal/ubuntu plucky/main s390x libglib2.0-0t64 s390x 2.82.2-3 [1575 kB] 119s Get:33 http://ftpmaster.internal/ubuntu plucky/main s390x libgirepository-1.0-1 s390x 1.82.0-2 [84.9 kB] 119s Get:34 http://ftpmaster.internal/ubuntu plucky/main s390x libglib2.0-data all 2.82.2-3 [51.7 kB] 119s Get:35 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x python-apt-common all 2.9.1 [20.5 kB] 119s Get:36 http://ftpmaster.internal/ubuntu plucky/main s390x python3-apt s390x 2.9.0ubuntu2 [185 kB] 119s Get:37 http://ftpmaster.internal/ubuntu plucky/main s390x python3-yaml s390x 6.0.2-1build1 [188 kB] 119s Get:38 http://ftpmaster.internal/ubuntu plucky/main s390x vim-tiny s390x 2:9.1.0861-1ubuntu1 [664 kB] 119s Get:39 http://ftpmaster.internal/ubuntu plucky/main s390x vim-common all 2:9.1.0861-1ubuntu1 [395 kB] 119s Get:40 http://ftpmaster.internal/ubuntu plucky/main s390x ubuntu-minimal s390x 1.544 [11.3 kB] 119s Get:41 http://ftpmaster.internal/ubuntu plucky/main s390x xxd s390x 2:9.1.0861-1ubuntu1 [66.6 kB] 119s Get:42 http://ftpmaster.internal/ubuntu plucky/main s390x libplymouth5 s390x 24.004.60-2ubuntu4 [150 kB] 119s Get:43 http://ftpmaster.internal/ubuntu plucky/main s390x plymouth-theme-ubuntu-text s390x 24.004.60-2ubuntu4 [10.1 kB] 119s Get:44 http://ftpmaster.internal/ubuntu plucky/main s390x plymouth s390x 24.004.60-2ubuntu4 [144 kB] 119s Get:45 http://ftpmaster.internal/ubuntu plucky/main s390x python3-distro-info all 1.12 [7754 B] 119s Get:46 http://ftpmaster.internal/ubuntu plucky/main s390x wget s390x 1.24.5-2ubuntu1 [369 kB] 119s Get:47 http://ftpmaster.internal/ubuntu plucky/main s390x xz-utils s390x 5.6.3-1 [273 kB] 119s Get:48 http://ftpmaster.internal/ubuntu plucky/main s390x ubuntu-standard s390x 1.544 [11.3 kB] 119s Get:49 http://ftpmaster.internal/ubuntu plucky/main s390x libcurl3t64-gnutls s390x 8.11.0-1ubuntu2 [386 kB] 119s Get:50 http://ftpmaster.internal/ubuntu plucky/main s390x libstemmer0d s390x 2.2.0-4build1 [174 kB] 119s Get:51 http://ftpmaster.internal/ubuntu plucky/main s390x libappstream5 s390x 1.0.3-1 [238 kB] 119s Get:52 http://ftpmaster.internal/ubuntu plucky/main s390x appstream s390x 1.0.3-1 [69.2 kB] 119s Get:53 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x libctf0 s390x 2.43.50.20241126-2ubuntu1 [101 kB] 119s Get:54 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x libctf-nobfd0 s390x 2.43.50.20241126-2ubuntu1 [101 kB] 119s Get:55 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x binutils-s390x-linux-gnu s390x 2.43.50.20241126-2ubuntu1 [2304 kB] 119s Get:56 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x libbinutils s390x 2.43.50.20241126-2ubuntu1 [481 kB] 120s Get:57 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x binutils s390x 2.43.50.20241126-2ubuntu1 [3066 B] 120s Get:58 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x binutils-common s390x 2.43.50.20241126-2ubuntu1 [222 kB] 120s Get:59 http://ftpmaster.internal/ubuntu plucky-proposed/main s390x libsframe1 s390x 2.43.50.20241126-2ubuntu1 [13.9 kB] 120s Get:60 http://ftpmaster.internal/ubuntu plucky/main s390x bpftrace s390x 0.21.2-2ubuntu3 [1718 kB] 120s Get:61 http://ftpmaster.internal/ubuntu plucky/main s390x cloud-init all 24.4-0ubuntu1 [2088 B] 120s Get:62 http://ftpmaster.internal/ubuntu plucky/main s390x cloud-init-base all 24.4-0ubuntu1 [612 kB] 120s Get:63 http://ftpmaster.internal/ubuntu plucky/main s390x curl s390x 8.11.0-1ubuntu2 [249 kB] 120s Get:64 http://ftpmaster.internal/ubuntu plucky/main s390x libcurl4t64 s390x 8.11.0-1ubuntu2 [390 kB] 120s Get:65 http://ftpmaster.internal/ubuntu plucky/main s390x dracut-install s390x 105-2ubuntu3 [36.0 kB] 120s Get:66 http://ftpmaster.internal/ubuntu plucky/main s390x libpackagekit-glib2-18 s390x 1.3.0-2 [117 kB] 120s Get:67 http://ftpmaster.internal/ubuntu plucky/main s390x gir1.2-packagekitglib-1.0 s390x 1.3.0-2 [25.2 kB] 120s Get:68 http://ftpmaster.internal/ubuntu plucky/main s390x libduktape207 s390x 2.7.0+tests-0ubuntu3 [150 kB] 120s Get:69 http://ftpmaster.internal/ubuntu plucky/main s390x libglib2.0-bin s390x 2.82.2-3 [99.3 kB] 120s Get:70 http://ftpmaster.internal/ubuntu plucky/main s390x libgstreamer1.0-0 s390x 1.24.9-1 [1213 kB] 120s Get:71 http://ftpmaster.internal/ubuntu plucky/main s390x libpolkit-agent-1-0 s390x 125-2ubuntu1 [17.3 kB] 120s Get:72 http://ftpmaster.internal/ubuntu plucky/main s390x libpolkit-gobject-1-0 s390x 125-2ubuntu1 [48.4 kB] 120s Get:73 http://ftpmaster.internal/ubuntu plucky/main s390x libsgutils2-1.48 s390x 1.48-0ubuntu1 [120 kB] 120s Get:74 http://ftpmaster.internal/ubuntu plucky/main s390x linux-base all 4.10.1ubuntu1 [34.8 kB] 120s Get:75 http://ftpmaster.internal/ubuntu plucky/main s390x lto-disabled-list all 54 [12.2 kB] 120s Get:76 http://ftpmaster.internal/ubuntu plucky/main s390x lxd-installer all 10 [5264 B] 120s Get:77 http://ftpmaster.internal/ubuntu plucky/main s390x xml-core all 0.19 [20.3 kB] 120s Get:78 http://ftpmaster.internal/ubuntu plucky/main s390x polkitd s390x 125-2ubuntu1 [96.1 kB] 120s Get:79 http://ftpmaster.internal/ubuntu plucky/main s390x packagekit s390x 1.3.0-2 [448 kB] 120s Get:80 http://ftpmaster.internal/ubuntu plucky/main s390x packagekit-tools s390x 1.3.0-2 [28.2 kB] 120s Get:81 http://ftpmaster.internal/ubuntu plucky/main s390x pinentry-curses s390x 1.3.1-0ubuntu2 [42.3 kB] 120s Get:82 http://ftpmaster.internal/ubuntu plucky/main s390x python3-blinker all 1.9.0-1 [10.7 kB] 120s Get:83 http://ftpmaster.internal/ubuntu plucky/main s390x python3-rpds-py s390x 0.21.0-2ubuntu1 [368 kB] 120s Get:84 http://ftpmaster.internal/ubuntu plucky/main s390x python3-jsonschema-specifications all 2023.12.1-2 [9116 B] 120s Get:85 http://ftpmaster.internal/ubuntu plucky/main s390x python3-software-properties all 0.105 [30.3 kB] 120s Get:86 http://ftpmaster.internal/ubuntu plucky/main s390x sg3-utils s390x 1.48-0ubuntu1 [1027 kB] 120s Get:87 http://ftpmaster.internal/ubuntu plucky/main s390x sg3-utils-udev all 1.48-0ubuntu1 [6608 B] 120s Get:88 http://ftpmaster.internal/ubuntu plucky/main s390x software-properties-common all 0.105 [16.5 kB] 120s Get:89 http://ftpmaster.internal/ubuntu plucky/main s390x ubuntu-kernel-accessories s390x 1.544 [11.0 kB] 120s Get:90 http://ftpmaster.internal/ubuntu plucky/main s390x unattended-upgrades all 2.9.1+nmu4ubuntu1 [51.2 kB] 120s Preconfiguring packages ... 120s Fetched 32.3 MB in 2s (13.3 MB/s) 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../bash_5.2.32-1ubuntu2_s390x.deb ... 121s Unpacking bash (5.2.32-1ubuntu2) over (5.2.32-1ubuntu1) ... 121s Setting up bash (5.2.32-1ubuntu2) ... 121s update-alternatives: using /usr/share/man/man7/bash-builtins.7.gz to provide /usr/share/man/man7/builtins.7.gz (builtins.7.gz) in auto mode 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../hostname_3.25_s390x.deb ... 121s Unpacking hostname (3.25) over (3.23+nmu2ubuntu2) ... 121s Setting up hostname (3.25) ... 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../libperl5.40_5.40.0-8_s390x.deb ... 121s Unpacking libperl5.40:s390x (5.40.0-8) over (5.40.0-7) ... 121s Preparing to unpack .../perl_5.40.0-8_s390x.deb ... 121s Unpacking perl (5.40.0-8) over (5.40.0-7) ... 121s Preparing to unpack .../perl-base_5.40.0-8_s390x.deb ... 121s Unpacking perl-base (5.40.0-8) over (5.40.0-7) ... 121s Setting up perl-base (5.40.0-8) ... 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../perl-modules-5.40_5.40.0-8_all.deb ... 121s Unpacking perl-modules-5.40 (5.40.0-8) over (5.40.0-7) ... 121s Preparing to unpack .../init-system-helpers_1.67ubuntu1_all.deb ... 121s Unpacking init-system-helpers (1.67ubuntu1) over (1.66ubuntu1) ... 121s Setting up init-system-helpers (1.67ubuntu1) ... 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../liblzma5_5.6.3-1_s390x.deb ... 121s Unpacking liblzma5:s390x (5.6.3-1) over (5.6.2-2) ... 121s Setting up liblzma5:s390x (5.6.3-1) ... 121s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 121s Preparing to unpack .../libapt-pkg6.0t64_2.9.14ubuntu1_s390x.deb ... 121s Unpacking libapt-pkg6.0t64:s390x (2.9.14ubuntu1) over (2.9.8) ... 122s Setting up libapt-pkg6.0t64:s390x (2.9.14ubuntu1) ... 122s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55541 files and directories currently installed.) 122s Preparing to unpack .../apt_2.9.14ubuntu1_s390x.deb ... 122s Unpacking apt (2.9.14ubuntu1) over (2.9.8) ... 122s Setting up apt (2.9.14ubuntu1) ... 122s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 122s Preparing to unpack .../apt-utils_2.9.14ubuntu1_s390x.deb ... 122s Unpacking apt-utils (2.9.14ubuntu1) over (2.9.8) ... 122s Preparing to unpack .../libaudit-common_1%3a4.0.2-2ubuntu1_all.deb ... 122s Unpacking libaudit-common (1:4.0.2-2ubuntu1) over (1:4.0.1-1ubuntu2) ... 122s Setting up libaudit-common (1:4.0.2-2ubuntu1) ... 122s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 122s Preparing to unpack .../libaudit1_1%3a4.0.2-2ubuntu1_s390x.deb ... 122s Unpacking libaudit1:s390x (1:4.0.2-2ubuntu1) over (1:4.0.1-1ubuntu2) ... 122s Setting up libaudit1:s390x (1:4.0.2-2ubuntu1) ... 122s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 122s Preparing to unpack .../debconf-i18n_1.5.87ubuntu1_all.deb ... 122s Unpacking debconf-i18n (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 122s Preparing to unpack .../python3-debconf_1.5.87ubuntu1_all.deb ... 122s Unpacking python3-debconf (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 122s Preparing to unpack .../debconf_1.5.87ubuntu1_all.deb ... 122s Unpacking debconf (1.5.87ubuntu1) over (1.5.86ubuntu1) ... 122s Setting up debconf (1.5.87ubuntu1) ... 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 123s Preparing to unpack .../libpam0g_1.5.3-7ubuntu4_s390x.deb ... 123s Unpacking libpam0g:s390x (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 123s Setting up libpam0g:s390x (1.5.3-7ubuntu4) ... 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 123s Preparing to unpack .../libselinux1_3.7-3ubuntu1_s390x.deb ... 123s Unpacking libselinux1:s390x (3.7-3ubuntu1) over (3.5-2ubuntu5) ... 123s Setting up libselinux1:s390x (3.7-3ubuntu1) ... 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 123s Preparing to unpack .../libpam-modules-bin_1.5.3-7ubuntu4_s390x.deb ... 123s Unpacking libpam-modules-bin (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 123s Setting up libpam-modules-bin (1.5.3-7ubuntu4) ... 123s pam_namespace.service is a disabled or a static unit not running, not starting it. 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 123s Preparing to unpack .../libpam-modules_1.5.3-7ubuntu4_s390x.deb ... 123s Unpacking libpam-modules:s390x (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 123s Setting up libpam-modules:s390x (1.5.3-7ubuntu4) ... 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55533 files and directories currently installed.) 123s Preparing to unpack .../init_1.67ubuntu1_s390x.deb ... 123s Unpacking init (1.67ubuntu1) over (1.66ubuntu1) ... 123s Preparing to unpack .../openssh-sftp-server_1%3a9.9p1-3ubuntu2_s390x.deb ... 123s Unpacking openssh-sftp-server (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 123s Preparing to unpack .../openssh-server_1%3a9.9p1-3ubuntu2_s390x.deb ... 123s Unpacking openssh-server (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 123s Preparing to unpack .../openssh-client_1%3a9.9p1-3ubuntu2_s390x.deb ... 123s Unpacking openssh-client (1:9.9p1-3ubuntu2) over (1:9.7p1-7ubuntu5) ... 123s Preparing to unpack .../libpam-runtime_1.5.3-7ubuntu4_all.deb ... 123s Unpacking libpam-runtime (1.5.3-7ubuntu4) over (1.5.3-7ubuntu2) ... 123s Setting up libpam-runtime (1.5.3-7ubuntu4) ... 123s Selecting previously unselected package sgml-base. 123s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55535 files and directories currently installed.) 123s Preparing to unpack .../sgml-base_1.31_all.deb ... 123s Unpacking sgml-base (1.31) ... 124s Preparing to unpack .../libsemanage-common_3.7-2build1_all.deb ... 124s Unpacking libsemanage-common (3.7-2build1) over (3.5-1build6) ... 124s Setting up libsemanage-common (3.7-2build1) ... 124s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55561 files and directories currently installed.) 124s Preparing to unpack .../libsemanage2_3.7-2build1_s390x.deb ... 124s Unpacking libsemanage2:s390x (3.7-2build1) over (3.5-1build6) ... 124s Setting up libsemanage2:s390x (3.7-2build1) ... 124s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55561 files and directories currently installed.) 124s Preparing to unpack .../00-distro-info_1.12_s390x.deb ... 124s Unpacking distro-info (1.12) over (1.9) ... 124s Preparing to unpack .../01-gir1.2-girepository-2.0_1.82.0-2_s390x.deb ... 124s Unpacking gir1.2-girepository-2.0:s390x (1.82.0-2) over (1.80.1-4) ... 124s Preparing to unpack .../02-gir1.2-glib-2.0_2.82.2-3_s390x.deb ... 124s Unpacking gir1.2-glib-2.0:s390x (2.82.2-3) over (2.82.1-0ubuntu1) ... 124s Preparing to unpack .../03-libglib2.0-0t64_2.82.2-3_s390x.deb ... 124s Unpacking libglib2.0-0t64:s390x (2.82.2-3) over (2.82.1-0ubuntu1) ... 124s Preparing to unpack .../04-libgirepository-1.0-1_1.82.0-2_s390x.deb ... 124s Unpacking libgirepository-1.0-1:s390x (1.82.0-2) over (1.80.1-4) ... 124s Preparing to unpack .../05-libglib2.0-data_2.82.2-3_all.deb ... 124s Unpacking libglib2.0-data (2.82.2-3) over (2.82.1-0ubuntu1) ... 124s Preparing to unpack .../06-python-apt-common_2.9.1_all.deb ... 124s Unpacking python-apt-common (2.9.1) over (2.9.0ubuntu1) ... 124s Preparing to unpack .../07-python3-apt_2.9.0ubuntu2_s390x.deb ... 124s Unpacking python3-apt (2.9.0ubuntu2) over (2.9.0ubuntu1) ... 124s Preparing to unpack .../08-python3-yaml_6.0.2-1build1_s390x.deb ... 124s Unpacking python3-yaml (6.0.2-1build1) over (6.0.2-1) ... 124s Preparing to unpack .../09-vim-tiny_2%3a9.1.0861-1ubuntu1_s390x.deb ... 124s Unpacking vim-tiny (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 124s Preparing to unpack .../10-vim-common_2%3a9.1.0861-1ubuntu1_all.deb ... 124s Unpacking vim-common (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 124s Preparing to unpack .../11-ubuntu-minimal_1.544_s390x.deb ... 124s Unpacking ubuntu-minimal (1.544) over (1.543) ... 124s Preparing to unpack .../12-xxd_2%3a9.1.0861-1ubuntu1_s390x.deb ... 124s Unpacking xxd (2:9.1.0861-1ubuntu1) over (2:9.1.0777-1ubuntu1) ... 124s Preparing to unpack .../13-libplymouth5_24.004.60-2ubuntu4_s390x.deb ... 124s Unpacking libplymouth5:s390x (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 124s Preparing to unpack .../14-plymouth-theme-ubuntu-text_24.004.60-2ubuntu4_s390x.deb ... 124s Unpacking plymouth-theme-ubuntu-text (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 124s Preparing to unpack .../15-plymouth_24.004.60-2ubuntu4_s390x.deb ... 124s Unpacking plymouth (24.004.60-2ubuntu4) over (24.004.60-1ubuntu11) ... 124s Selecting previously unselected package python3-distro-info. 124s Preparing to unpack .../16-python3-distro-info_1.12_all.deb ... 124s Unpacking python3-distro-info (1.12) ... 124s Preparing to unpack .../17-wget_1.24.5-2ubuntu1_s390x.deb ... 124s Unpacking wget (1.24.5-2ubuntu1) over (1.24.5-1ubuntu2) ... 124s Preparing to unpack .../18-xz-utils_5.6.3-1_s390x.deb ... 124s Unpacking xz-utils (5.6.3-1) over (5.6.2-2) ... 124s Preparing to unpack .../19-ubuntu-standard_1.544_s390x.deb ... 124s Unpacking ubuntu-standard (1.544) over (1.543) ... 124s Preparing to unpack .../20-libcurl3t64-gnutls_8.11.0-1ubuntu2_s390x.deb ... 124s Unpacking libcurl3t64-gnutls:s390x (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 124s Selecting previously unselected package libstemmer0d:s390x. 124s Preparing to unpack .../21-libstemmer0d_2.2.0-4build1_s390x.deb ... 124s Unpacking libstemmer0d:s390x (2.2.0-4build1) ... 124s Selecting previously unselected package libappstream5:s390x. 124s Preparing to unpack .../22-libappstream5_1.0.3-1_s390x.deb ... 124s Unpacking libappstream5:s390x (1.0.3-1) ... 124s Selecting previously unselected package appstream. 124s Preparing to unpack .../23-appstream_1.0.3-1_s390x.deb ... 124s Unpacking appstream (1.0.3-1) ... 124s Preparing to unpack .../24-libctf0_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking libctf0:s390x (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../25-libctf-nobfd0_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking libctf-nobfd0:s390x (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../26-binutils-s390x-linux-gnu_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking binutils-s390x-linux-gnu (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../27-libbinutils_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking libbinutils:s390x (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../28-binutils_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking binutils (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../29-binutils-common_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking binutils-common:s390x (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../30-libsframe1_2.43.50.20241126-2ubuntu1_s390x.deb ... 124s Unpacking libsframe1:s390x (2.43.50.20241126-2ubuntu1) over (2.43.1-4ubuntu1) ... 124s Preparing to unpack .../31-bpftrace_0.21.2-2ubuntu3_s390x.deb ... 124s Unpacking bpftrace (0.21.2-2ubuntu3) over (0.21.2-2ubuntu2) ... 124s Preparing to unpack .../32-cloud-init_24.4-0ubuntu1_all.deb ... 125s Unpacking cloud-init (24.4-0ubuntu1) over (24.4~3+really24.3.1-0ubuntu4) ... 125s dpkg: warning: unable to delete old directory '/etc/cloud/templates': Directory not empty 125s dpkg: warning: unable to delete old directory '/etc/cloud/cloud.cfg.d': Directory not empty 125s dpkg: warning: unable to delete old directory '/etc/cloud': Directory not empty 125s Selecting previously unselected package cloud-init-base. 125s Preparing to unpack .../33-cloud-init-base_24.4-0ubuntu1_all.deb ... 125s Unpacking cloud-init-base (24.4-0ubuntu1) ... 125s Preparing to unpack .../34-curl_8.11.0-1ubuntu2_s390x.deb ... 125s Unpacking curl (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 125s Preparing to unpack .../35-libcurl4t64_8.11.0-1ubuntu2_s390x.deb ... 125s Unpacking libcurl4t64:s390x (8.11.0-1ubuntu2) over (8.9.1-2ubuntu2) ... 125s Preparing to unpack .../36-dracut-install_105-2ubuntu3_s390x.deb ... 125s Unpacking dracut-install (105-2ubuntu3) over (105-1ubuntu1) ... 125s Selecting previously unselected package libpackagekit-glib2-18:s390x. 125s Preparing to unpack .../37-libpackagekit-glib2-18_1.3.0-2_s390x.deb ... 125s Unpacking libpackagekit-glib2-18:s390x (1.3.0-2) ... 125s Selecting previously unselected package gir1.2-packagekitglib-1.0. 125s Preparing to unpack .../38-gir1.2-packagekitglib-1.0_1.3.0-2_s390x.deb ... 125s Unpacking gir1.2-packagekitglib-1.0 (1.3.0-2) ... 125s Selecting previously unselected package libduktape207:s390x. 125s Preparing to unpack .../39-libduktape207_2.7.0+tests-0ubuntu3_s390x.deb ... 125s Unpacking libduktape207:s390x (2.7.0+tests-0ubuntu3) ... 125s Selecting previously unselected package libglib2.0-bin. 125s Preparing to unpack .../40-libglib2.0-bin_2.82.2-3_s390x.deb ... 125s Unpacking libglib2.0-bin (2.82.2-3) ... 125s Selecting previously unselected package libgstreamer1.0-0:s390x. 125s Preparing to unpack .../41-libgstreamer1.0-0_1.24.9-1_s390x.deb ... 125s Unpacking libgstreamer1.0-0:s390x (1.24.9-1) ... 125s Preparing to unpack .../42-libpolkit-agent-1-0_125-2ubuntu1_s390x.deb ... 125s Unpacking libpolkit-agent-1-0:s390x (125-2ubuntu1) over (124-2ubuntu1) ... 125s Preparing to unpack .../43-libpolkit-gobject-1-0_125-2ubuntu1_s390x.deb ... 125s Unpacking libpolkit-gobject-1-0:s390x (125-2ubuntu1) over (124-2ubuntu1) ... 125s Selecting previously unselected package libsgutils2-1.48:s390x. 125s Preparing to unpack .../44-libsgutils2-1.48_1.48-0ubuntu1_s390x.deb ... 125s Unpacking libsgutils2-1.48:s390x (1.48-0ubuntu1) ... 125s Preparing to unpack .../45-linux-base_4.10.1ubuntu1_all.deb ... 125s Unpacking linux-base (4.10.1ubuntu1) over (4.5ubuntu9) ... 125s Preparing to unpack .../46-lto-disabled-list_54_all.deb ... 125s Unpacking lto-disabled-list (54) over (53) ... 125s Preparing to unpack .../47-lxd-installer_10_all.deb ... 125s Unpacking lxd-installer (10) over (9) ... 125s Selecting previously unselected package xml-core. 125s Preparing to unpack .../48-xml-core_0.19_all.deb ... 125s Unpacking xml-core (0.19) ... 125s Selecting previously unselected package polkitd. 125s Preparing to unpack .../49-polkitd_125-2ubuntu1_s390x.deb ... 125s Unpacking polkitd (125-2ubuntu1) ... 125s Selecting previously unselected package packagekit. 125s Preparing to unpack .../50-packagekit_1.3.0-2_s390x.deb ... 125s Unpacking packagekit (1.3.0-2) ... 125s Selecting previously unselected package packagekit-tools. 125s Preparing to unpack .../51-packagekit-tools_1.3.0-2_s390x.deb ... 125s Unpacking packagekit-tools (1.3.0-2) ... 125s Preparing to unpack .../52-pinentry-curses_1.3.1-0ubuntu2_s390x.deb ... 125s Unpacking pinentry-curses (1.3.1-0ubuntu2) over (1.2.1-3ubuntu5) ... 125s Preparing to unpack .../53-python3-blinker_1.9.0-1_all.deb ... 125s Unpacking python3-blinker (1.9.0-1) over (1.8.2-1) ... 125s Preparing to unpack .../54-python3-rpds-py_0.21.0-2ubuntu1_s390x.deb ... 125s Unpacking python3-rpds-py (0.21.0-2ubuntu1) over (0.20.0-0ubuntu3) ... 125s Preparing to unpack .../55-python3-jsonschema-specifications_2023.12.1-2_all.deb ... 125s Unpacking python3-jsonschema-specifications (2023.12.1-2) over (2023.12.1-1ubuntu1) ... 125s Selecting previously unselected package python3-software-properties. 125s Preparing to unpack .../56-python3-software-properties_0.105_all.deb ... 125s Unpacking python3-software-properties (0.105) ... 125s Preparing to unpack .../57-sg3-utils_1.48-0ubuntu1_s390x.deb ... 125s Unpacking sg3-utils (1.48-0ubuntu1) over (1.46-3ubuntu5) ... 126s Preparing to unpack .../58-sg3-utils-udev_1.48-0ubuntu1_all.deb ... 126s Unpacking sg3-utils-udev (1.48-0ubuntu1) over (1.46-3ubuntu5) ... 126s Selecting previously unselected package software-properties-common. 126s Preparing to unpack .../59-software-properties-common_0.105_all.deb ... 126s Unpacking software-properties-common (0.105) ... 126s Preparing to unpack .../60-ubuntu-kernel-accessories_1.544_s390x.deb ... 126s Unpacking ubuntu-kernel-accessories (1.544) over (1.543) ... 126s Selecting previously unselected package unattended-upgrades. 126s Preparing to unpack .../61-unattended-upgrades_2.9.1+nmu4ubuntu1_all.deb ... 126s Unpacking unattended-upgrades (2.9.1+nmu4ubuntu1) ... 126s Setting up pinentry-curses (1.3.1-0ubuntu2) ... 126s Setting up distro-info (1.12) ... 126s Setting up lto-disabled-list (54) ... 126s Setting up ubuntu-kernel-accessories (1.544) ... 126s Setting up apt-utils (2.9.14ubuntu1) ... 126s Setting up linux-base (4.10.1ubuntu1) ... 126s Setting up wget (1.24.5-2ubuntu1) ... 126s Setting up init (1.67ubuntu1) ... 126s Setting up libcurl4t64:s390x (8.11.0-1ubuntu2) ... 126s Setting up openssh-client (1:9.9p1-3ubuntu2) ... 126s Setting up python3-debconf (1.5.87ubuntu1) ... 126s Setting up binutils-common:s390x (2.43.50.20241126-2ubuntu1) ... 126s Setting up libcurl3t64-gnutls:s390x (8.11.0-1ubuntu2) ... 126s Setting up libctf-nobfd0:s390x (2.43.50.20241126-2ubuntu1) ... 126s Setting up libsgutils2-1.48:s390x (1.48-0ubuntu1) ... 126s Setting up python3-yaml (6.0.2-1build1) ... 126s Setting up debconf-i18n (1.5.87ubuntu1) ... 126s Setting up cloud-init-base (24.4-0ubuntu1) ... 127s Setting up xxd (2:9.1.0861-1ubuntu1) ... 127s Setting up libsframe1:s390x (2.43.50.20241126-2ubuntu1) ... 127s Setting up libglib2.0-0t64:s390x (2.82.2-3) ... 127s No schema files found: doing nothing. 127s Setting up libglib2.0-data (2.82.2-3) ... 127s Setting up vim-common (2:9.1.0861-1ubuntu1) ... 127s Setting up xz-utils (5.6.3-1) ... 127s Setting up gir1.2-glib-2.0:s390x (2.82.2-3) ... 127s Setting up lxd-installer (10) ... 128s Setting up python3-rpds-py (0.21.0-2ubuntu1) ... 128s Setting up python-apt-common (2.9.1) ... 128s Setting up dracut-install (105-2ubuntu3) ... 128s Setting up perl-modules-5.40 (5.40.0-8) ... 128s Setting up libduktape207:s390x (2.7.0+tests-0ubuntu3) ... 128s Setting up libplymouth5:s390x (24.004.60-2ubuntu4) ... 128s Setting up libgirepository-1.0-1:s390x (1.82.0-2) ... 128s Setting up sgml-base (1.31) ... 128s Setting up curl (8.11.0-1ubuntu2) ... 128s Setting up libstemmer0d:s390x (2.2.0-4build1) ... 128s Setting up libbinutils:s390x (2.43.50.20241126-2ubuntu1) ... 128s Setting up python3-jsonschema-specifications (2023.12.1-2) ... 128s Setting up python3-distro-info (1.12) ... 128s Setting up libpolkit-gobject-1-0:s390x (125-2ubuntu1) ... 128s Setting up libgstreamer1.0-0:s390x (1.24.9-1) ... 128s Setcap worked! gst-ptp-helper is not suid! 128s Setting up sg3-utils (1.48-0ubuntu1) ... 128s Setting up python3-blinker (1.9.0-1) ... 128s Setting up libctf0:s390x (2.43.50.20241126-2ubuntu1) ... 128s Setting up openssh-sftp-server (1:9.9p1-3ubuntu2) ... 128s Setting up cloud-init (24.4-0ubuntu1) ... 128s Setting up binutils-s390x-linux-gnu (2.43.50.20241126-2ubuntu1) ... 128s Setting up openssh-server (1:9.9p1-3ubuntu2) ... 128s Installing new version of config file /etc/ssh/moduli ... 128s Replacing config file /etc/ssh/sshd_config with new version 129s Setting up bpftrace (0.21.2-2ubuntu3) ... 129s Setting up plymouth (24.004.60-2ubuntu4) ... 129s update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults 129s update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults 129s Setting up python3-apt (2.9.0ubuntu2) ... 129s Setting up libglib2.0-bin (2.82.2-3) ... 129s Setting up libpackagekit-glib2-18:s390x (1.3.0-2) ... 129s Setting up libappstream5:s390x (1.0.3-1) ... 129s Setting up binutils (2.43.50.20241126-2ubuntu1) ... 129s Setting up vim-tiny (2:9.1.0861-1ubuntu1) ... 129s Setting up ubuntu-standard (1.544) ... 129s Setting up sg3-utils-udev (1.48-0ubuntu1) ... 130s update-initramfs: deferring update (trigger activated) 130s Setting up libperl5.40:s390x (5.40.0-8) ... 130s Setting up gir1.2-packagekitglib-1.0 (1.3.0-2) ... 130s Setting up unattended-upgrades (2.9.1+nmu4ubuntu1) ... 130s 130s Creating config file /etc/apt/apt.conf.d/20auto-upgrades with new version 130s 130s Creating config file /etc/apt/apt.conf.d/50unattended-upgrades with new version 130s Created symlink '/etc/systemd/system/multi-user.target.wants/unattended-upgrades.service' → '/usr/lib/systemd/system/unattended-upgrades.service'. 130s Synchronizing state of unattended-upgrades.service with SysV service script with /usr/lib/systemd/systemd-sysv-install. 130s Executing: /usr/lib/systemd/systemd-sysv-install enable unattended-upgrades 131s Setting up perl (5.40.0-8) ... 131s Setting up appstream (1.0.3-1) ... 131s ✔ Metadata cache was updated successfully. 131s Setting up python3-software-properties (0.105) ... 131s Setting up gir1.2-girepository-2.0:s390x (1.82.0-2) ... 131s Setting up xml-core (0.19) ... 131s Setting up libpolkit-agent-1-0:s390x (125-2ubuntu1) ... 131s Setting up ubuntu-minimal (1.544) ... 131s Processing triggers for dbus (1.14.10-4ubuntu5) ... 131s Processing triggers for debianutils (5.21) ... 131s Processing triggers for install-info (7.1.1-1) ... 131s Processing triggers for initramfs-tools (0.142ubuntu35) ... 131s update-initramfs: Generating /boot/initrd.img-6.11.0-8-generic 131s W: No lz4 in /usr/bin:/sbin:/bin, using gzip 134s Using config file '/etc/zipl.conf' 134s Building bootmap in '/boot' 134s Adding IPL section 'ubuntu' (default) 134s Preparing boot device for LD-IPL: vda (0000). 134s Done. 134s Processing triggers for libc-bin (2.40-1ubuntu3) ... 134s Processing triggers for rsyslog (8.2406.0-1ubuntu2) ... 134s Processing triggers for ufw (0.36.2-8) ... 134s Processing triggers for man-db (2.13.0-1) ... 135s Setting up plymouth-theme-ubuntu-text (24.004.60-2ubuntu4) ... 135s Processing triggers for sgml-base (1.31) ... 135s Setting up polkitd (125-2ubuntu1) ... 136s Setting up packagekit (1.3.0-2) ... 136s Created symlink '/etc/systemd/user/sockets.target.wants/pk-debconf-helper.socket' → '/usr/lib/systemd/user/pk-debconf-helper.socket'. 136s Setting up packagekit-tools (1.3.0-2) ... 136s Setting up software-properties-common (0.105) ... 136s Processing triggers for initramfs-tools (0.142ubuntu35) ... 136s update-initramfs: Generating /boot/initrd.img-6.11.0-8-generic 136s W: No lz4 in /usr/bin:/sbin:/bin, using gzip 138s Using config file '/etc/zipl.conf' 138s Building bootmap in '/boot' 138s Adding IPL section 'ubuntu' (default) 138s Preparing boot device for LD-IPL: vda (0000). 138s Done. 138s Processing triggers for dbus (1.14.10-4ubuntu5) ... 139s Reading package lists... 139s Building dependency tree... 139s Reading state information... 140s The following packages will be REMOVED: 140s libsgutils2-1.46-2* 140s 0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded. 140s After this operation, 294 kB disk space will be freed. 140s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55909 files and directories currently installed.) 140s Removing libsgutils2-1.46-2:s390x (1.46-3ubuntu5) ... 140s Processing triggers for libc-bin (2.40-1ubuntu3) ... 140s Reading package lists... 140s Building dependency tree... 140s Reading state information... 140s The following packages will be REMOVED: 140s python3-distro-info* unattended-upgrades* 141s 0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded. 141s After this operation, 465 kB disk space will be freed. 141s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55904 files and directories currently installed.) 141s Removing unattended-upgrades (2.9.1+nmu4ubuntu1) ... 141s Removing python3-distro-info (1.12) ... 141s Processing triggers for man-db (2.13.0-1) ... 141s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55867 files and directories currently installed.) 141s Purging configuration files for unattended-upgrades (2.9.1+nmu4ubuntu1) ... 142s dpkg: warning: while removing unattended-upgrades, directory '/var/log/unattended-upgrades' not empty so not removed 142s dpkg: warning: while removing unattended-upgrades, directory '/lib/systemd/system-sleep' not empty so not removed 143s Hit:1 http://ftpmaster.internal/ubuntu plucky-proposed InRelease 143s Hit:2 http://ftpmaster.internal/ubuntu plucky InRelease 143s Hit:3 http://ftpmaster.internal/ubuntu plucky-updates InRelease 143s Hit:4 http://ftpmaster.internal/ubuntu plucky-security InRelease 144s Reading package lists... 144s Reading package lists... 144s Building dependency tree... 144s Reading state information... 144s Calculating upgrade... 144s 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 144s Reading package lists... 144s Building dependency tree... 144s Reading state information... 145s 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. 145s autopkgtest [20:42:21]: rebooting testbed after setup commands that affected boot 149s autopkgtest-virt-ssh: WARNING: ssh connection failed. Retrying in 3 seconds... 168s autopkgtest [20:42:44]: testbed running kernel: Linux 6.11.0-8-generic #8-Ubuntu SMP Mon Sep 16 12:49:35 UTC 2024 171s autopkgtest [20:42:47]: @@@@@@@@@@@@@@@@@@@@ apt-source chkrootkit 173s Get:1 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (dsc) [1407 B] 173s Get:2 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (tar) [43.0 kB] 173s Get:3 http://ftpmaster.internal/ubuntu plucky/universe chkrootkit 0.58b-3 (diff) [97.1 kB] 173s gpgv: Signature made Mon Sep 30 14:15:58 2024 UTC 173s gpgv: using EDDSA key A3CC9C870B9D310ABAD4CF2F51722B08FE4745A2 173s gpgv: Can't check signature: No public key 173s dpkg-source: warning: cannot verify inline signature for ./chkrootkit_0.58b-3.dsc: no acceptable signature found 173s autopkgtest [20:42:49]: testing package chkrootkit version 0.58b-3 174s autopkgtest [20:42:50]: build not needed 174s autopkgtest [20:42:50]: test test-chkrootkit: preparing testbed 183s Reading package lists... 183s Building dependency tree... 183s Reading state information... 183s Starting pkgProblemResolver with broken count: 0 183s Starting 2 pkgProblemResolver with broken count: 0 183s Done 184s The following additional packages will be installed: 184s chkrootkit net-tools 184s Recommended packages: 184s default-mta | mail-transport-agent mailx 184s The following NEW packages will be installed: 184s autopkgtest-satdep chkrootkit net-tools 184s 0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded. 184s Need to get 544 kB/545 kB of archives. 184s After this operation, 1698 kB of additional disk space will be used. 184s Get:1 /tmp/autopkgtest.VEUWPF/1-autopkgtest-satdep.deb autopkgtest-satdep s390x 0 [732 B] 184s Get:2 http://ftpmaster.internal/ubuntu plucky/universe s390x chkrootkit s390x 0.58b-3 [337 kB] 184s Get:3 http://ftpmaster.internal/ubuntu plucky/main s390x net-tools s390x 2.10-1.1ubuntu1 [207 kB] 185s Fetched 544 kB in 1s (920 kB/s) 185s Selecting previously unselected package chkrootkit. 185s (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 55858 files and directories currently installed.) 185s Preparing to unpack .../chkrootkit_0.58b-3_s390x.deb ... 185s Unpacking chkrootkit (0.58b-3) ... 185s Selecting previously unselected package net-tools. 185s Preparing to unpack .../net-tools_2.10-1.1ubuntu1_s390x.deb ... 185s Unpacking net-tools (2.10-1.1ubuntu1) ... 185s Selecting previously unselected package autopkgtest-satdep. 185s Preparing to unpack .../1-autopkgtest-satdep.deb ... 185s Unpacking autopkgtest-satdep (0) ... 185s Setting up net-tools (2.10-1.1ubuntu1) ... 185s Setting up chkrootkit (0.58b-3) ... 185s Created symlink '/etc/systemd/system/timers.target.wants/chkrootkit.timer' → '/usr/lib/systemd/system/chkrootkit.timer'. 185s Setting up autopkgtest-satdep (0) ... 185s Processing triggers for man-db (2.13.0-1) ... 187s (Reading database ... 55942 files and directories currently installed.) 187s Removing autopkgtest-satdep (0) ... 188s autopkgtest [20:43:04]: test test-chkrootkit: [----------------------- 188s copy: awk from /usr/bin/gawk to /tmp/clean 188s copy: cut from /usr/bin/cut to /tmp/clean 188s copy: echo from /usr/bin/echo to /tmp/clean 188s copy: grep from /usr/bin/grep to /tmp/clean 188s copy: find from /usr/bin/find to /tmp/clean 188s copy: head from /usr/bin/head to /tmp/clean 188s copy: id from /usr/bin/id to /tmp/clean 188s copy: ls from /usr/bin/ls to /tmp/clean 188s copy: ps from /usr/bin/ps to /tmp/clean 188s copy: sed from /usr/bin/sed to /tmp/clean 188s copy: strings from /usr/bin/s390x-linux-gnu-strings to /tmp/clean 188s copy: uname from /usr/bin/uname to /tmp/clean 188s copy: ss from /usr/bin/ss to /tmp/clean 188s copy: netstat from /usr/bin/netstat to /tmp/clean 188s copy: dirname from /usr/bin/dirname to /tmp/clean 188s copy: xargs from /usr/bin/xargs to /tmp/clean 188s copy: dpkg-query from /usr/bin/dpkg-query to /tmp/clean 188s total 2444 188s drwxr-xr-x 2 root root 4096 Nov 26 20:43 . 188s drwxrwxrwt 13 root root 4096 Nov 26 20:43 .. 188s -rwxr-xr-x 1 root root 821480 Mar 31 2024 awk 188s -rwxr-xr-x 1 root root 43456 Jul 31 15:24 cut 188s -rwxr-xr-x 1 root root 31080 Jul 31 15:24 dirname 188s -rwxr-xr-x 1 root root 146008 Oct 29 08:03 dpkg-query 188s -rwxr-xr-x 1 root root 31000 Jul 31 15:24 echo 188s -rwxr-xr-x 1 root root 228656 Aug 10 08:47 find 188s -rwxr-xr-x 1 root root 211160 Apr 8 2024 grep 188s -rwxr-xr-x 1 root root 43456 Jul 31 15:24 head 188s -rwxr-xr-x 1 root root 43456 Jul 31 15:24 id 188s -rwxr-xr-x 1 root root 158584 Jul 31 15:24 ls 188s -rwxr-xr-x 1 root root 157872 May 22 2024 netstat 188s -rwxr-xr-x 1 root root 158568 Sep 12 12:34 ps 188s -rwxr-xr-x 1 root root 125248 Apr 8 2024 sed 188s -rwxr-xr-x 1 root root 131752 Oct 10 13:19 ss 188s -rwxr-xr-x 1 root root 31176 Nov 26 15:44 strings 188s -rwxr-xr-x 1 root root 31160 Jul 31 15:24 uname 188s -rwxr-xr-x 1 root root 71960 Aug 10 08:47 xargs 188s * Running test-chkrootkit (from: /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests)... 188s ** env 188s SHELL=/bin/bash 188s SUDO_GID=1000 188s AUTOPKGTEST_TESTBED_ARCH=s390x 188s no_proxy=127.0.0.1,127.0.1.1,login.ubuntu.com,localhost,localdomain,novalocal,internal,archive.ubuntu.com,ports.ubuntu.com,security.ubuntu.com,ddebs.ubuntu.com,changelogs.ubuntu.com,keyserver.ubuntu.com,launchpadlibrarian.net,launchpadcontent.net,launchpad.net,10.24.0.0/24,keystone.ps5.canonical.com,objectstorage.prodstack5.canonical.com 188s AUTOPKGTEST_NORMAL_USER=ubuntu 188s AUTOPKGTEST_TMP=/tmp/autopkgtest.VEUWPF/autopkgtest_tmp 188s SUDO_COMMAND=/var/tmp/autopkgtest-run-wrapper su -s /bin/bash root -c set -e; exec /tmp/autopkgtest.VEUWPF/wrapper.sh --artifacts=/tmp/autopkgtest.VEUWPF/test-chkrootkit-artifacts --chdir=/tmp/autopkgtest.VEUWPF/build.ezA/src --env=AUTOPKGTEST_TESTBED_ARCH=s390x --env=AUTOPKGTEST_TEST_ARCH=s390x --env=DEB_BUILD_OPTIONS=parallel=2 --env=DEBIAN_FRONTEND=noninteractive --env=LANG=C.UTF-8 --unset-env=LANGUAGE --unset-env=LC_ADDRESS --unset-env=LC_ALL --unset-env=LC_COLLATE --unset-env=LC_CTYPE --unset-env=LC_IDENTIFICATION --unset-env=LC_MEASUREMENT --unset-env=LC_MESSAGES --unset-env=LC_MONETARY --unset-env=LC_NAME --unset-env=LC_NUMERIC --unset-env=LC_PAPER --unset-env=LC_TELEPHONE --unset-env=LC_TIME --script-pid-file=/tmp/autopkgtest_script_pid --source-profile --stderr=/tmp/autopkgtest.VEUWPF/test-chkrootkit-stderr --stdout=/tmp/autopkgtest.VEUWPF/test-chkrootkit-stdout --tmp=/tmp/autopkgtest.VEUWPF/autopkgtest_tmp --env=AUTOPKGTEST_NORMAL_USER=ubuntu --env=ADT_NORMAL_USER=ubuntu '--env=ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1' --make-executable=/tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit -- /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit 188s SUDO_USER=ubuntu 188s PWD=/tmp/autopkgtest.VEUWPF/build.ezA/src 188s ADT_TEST_TRIGGERS=binutils/2.43.50.20241126-2ubuntu1 python-apt/2.9.1 188s LOGNAME=root 188s HOME=/root 188s LANG=C.UTF-8 188s ADTTMP=/tmp/autopkgtest.VEUWPF/autopkgtest_tmp 188s https_proxy=http://squid.internal:3128 188s AUTOPKGTEST_ARTIFACTS=/tmp/autopkgtest.VEUWPF/test-chkrootkit-artifacts 188s TERM=linux 188s USER=root 188s AUTOPKGTEST_TEST_ARCH=s390x 188s DEB_BUILD_OPTIONS=parallel=2 188s SHLVL=2 188s ADT_NORMAL_USER=ubuntu 188s http_proxy=http://squid.internal:3128 188s ADT_ARTIFACTS=/tmp/autopkgtest.VEUWPF/test-chkrootkit-artifacts 188s PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin 188s SUDO_UID=1000 188s MAIL=/var/mail/root 188s DEBIAN_FRONTEND=noninteractive 188s OLDPWD=/home/ubuntu 188s _=/usr/bin/env 188s MY_BUILD_DIR=/tmp/autopkgtest.VEUWPF 188s ** other info 188s ls /var/run/utmp 188s -rw-rw-r-- 1 root utmp 1600 Nov 26 20:42 /var/run/utmp 188s ls /var/log/wtmp 188s -rw-rw-r-- 1 root utmp 246400 Nov 26 20:42 /var/log/wtmp 188s ls /var/log/lastlog 188s -rw-rw-r-- 1 root utmp 296296 Oct 17 14:57 /var/log/lastlog 188s * Setting up the testsuite 188s ** README 188s The purpose of this tests is to check that the actual output is as we expect. 188s 188s This tests that both chkrootkit (directly invoked) and its chkrootkit-daily 188s (systemd timer/cronjob) work with various combinations of options. 188s 188s - Each test has a file listing regexps: each listed regexp must match 188s against the output or the test will fail: the 'fix' will often be 188s to update the .expected file 188s - (these are in debian/test/*.expected) 188s - Output not matched by any such regexp is listed (with some known 188s exceptions removed), but does not cause failure 188s - This testsuite is designed to run in a sbuild schroot or via the CI 188s pipeline on salsa.debian.org: you might need to adjust the 188s debian/test/*.expected files if running in some other way. 188s 188s ** Ensuring chkrootkit finds as much to test as we can 188s Making /usr/sbin/amd 188s Making /etc/amd.conf 188s Making /usr/sbin/biff 188s Making /etc/biff.conf 188s /usr/sbin/cron: exists; mv to .orig 188s Making /etc/cron.conf 188s /usr/bin/crontab: exists; mv to .orig 188s Making /etc/crontab.conf 188s Making /usr/sbin/fingerd 188s Making /etc/fingerd.conf 188s Making /usr/sbin/in.fingerd 188s Making /etc/in.fingerd.conf 188s Making /usr/sbin/gpm 188s Making /etc/gpm.conf 188s /usr/sbin/hdparm: exists; mv to .orig 188s /etc/hdparm.conf: exists; mv to .orig 188s Making /usr/sbin/inetd 188s Making /etc/inetd.conf 188s Making /usr/sbin/in.identd 188s Making /etc/in.identd.conf 188s Making /usr/sbin/inetdconf 188s Making /etc/inetdconf.conf 188s /usr/lib/systemd/systemd: exists; mv to .orig 188s Making /etc/init.conf 188s /usr/bin/killall: exists; mv to .orig 188s Making /etc/killall.conf 188s /usr/bin/lsof: exists; mv to .orig 188s Making /etc/lsof.conf 188s Making /usr/sbin/mail 188s Making /etc/mail.conf 188s Making /usr/sbin/mingetty 188s Making /etc/mingetty.conf 188s Making /usr/sbin/named 188s Making /etc/named.conf 188s Making /usr/sbin/in.pop2d 188s Making /etc/in.pop2d.conf 188s Making /usr/sbin/in.pop3d 188s Making /etc/in.pop3d.conf 188s /usr/bin/write: exists; mv to .orig 188s Making /etc/write.conf 188s /usr/bin/pstree: exists; mv to .orig 188s Making /etc/pstree.conf 188s Making /usr/sbin/rpcinfo 188s Making /etc/rpcinfo.conf 188s Making /usr/sbin/rlogind 188s Making /etc/rlogind.conf 188s Making /usr/sbin/in.rshd 188s Making /etc/in.rshd.conf 188s /usr/bin/ssh: exists; mv to .orig 188s Making /etc/slogin.conf 188s Making /usr/sbin/sendmail 188s Making /etc/sendmail.conf 188s /usr/sbin/sshd: exists; mv to .orig 188s Making /etc/sshd.conf 188s Making /usr/sbin/syslogd 188s Making /etc/syslogd.conf 188s Making /usr/sbin/tcpd 188s Making /etc/tcpd.conf 188s /usr/bin/tcpdump: exists; mv to .orig 188s Making /etc/tcpdump.conf 188s Making /usr/sbin/telnetd 188s Making /etc/telnetd.conf 188s Making /usr/sbin/timed 188s Making /etc/timed.conf 188s Making /usr/sbin/traceroute 188s Making /etc/traceroute.conf 188s MADE: /usr/sbin/amd /etc/amd.conf /usr/sbin/biff /etc/biff.conf /etc/cron.conf /etc/crontab.conf /usr/sbin/fingerd /etc/fingerd.conf /usr/sbin/in.fingerd /etc/in.fingerd.conf /usr/sbin/gpm /etc/gpm.conf /usr/sbin/inetd /etc/inetd.conf /usr/sbin/in.identd /etc/in.identd.conf /usr/sbin/inetdconf /etc/inetdconf.conf /etc/init.conf /etc/killall.conf /etc/lsof.conf /usr/sbin/mail /etc/mail.conf /usr/sbin/mingetty /etc/mingetty.conf /usr/sbin/named /etc/named.conf /usr/sbin/in.pop2d /etc/in.pop2d.conf /usr/sbin/in.pop3d /etc/in.pop3d.conf /etc/write.conf /etc/pstree.conf /usr/sbin/rpcinfo /etc/rpcinfo.conf /usr/sbin/rlogind /etc/rlogind.conf /usr/sbin/in.rshd /etc/in.rshd.conf /etc/slogin.conf /usr/sbin/sendmail /etc/sendmail.conf /etc/sshd.conf /usr/sbin/syslogd /etc/syslogd.conf /usr/sbin/tcpd /etc/tcpd.conf /etc/tcpdump.conf /usr/sbin/telnetd /etc/telnetd.conf /usr/sbin/timed /etc/timed.conf /usr/sbin/traceroute /etc/traceroute.conf 188s MOVED to .orig: /usr/sbin/amd /etc/amd.conf /usr/sbin/biff /etc/biff.conf /etc/cron.conf /etc/crontab.conf /usr/sbin/fingerd /etc/fingerd.conf /usr/sbin/in.fingerd /etc/in.fingerd.conf /usr/sbin/gpm /etc/gpm.conf /usr/sbin/inetd /etc/inetd.conf /usr/sbin/in.identd /etc/in.identd.conf /usr/sbin/inetdconf /etc/inetdconf.conf /etc/init.conf /etc/killall.conf /etc/lsof.conf /usr/sbin/mail /etc/mail.conf /usr/sbin/mingetty /etc/mingetty.conf /usr/sbin/named /etc/named.conf /usr/sbin/in.pop2d /etc/in.pop2d.conf /usr/sbin/in.pop3d /etc/in.pop3d.conf /etc/write.conf /etc/pstree.conf /usr/sbin/rpcinfo /etc/rpcinfo.conf /usr/sbin/rlogind /etc/rlogind.conf /usr/sbin/in.rshd /etc/in.rshd.conf /etc/slogin.conf /usr/sbin/sendmail /etc/sendmail.conf /etc/sshd.conf /usr/sbin/syslogd /etc/syslogd.conf /usr/sbin/tcpd /etc/tcpd.conf /etc/tcpdump.conf /usr/sbin/telnetd /etc/telnetd.conf /usr/sbin/timed /etc/timed.conf /usr/sbin/traceroute /etc/traceroute.conf 188s Done 188s Preserving existing /etc/chkrootkit/chkrootkit.conf as /etc/chkrootkit/chkrootkit.conf.orig 188s Preserving existing /etc/chkrootkit/chkrootkit.ignore as /etc/chkrootkit/chkrootkit.ignore.orig 188s * Testing: the main binary 188s ** Testing: chkrootkit-0-full (/usr/sbin/chkrootkit) ... 188s *** Output 188s ROOTDIR is `/' 188s Checking `amd'... not infected 188s Checking `basename'... not infected 188s Checking `biff'... not infected 188s Checking `chfn'... not infected 188s Checking `chsh'... not infected 188s Checking `cron'... not infected 188s Checking `crontab'... not infected 188s Checking `date'... not infected 188s Checking `du'... not infected 188s Checking `dirname'... not infected 188s Checking `echo'... not infected 188s Checking `egrep'... not infected 188s Checking `env'... not infected 188s Checking `find'... not infected 188s Checking `fingerd'... not infected 188s Checking `gpm'... not infected 188s Checking `grep'... not infected 188s Checking `hdparm'... not infected 188s Checking `su'... not infected 188s Checking `ifconfig'... not infected 188s Checking `inetd'... not infected 188s Checking `inetdconf'... not infected 188s Checking `identd'... not infected 188s Checking `init'... not infected 188s Checking `killall'... not infected 188s Checking `ldsopreload'... not infected 188s Checking `login'... not infected 188s Checking `ls'... not infected 188s Checking `lsof'... not infected 188s Checking `mail'... not infected 188s Checking `mingetty'... not infected 188s Checking `netstat'... not infected 188s Checking `named'... not infected 188s Checking `passwd'... not infected 188s Checking `pidof'... not infected 188s Checking `pop2'... not infected 188s Checking `pop3'... not infected 188s Checking `ps'... not infected 188s Checking `pstree'... not infected 188s Checking `rpcinfo'... not infected 188s Checking `rlogind'... not infected 188s Checking `rshd'... not infected 188s Checking `slogin'... not infected 188s Checking `sendmail'... not infected 188s Checking `sshd'... not infected 188s Checking `syslogd'... not infected 188s Checking `tar'... not infected 188s Checking `tcpd'... not infected 189s Checking `tcpdump'... not infected 189s Checking `top'... not infected 189s Checking `telnetd'... not infected 189s Checking `timed'... not infected 189s Checking `traceroute'... not infected 189s Checking `vdir'... not infected 189s Checking `w'... not infected 189s Checking `write'... not infected 189s Checking `aliens'... started 189s Searching for suspicious files in /dev... not found 189s Searching for known suspicious directories... not found 189s Searching for known suspicious files... not found 189s Searching for sniffer's logs... not found 189s Searching for HiDrootkit rootkit... not found 189s Searching for t0rn rootkit... not found 189s Searching for t0rn v8 (or variation)... not found 189s Searching for Lion rootkit... not found 189s Searching for RSHA rootkit... not found 189s Searching for RH-Sharpe rootkit... not found 189s Searching for Ambient (ark) rootkit... not found 189s Searching for suspicious files and dirs... WARNING 189s 189s WARNING: The following suspicious files and directories were found: 189s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 189s 189s Searching for LPD Worm... not found 189s Searching for Ramen Worm rootkit... not found 189s Searching for Maniac rootkit... not found 189s Searching for RK17 rootkit... not found 189s Searching for Ducoci rootkit... not found 189s Searching for Adore Worm... not found 189s Searching for ShitC Worm... not found 189s Searching for Omega Worm... not found 189s Searching for Sadmind/IIS Worm... not found 189s Searching for MonKit... not found 189s Searching for Showtee rootkit... not found 189s Searching for OpticKit... not found 189s Searching for T.R.K... not found 189s Searching for Mithra rootkit... not found 189s Searching for OBSD rootkit v1... not tested 189s Searching for LOC rootkit... not found 189s Searching for Romanian rootkit... not found 189s Searching for HKRK rootkit... not found 189s Searching for Suckit rootkit... not found 189s Searching for Volc rootkit... not found 189s Searching for Gold2 rootkit... not found 189s Searching for TC2 rootkit... not found 189s Searching for Anonoying rootkit... not found 189s Searching for ZK rootkit... not found 189s Searching for ShKit rootkit... not found 189s Searching for AjaKit rootkit... not found 189s Searching for zaRwT rootkit... not found 189s Searching for Madalin rootkit... not found 189s Searching for Fu rootkit... not found 189s Searching for Kenga3 rootkit... not found 189s Searching for ESRK rootkit... not found 189s Searching for rootedoor... not found 189s Searching for ENYELKM rootkit... not found 189s Searching for common ssh-scanners... not found 189s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 189s Searching for Linux/Ebury 1.6... not tested 189s Searching for 64-bit Linux Rootkit... not found 189s Searching for 64-bit Linux Rootkit modules... not found 189s Searching for Mumblehard... not found 189s Searching for Backdoor.Linux.Mokes.a... not found 189s Searching for Malicious TinyDNS... not found 191s Searching for Linux.Xor.DDoS... WARNING 191s 191s WARNING: Possible Linux.Xor.DDoS installed: 191s /tmp/clean/ps [Not from a Debian package] 191s /tmp/clean/head [Not from a Debian package] 191s /tmp/clean/cut [Not from a Debian package] 191s /tmp/clean/ls [Not from a Debian package] 191s /tmp/clean/echo [Not from a Debian package] 191s /tmp/clean/awk [Not from a Debian package] 191s /tmp/clean/dpkg-query [Not from a Debian package] 191s /tmp/clean/sed [Not from a Debian package] 191s /tmp/clean/strings [Not from a Debian package] 191s /tmp/clean/netstat [Not from a Debian package] 191s /tmp/clean/uname [Not from a Debian package] 191s /tmp/clean/id [Not from a Debian package] 191s /tmp/clean/grep [Not from a Debian package] 191s /tmp/clean/find [Not from a Debian package] 191s /tmp/clean/dirname [Not from a Debian package] 191s /tmp/clean/xargs [Not from a Debian package] 191s /tmp/clean/ss [Not from a Debian package] 191s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 191s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 191s 191s Searching for Linux.Proxy.1.0... not found 191s Searching for CrossRAT... not found 191s Searching for Hidden Cobra... not found 191s Searching for Rocke Miner rootkit... not found 191s Searching for PWNLNX4 lkm rootkit... not found 191s Searching for PWNLNX6 lkm rootkit... not found 191s Searching for Umbreon lrk... not found 191s Searching for Kinsing.a backdoor rootkit... not found 191s Searching for RotaJakiro backdoor rootkit... not found 191s Searching for Syslogk LKM rootkit... not found 191s Searching for Kovid LKM rootkit... not tested 191s Searching for Tsunami DDoS Malware rootkit... not found 191s Searching for Linux BPF Door... not found 191s Searching for suspect PHP files... not found 191s Searching for zero-size shell history files in /root... not found 191s Searching for hardlinked shell history files in /root... not found 191s Checking `aliens'... finished 191s Checking `asp'... not infected 191s Checking `bindshell'... not found 191s Checking `lkm'... started 191s Searching for Adore LKM... not tested 191s Searching for sebek LKM (Adore based)... not tested 191s Searching for knark LKM rootkit... not found 200s Searching for for hidden processes with chkproc... not found 200s Searching for for hidden directories using chkdirs... not found 200s Checking `lkm'... finished 200s Checking `rexedcs'... not found 200s Checking `sniffer'... WARNING 200s 200s WARNING: Output from ifpromisc: 200s lo: not promisc and no packet sniffer sockets 200s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 200s 200s Checking `w55808'... not found 200s Checking `wted'... not found 200s Checking `scalper'... not found 200s Checking `slapper'... not found 200s Checking `z2'... not found 200s Checking `chkutmp'... not found 200s Checking `OSX_RSPLUG'... not tested 200s **** Files in log 200s total 8.0K 200s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 200s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 200s *** Test of content of output follows... 200s **** Test for '^ROOTDIR is `/'$' 200s ROOTDIR is `/' 200s OK 200s **** Test for '^Checking `amd'\.\.\. not infected$' 200s Checking `amd'... not infected 200s OK 200s **** Test for '^Checking `basename'\.\.\. not infected$' 200s Checking `basename'... not infected 200s OK 200s **** Test for '^Checking `biff'\.\.\. not infected$' 200s Checking `biff'... not infected 200s OK 200s **** Test for '^Checking `chfn'\.\.\. not infected$' 200s Checking `chfn'... not infected 200s OK 200s **** Test for '^Checking `chsh'\.\.\. not infected$' 200s Checking `chsh'... not infected 200s OK 200s **** Test for '^Checking `cron'\.\.\. not infected$' 200s Checking `cron'... not infected 200s OK 200s **** Test for '^Checking `crontab'\.\.\. not infected$' 200s Checking `crontab'... not infected 200s OK 200s **** Test for '^Checking `date'\.\.\. not infected$' 200s Checking `date'... not infected 200s OK 200s **** Test for '^Checking `du'\.\.\. not infected$' 200s Checking `du'... not infected 200s OK 200s **** Test for '^Checking `dirname'\.\.\. not infected$' 200s Checking `dirname'... not infected 200s OK 200s **** Test for '^Checking `echo'\.\.\. not infected$' 200s Checking `echo'... not infected 200s OK 200s **** Test for '^Checking `egrep'\.\.\. not infected$' 200s Checking `egrep'... not infected 200s OK 200s **** Test for '^Checking `env'\.\.\. not infected$' 200s Checking `env'... not infected 200s OK 200s **** Test for '^Checking `find'\.\.\. not infected$' 200s Checking `find'... not infected 200s OK 200s **** Test for '^Checking `fingerd'\.\.\. not infected$' 200s Checking `fingerd'... not infected 200s OK 200s **** Test for '^Checking `gpm'\.\.\. not infected$' 200s Checking `gpm'... not infected 200s OK 200s **** Test for '^Checking `grep'\.\.\. not infected$' 200s Checking `grep'... not infected 200s OK 200s **** Test for '^Checking `hdparm'\.\.\. not infected$' 200s Checking `hdparm'... not infected 200s OK 200s **** Test for '^Checking `su'\.\.\. not infected$' 200s Checking `su'... not infected 200s OK 200s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 200s Checking `ifconfig'... not infected 200s OK 200s **** Test for '^Checking `inetd'\.\.\. not infected$' 200s Checking `inetd'... not infected 200s OK 200s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 200s Checking `inetdconf'... not infected 200s OK 200s **** Test for '^Checking `identd'\.\.\. not infected$' 200s Checking `identd'... not infected 200s OK 200s **** Test for '^Checking `init'\.\.\. not infected$' 200s Checking `init'... not infected 200s OK 200s **** Test for '^Checking `killall'\.\.\. not infected$' 200s Checking `killall'... not infected 200s OK 200s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 200s Checking `ldsopreload'... not infected 200s OK 200s **** Test for '^Checking `login'\.\.\. not infected$' 200s Checking `login'... not infected 200s OK 200s **** Test for '^Checking `ls'\.\.\. not infected$' 200s Checking `ls'... not infected 200s OK 200s **** Test for '^Checking `lsof'\.\.\. not infected$' 200s Checking `lsof'... not infected 200s OK 200s **** Test for '^Checking `mail'\.\.\. not infected$' 200s Checking `mail'... not infected 200s OK 200s **** Test for '^Checking `mingetty'\.\.\. not infected$' 200s Checking `mingetty'... not infected 200s OK 200s **** Test for '^Checking `netstat'\.\.\. not infected$' 200s Checking `netstat'... not infected 200s OK 200s **** Test for '^Checking `named'\.\.\. not infected$' 200s Checking `named'... not infected 200s OK 200s **** Test for '^Checking `passwd'\.\.\. not infected$' 200s Checking `passwd'... not infected 200s OK 200s **** Test for '^Checking `pidof'\.\.\. not infected$' 200s Checking `pidof'... not infected 200s OK 200s **** Test for '^Checking `pop2'\.\.\. not infected$' 200s Checking `pop2'... not infected 200s OK 200s **** Test for '^Checking `pop3'\.\.\. not infected$' 200s Checking `pop3'... not infected 200s OK 200s **** Test for '^Checking `ps'\.\.\. not infected$' 200s Checking `ps'... not infected 200s OK 200s **** Test for '^Checking `pstree'\.\.\. not infected$' 200s Checking `pstree'... not infected 200s OK 200s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 200s Checking `rpcinfo'... not infected 200s OK 200s **** Test for '^Checking `rlogind'\.\.\. not infected$' 200s Checking `rlogind'... not infected 200s OK 200s **** Test for '^Checking `rshd'\.\.\. not infected$' 200s Checking `rshd'... not infected 200s OK 200s **** Test for '^Checking `slogin'\.\.\. not infected$' 200s Checking `slogin'... not infected 200s OK 200s **** Test for '^Checking `sendmail'\.\.\. not infected$' 200s Checking `sendmail'... not infected 200s OK 200s **** Test for '^Checking `sshd'\.\.\. not infected$' 200s Checking `sshd'... not infected 200s OK 200s **** Test for '^Checking `syslogd'\.\.\. not infected$' 200s Checking `syslogd'... not infected 200s OK 200s **** Test for '^Checking `tar'\.\.\. not infected$' 200s Checking `tar'... not infected 200s OK 200s **** Test for '^Checking `tcpd'\.\.\. not infected$' 200s Checking `tcpd'... not infected 200s OK 200s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 200s Checking `tcpdump'... not infected 200s OK 200s **** Test for '^Checking `top'\.\.\. not infected$' 200s Checking `top'... not infected 200s OK 200s **** Test for '^Checking `telnetd'\.\.\. not infected$' 200s Checking `telnetd'... not infected 200s OK 200s **** Test for '^Checking `timed'\.\.\. not infected$' 200s Checking `timed'... not infected 200s OK 200s **** Test for '^Checking `traceroute'\.\.\. not infected$' 200s Checking `traceroute'... not infected 200s OK 200s **** Test for '^Checking `vdir'\.\.\. not infected$' 200s Checking `vdir'... not infected 200s OK 200s **** Test for '^Checking `w'\.\.\. not infected$' 200s Checking `w'... not infected 200s OK 200s **** Test for '^Checking `write'\.\.\. not infected$' 200s Checking `write'... not infected 200s OK 200s **** Test for '^Checking `aliens'\.\.\. started$' 200s Checking `aliens'... started 200s OK 200s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 200s Searching for suspicious files in /dev... not found 200s OK 200s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 200s Searching for known suspicious directories... not found 200s OK 200s **** Test for '^Searching for known suspicious files\.\.\. not found$' 200s Searching for known suspicious files... not found 200s OK 200s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 200s Searching for sniffer's logs... not found 200s OK 200s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 200s Searching for HiDrootkit rootkit... not found 200s OK 200s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 200s Searching for t0rn rootkit... not found 200s OK 200s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 200s Searching for t0rn v8 (or variation)... not found 200s OK 200s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 200s Searching for Lion rootkit... not found 200s OK 200s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 200s Searching for RSHA rootkit... not found 200s OK 200s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 200s Searching for RH-Sharpe rootkit... not found 200s OK 200s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 200s Searching for Ambient (ark) rootkit... not found 200s OK 200s **** Test for '^Searching for suspicious files and dirs\.\.\. not found$' 200s 200s 200s **** Test for '^Searching for LPD Worm\.\.\. not found$' 200s Searching for LPD Worm... not found 200s OK 200s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 200s Searching for Ramen Worm rootkit... not found 200s OK 200s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 200s Searching for Maniac rootkit... not found 200s OK 200s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 200s Searching for RK17 rootkit... not found 200s OK 200s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 200s Searching for Ducoci rootkit... not found 200s OK 200s **** Test for '^Searching for Adore Worm\.\.\. not found$' 200s Searching for Adore Worm... not found 200s OK 200s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 200s Searching for ShitC Worm... not found 200s OK 200s **** Test for '^Searching for Omega Worm\.\.\. not found$' 200s Searching for Omega Worm... not found 200s OK 200s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 200s Searching for Sadmind/IIS Worm... not found 200s OK 200s **** Test for '^Searching for MonKit\.\.\. not found$' 200s Searching for MonKit... not found 200s OK 200s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 200s Searching for Showtee rootkit... not found 200s OK 200s **** Test for '^Searching for OpticKit\.\.\. not found$' 200s Searching for OpticKit... not found 200s OK 200s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 200s Searching for T.R.K... not found 200s OK 200s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 200s Searching for Mithra rootkit... not found 200s OK 200s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 200s Searching for OBSD rootkit v1... not tested 200s OK 200s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 200s Searching for LOC rootkit... not found 200s OK 200s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 200s Searching for Romanian rootkit... not found 200s OK 200s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 200s Searching for HKRK rootkit... not found 200s OK 200s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 200s Searching for Suckit rootkit... not found 200s OK 200s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 200s Searching for Volc rootkit... not found 200s OK 200s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 200s Searching for Gold2 rootkit... not found 200s OK 200s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 200s Searching for TC2 rootkit... not found 200s OK 200s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 200s Searching for Anonoying rootkit... not found 200s OK 200s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 200s Searching for ZK rootkit... not found 200s OK 200s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 200s Searching for ShKit rootkit... not found 200s OK 200s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 200s Searching for AjaKit rootkit... not found 200s OK 200s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 200s Searching for zaRwT rootkit... not found 200s OK 200s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 200s Searching for Madalin rootkit... not found 200s OK 200s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 200s Searching for Fu rootkit... not found 200s OK 200s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 200s Searching for Kenga3 rootkit... not found 200s OK 200s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 200s Searching for ESRK rootkit... not found 200s OK 200s **** Test for '^Searching for rootedoor\.\.\. not found$' 200s Searching for rootedoor... not found 200s OK 200s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 200s Searching for ENYELKM rootkit... not found 200s OK 200s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 200s Searching for common ssh-scanners... not found 200s OK 200s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 200s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 200s OK 200s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 200s Searching for Linux/Ebury 1.6... not tested 200s OK 200s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 200s Searching for 64-bit Linux Rootkit... not found 200s OK 200s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 200s Searching for 64-bit Linux Rootkit modules... not found 200s OK 200s **** Test for '^Searching for Mumblehard\.\.\. not found$' 200s Searching for Mumblehard... not found 200s OK 200s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 200s Searching for Backdoor.Linux.Mokes.a... not found 200s OK 200s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 200s Searching for Malicious TinyDNS... not found 200s OK 200s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 200s Searching for Linux.Xor.DDoS... WARNING 200s OK 200s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 200s WARNING: Possible Linux.Xor.DDoS installed: 200s OK 200s **** Test for '^$' 200s 200s 200s 200s 200s 200s 200s OK 200s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 200s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 200s OK 200s **** Test for '^/tmp/clean/.+$' 200s /tmp/clean/ps [Not from a Debian package] 200s /tmp/clean/head [Not from a Debian package] 200s /tmp/clean/cut [Not from a Debian package] 200s /tmp/clean/ls [Not from a Debian package] 200s /tmp/clean/echo [Not from a Debian package] 200s /tmp/clean/awk [Not from a Debian package] 200s /tmp/clean/dpkg-query [Not from a Debian package] 200s /tmp/clean/sed [Not from a Debian package] 200s /tmp/clean/strings [Not from a Debian package] 200s /tmp/clean/netstat [Not from a Debian package] 200s /tmp/clean/uname [Not from a Debian package] 200s /tmp/clean/id [Not from a Debian package] 200s /tmp/clean/grep [Not from a Debian package] 200s /tmp/clean/find [Not from a Debian package] 200s /tmp/clean/dirname [Not from a Debian package] 200s /tmp/clean/xargs [Not from a Debian package] 200s /tmp/clean/ss [Not from a Debian package] 200s OK 200s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 200s Searching for Linux.Proxy.1.0... not found 200s OK 200s **** Test for '^Searching for CrossRAT\.\.\. not found$' 200s Searching for CrossRAT... not found 200s OK 200s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 200s Searching for Hidden Cobra... not found 200s OK 200s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 200s Searching for Rocke Miner rootkit... not found 200s OK 200s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 200s Searching for PWNLNX4 lkm rootkit... not found 200s OK 200s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 200s Searching for PWNLNX6 lkm rootkit... not found 200s OK 200s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 200s Searching for Umbreon lrk... not found 200s OK 200s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 200s Searching for Kinsing.a backdoor rootkit... not found 200s OK 200s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 200s Searching for RotaJakiro backdoor rootkit... not found 200s OK 200s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 200s Searching for Syslogk LKM rootkit... not found 200s OK 200s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 200s Searching for Kovid LKM rootkit... not tested 200s OK 200s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 200s Searching for Tsunami DDoS Malware rootkit... not found 200s OK 200s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 200s Searching for Linux BPF Door... not found 200s OK 200s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 200s Searching for suspect PHP files... not found 200s OK 200s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 200s Searching for zero-size shell history files in /root... not found 200s OK 200s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 200s Searching for hardlinked shell history files in /root... not found 200s OK 200s **** Test for '^Checking `aliens'\.\.\. finished$' 200s Checking `aliens'... finished 200s OK 200s **** Test for '^Checking `asp'\.\.\. not infected$' 200s Checking `asp'... not infected 200s OK 200s **** Test for '^Checking `bindshell'\.\.\. not found$' 200s Checking `bindshell'... not found 200s OK 200s **** Test for '^Checking `lkm'\.\.\. started$' 200s Checking `lkm'... started 200s OK 200s **** Test for '^Searching for Adore LKM\.\.\. not (tested|found)$' 200s Searching for Adore LKM... not tested 200s OK 200s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not (tested|found)$' 200s Searching for sebek LKM (Adore based)... not tested 200s OK 200s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 200s Searching for knark LKM rootkit... not found 200s OK 200s **** Test for '^Checking `lkm'\.\.\. finished$' 200s Checking `lkm'... finished 200s OK 200s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 200s Searching for for hidden processes with chkproc... not found 201s OK 201s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 201s Searching for for hidden directories using chkdirs... not found 201s OK 201s **** Test for '^Checking `rexedcs'\.\.\. not found$' 201s Checking `rexedcs'... not found 201s OK 201s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 201s Checking `sniffer'... WARNING 201s OK 201s **** Test for '^WARNING: Output from ifpromisc:$' 201s WARNING: Output from ifpromisc: 201s OK 201s **** Test for '^lo: not promisc and no packet sniffer sockets$' 201s lo: not promisc and no packet sniffer sockets 201s OK 201s **** Test for '^Checking `w55808'\.\.\. not found$' 201s Checking `w55808'... not found 201s OK 201s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 201s Checking `wted'... not found 201s OK 201s **** Test for '^Checking `scalper'\.\.\. not found$' 201s Checking `scalper'... not found 201s OK 201s **** Test for '^Checking `slapper'\.\.\. not found$' 201s Checking `slapper'... not found 201s OK 201s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 201s Checking `z2'... not found 201s OK 201s **** Test for '^Checking `chkutmp'\.\.\.' 201s Checking `chkutmp'... not found 201s OK 201s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 201s Checking `OSX_RSPLUG'... not tested 201s OK 201s ** FAIL: Testing: chkrootkit-0-full (/usr/sbin/chkrootkit) done: FAIL 201s *** FAIL was with config set to: 201s total 20 201s drwxr-xr-x 2 root root 4096 Nov 26 20:43 . 201s drwxr-xr-x 98 root root 12288 Nov 26 20:43 .. 201s -rw-r--r-- 1 root root 4074 Sep 26 06:10 chkrootkit.conf.orig 201s -rw-r--r-- 1 root root 0 Sep 26 06:10 chkrootkit.ignore.orig 201s *** Reason(s) for failure follows 201s Result: FAIL 201s 201s Missing: ^Searching for suspicious files and dirs\.\.\. not found$ 201s cat: /etc/chkrootkit/chkrootkit.conf: No such file or directory 201s *** Unexpected (unmatched) lines follow (for info): 201s Searching for suspicious files and dirs... WARNING 201s WARNING: The following suspicious files and directories were found: 201s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 201s ** Testing: chkrootkit-1-full (/usr/sbin/chkrootkit) ... 201s *** Output 201s ROOTDIR is `/' 201s Checking `amd'... not infected 201s Checking `basename'... not infected 201s Checking `biff'... not infected 201s Checking `chfn'... not infected 201s Checking `chsh'... not infected 201s Checking `cron'... not infected 201s Checking `crontab'... not infected 201s Checking `date'... not infected 201s Checking `du'... not infected 201s Checking `dirname'... not infected 201s Checking `echo'... not infected 201s Checking `egrep'... not infected 201s Checking `env'... not infected 201s Checking `find'... not infected 201s Checking `fingerd'... not infected 201s Checking `gpm'... not infected 201s Checking `grep'... not infected 201s Checking `hdparm'... not infected 201s Checking `su'... not infected 201s Checking `ifconfig'... not infected 201s Checking `inetd'... not infected 201s Checking `inetdconf'... not infected 201s Checking `identd'... not infected 201s Checking `init'... not infected 201s Checking `killall'... not infected 201s Checking `ldsopreload'... not infected 201s Checking `login'... not infected 201s Checking `ls'... not infected 201s Checking `lsof'... not infected 201s Checking `mail'... not infected 201s Checking `mingetty'... not infected 201s Checking `netstat'... not infected 201s Checking `named'... not infected 201s Checking `passwd'... not infected 201s Checking `pidof'... not infected 201s Checking `pop2'... not infected 201s Checking `pop3'... not infected 201s Checking `ps'... not infected 201s Checking `pstree'... not infected 201s Checking `rpcinfo'... not infected 201s Checking `rlogind'... not infected 201s Checking `rshd'... not infected 201s Checking `slogin'... not infected 201s Checking `sendmail'... not infected 201s Checking `sshd'... not infected 201s Checking `syslogd'... not infected 201s Checking `tar'... not infected 201s Checking `tcpd'... not infected 201s Checking `tcpdump'... not infected 201s Checking `top'... not infected 201s Checking `telnetd'... not infected 201s Checking `timed'... not infected 201s Checking `traceroute'... not infected 201s Checking `vdir'... not infected 201s Checking `w'... not infected 201s Checking `write'... not infected 201s Checking `aliens'... started 201s Searching for suspicious files in /dev... not found 201s Searching for known suspicious directories... not found 201s Searching for known suspicious files... not found 201s Searching for sniffer's logs... not found 201s Searching for HiDrootkit rootkit... not found 201s Searching for t0rn rootkit... not found 201s Searching for t0rn v8 (or variation)... not found 201s Searching for Lion rootkit... not found 201s Searching for RSHA rootkit... not found 201s Searching for RH-Sharpe rootkit... not found 201s Searching for Ambient (ark) rootkit... not found 201s Searching for suspicious files and dirs... WARNING 201s 201s WARNING: The following suspicious files and directories were found: 201s /usr/lib/... [Not from a Debian package] 201s /usr/lib/.aaa [Not from a Debian package] 201s /usr/lib/.1 [Not from a Debian package] 201s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 201s /usr/lib/.bbb [Not from a Debian package] 201s /usr/lib/.1DIR [Not from a Debian package] 201s /usr/lib/.DIR-aaa [Not from a Debian package] 201s /usr/lib/...DIR [Not from a Debian package] 201s 201s Searching for LPD Worm... not found 201s Searching for Ramen Worm rootkit... not found 201s Searching for Maniac rootkit... not found 201s Searching for RK17 rootkit... not found 201s Searching for Ducoci rootkit... not found 201s Searching for Adore Worm... not found 201s Searching for ShitC Worm... not found 201s Searching for Omega Worm... not found 201s Searching for Sadmind/IIS Worm... not found 201s Searching for MonKit... not found 201s Searching for Showtee rootkit... not found 201s Searching for OpticKit... not found 201s Searching for T.R.K... not found 201s Searching for Mithra rootkit... not found 201s Searching for OBSD rootkit v1... not tested 201s Searching for LOC rootkit... not found 201s Searching for Romanian rootkit... not found 201s Searching for HKRK rootkit... not found 201s Searching for Suckit rootkit... not found 201s Searching for Volc rootkit... not found 201s Searching for Gold2 rootkit... not found 201s Searching for TC2 rootkit... not found 201s Searching for Anonoying rootkit... not found 201s Searching for ZK rootkit... not found 201s Searching for ShKit rootkit... not found 201s Searching for AjaKit rootkit... not found 201s Searching for zaRwT rootkit... not found 201s Searching for Madalin rootkit... not found 201s Searching for Fu rootkit... not found 201s Searching for Kenga3 rootkit... not found 201s Searching for ESRK rootkit... not found 201s Searching for rootedoor... not found 201s Searching for ENYELKM rootkit... not found 201s Searching for common ssh-scanners... not found 201s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 201s Searching for Linux/Ebury 1.6... not tested 201s Searching for 64-bit Linux Rootkit... not found 201s Searching for 64-bit Linux Rootkit modules... not found 201s Searching for Mumblehard... not found 201s Searching for Backdoor.Linux.Mokes.a... not found 201s Searching for Malicious TinyDNS... not found 203s Searching for Linux.Xor.DDoS... WARNING 203s 203s WARNING: Possible Linux.Xor.DDoS installed: 203s /tmp/clean/ps [Not from a Debian package] 203s /tmp/clean/head [Not from a Debian package] 203s /tmp/clean/cut [Not from a Debian package] 203s /tmp/clean/ls [Not from a Debian package] 203s /tmp/clean/echo [Not from a Debian package] 203s /tmp/clean/awk [Not from a Debian package] 203s /tmp/clean/dpkg-query [Not from a Debian package] 203s /tmp/clean/sed [Not from a Debian package] 203s /tmp/clean/strings [Not from a Debian package] 203s /tmp/clean/netstat [Not from a Debian package] 203s /tmp/clean/uname [Not from a Debian package] 203s /tmp/clean/id [Not from a Debian package] 203s /tmp/clean/grep [Not from a Debian package] 203s /tmp/clean/find [Not from a Debian package] 203s /tmp/clean/dirname [Not from a Debian package] 203s /tmp/clean/xargs [Not from a Debian package] 203s /tmp/clean/ss [Not from a Debian package] 203s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 203s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 203s 203s Searching for Linux.Proxy.1.0... not found 203s Searching for CrossRAT... not found 203s Searching for Hidden Cobra... not found 203s Searching for Rocke Miner rootkit... not found 203s Searching for PWNLNX4 lkm rootkit... not found 203s Searching for PWNLNX6 lkm rootkit... not found 203s Searching for Umbreon lrk... not found 203s Searching for Kinsing.a backdoor rootkit... not found 203s Searching for RotaJakiro backdoor rootkit... not found 203s Searching for Syslogk LKM rootkit... not found 203s Searching for Kovid LKM rootkit... not tested 203s Searching for Tsunami DDoS Malware rootkit... not found 203s Searching for Linux BPF Door... not found 204s Searching for suspect PHP files... not found 204s Searching for zero-size shell history files in /root... not found 204s Searching for hardlinked shell history files in /root... not found 204s Checking `aliens'... finished 204s Checking `asp'... not infected 204s Checking `bindshell'... not found 204s Checking `lkm'... started 204s Searching for Adore LKM... not tested 204s Searching for sebek LKM (Adore based)... not tested 204s Searching for knark LKM rootkit... not found 212s Searching for for hidden processes with chkproc... not found 212s Searching for for hidden directories using chkdirs... not found 212s Checking `lkm'... finished 212s Checking `rexedcs'... not found 212s Checking `sniffer'... WARNING 212s 212s WARNING: Output from ifpromisc: 212s lo: not promisc and no packet sniffer sockets 212s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 212s 212s Checking `w55808'... not found 212s Checking `wted'... not found 212s Checking `scalper'... not found 212s Checking `slapper'... not found 212s Checking `z2'... not found 212s Checking `chkutmp'... not found 212s Checking `OSX_RSPLUG'... not tested 212s **** Files in log 212s total 8.0K 212s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 212s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 212s *** Test of content of output follows... 212s **** Test for '^ROOTDIR is `/'$' 212s ROOTDIR is `/' 212s OK 212s **** Test for '^Checking `amd'\.\.\. not infected$' 212s Checking `amd'... not infected 212s OK 212s **** Test for '^Checking `basename'\.\.\. not infected$' 212s Checking `basename'... not infected 212s OK 212s **** Test for '^Checking `biff'\.\.\. not infected$' 212s Checking `biff'... not infected 212s OK 212s **** Test for '^Checking `chfn'\.\.\. not infected$' 212s Checking `chfn'... not infected 212s OK 212s **** Test for '^Checking `chsh'\.\.\. not infected$' 212s Checking `chsh'... not infected 212s OK 212s **** Test for '^Checking `cron'\.\.\. not infected$' 212s Checking `cron'... not infected 212s OK 212s **** Test for '^Checking `crontab'\.\.\. not infected$' 212s Checking `crontab'... not infected 212s OK 212s **** Test for '^Checking `date'\.\.\. not infected$' 212s Checking `date'... not infected 212s OK 212s **** Test for '^Checking `du'\.\.\. not infected$' 212s Checking `du'... not infected 212s OK 212s **** Test for '^Checking `dirname'\.\.\. not infected$' 212s Checking `dirname'... not infected 212s OK 212s **** Test for '^Checking `echo'\.\.\. not infected$' 212s Checking `echo'... not infected 212s OK 212s **** Test for '^Checking `egrep'\.\.\. not infected$' 212s Checking `egrep'... not infected 212s OK 212s **** Test for '^Checking `env'\.\.\. not infected$' 212s Checking `env'... not infected 212s OK 212s **** Test for '^Checking `find'\.\.\. not infected$' 212s Checking `find'... not infected 212s OK 212s **** Test for '^Checking `fingerd'\.\.\. not infected$' 212s Checking `fingerd'... not infected 212s OK 212s **** Test for '^Checking `gpm'\.\.\. not infected$' 212s Checking `gpm'... not infected 212s OK 212s **** Test for '^Checking `grep'\.\.\. not infected$' 212s Checking `grep'... not infected 212s OK 212s **** Test for '^Checking `hdparm'\.\.\. not infected$' 212s Checking `hdparm'... not infected 212s OK 212s **** Test for '^Checking `su'\.\.\. not infected$' 212s Checking `su'... not infected 212s OK 212s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 212s Checking `ifconfig'... not infected 212s OK 212s **** Test for '^Checking `inetd'\.\.\. not infected$' 212s Checking `inetd'... not infected 212s OK 212s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 212s Checking `inetdconf'... not infected 212s OK 212s **** Test for '^Checking `identd'\.\.\. not infected$' 212s Checking `identd'... not infected 212s OK 212s **** Test for '^Checking `init'\.\.\. not infected$' 212s Checking `init'... not infected 212s OK 212s **** Test for '^Checking `killall'\.\.\. not infected$' 212s Checking `killall'... not infected 212s OK 212s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 212s Checking `ldsopreload'... not infected 212s OK 212s **** Test for '^Checking `login'\.\.\. not infected$' 212s Checking `login'... not infected 212s OK 212s **** Test for '^Checking `ls'\.\.\. not infected$' 212s Checking `ls'... not infected 212s OK 212s **** Test for '^Checking `lsof'\.\.\. not infected$' 212s Checking `lsof'... not infected 212s OK 212s **** Test for '^Checking `mail'\.\.\. not infected$' 212s Checking `mail'... not infected 212s OK 212s **** Test for '^Checking `mingetty'\.\.\. not infected$' 212s Checking `mingetty'... not infected 212s OK 212s **** Test for '^Checking `netstat'\.\.\. not infected$' 212s Checking `netstat'... not infected 212s OK 212s **** Test for '^Checking `named'\.\.\. not infected$' 212s Checking `named'... not infected 212s OK 212s **** Test for '^Checking `passwd'\.\.\. not infected$' 212s Checking `passwd'... not infected 212s OK 212s **** Test for '^Checking `pidof'\.\.\. not infected$' 212s Checking `pidof'... not infected 212s OK 212s **** Test for '^Checking `pop2'\.\.\. not infected$' 212s Checking `pop2'... not infected 212s OK 212s **** Test for '^Checking `pop3'\.\.\. not infected$' 212s Checking `pop3'... not infected 212s OK 212s **** Test for '^Checking `ps'\.\.\. not infected$' 212s Checking `ps'... not infected 212s OK 212s **** Test for '^Checking `pstree'\.\.\. not infected$' 212s Checking `pstree'... not infected 212s OK 212s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 212s Checking `rpcinfo'... not infected 212s OK 212s **** Test for '^Checking `rlogind'\.\.\. not infected$' 212s Checking `rlogind'... not infected 212s OK 212s **** Test for '^Checking `rshd'\.\.\. not infected$' 212s Checking `rshd'... not infected 212s OK 212s **** Test for '^Checking `slogin'\.\.\. not infected$' 212s Checking `slogin'... not infected 212s OK 212s **** Test for '^Checking `sendmail'\.\.\. not infected$' 212s Checking `sendmail'... not infected 212s OK 212s **** Test for '^Checking `sshd'\.\.\. not infected$' 212s Checking `sshd'... not infected 212s OK 212s **** Test for '^Checking `syslogd'\.\.\. not infected$' 212s Checking `syslogd'... not infected 212s OK 212s **** Test for '^Checking `tar'\.\.\. not infected$' 212s Checking `tar'... not infected 212s OK 212s **** Test for '^Checking `tcpd'\.\.\. not infected$' 212s Checking `tcpd'... not infected 212s OK 212s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 212s Checking `tcpdump'... not infected 212s OK 212s **** Test for '^Checking `top'\.\.\. not infected$' 212s Checking `top'... not infected 212s OK 212s **** Test for '^Checking `telnetd'\.\.\. not infected$' 212s Checking `telnetd'... not infected 212s OK 212s **** Test for '^Checking `timed'\.\.\. not infected$' 212s Checking `timed'... not infected 212s OK 212s **** Test for '^Checking `traceroute'\.\.\. not infected$' 212s Checking `traceroute'... not infected 212s OK 212s **** Test for '^Checking `vdir'\.\.\. not infected$' 212s Checking `vdir'... not infected 212s OK 212s **** Test for '^Checking `w'\.\.\. not infected$' 212s Checking `w'... not infected 212s OK 212s **** Test for '^Checking `write'\.\.\. not infected$' 212s Checking `write'... not infected 212s OK 212s **** Test for '^Checking `aliens'\.\.\. started$' 212s Checking `aliens'... started 212s OK 212s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 212s Searching for suspicious files in /dev... not found 212s OK 212s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 212s Searching for known suspicious directories... not found 212s OK 212s **** Test for '^Searching for known suspicious files\.\.\. not found$' 212s Searching for known suspicious files... not found 212s OK 212s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 212s Searching for sniffer's logs... not found 212s OK 212s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 212s Searching for HiDrootkit rootkit... not found 212s OK 212s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 212s Searching for t0rn rootkit... not found 212s OK 212s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 212s Searching for t0rn v8 (or variation)... not found 212s OK 212s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 212s Searching for Lion rootkit... not found 212s OK 212s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 212s Searching for RSHA rootkit... not found 212s OK 212s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 212s Searching for RH-Sharpe rootkit... not found 212s OK 212s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 212s Searching for Ambient (ark) rootkit... not found 212s OK 212s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 212s Searching for suspicious files and dirs... WARNING 212s OK 212s **** Test for '^$' 212s 212s 212s 212s 212s 212s 212s OK 212s **** Test for '^WARNING: The following suspicious files and directories were found:$' 212s WARNING: The following suspicious files and directories were found: 212s OK 212s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 212s /usr/lib/.1 [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 212s /usr/lib/.aaa [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 212s /usr/lib/.1DIR [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 212s /usr/lib/...DIR [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 212s /usr/lib/.bbb [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 212s /usr/lib/.DIR-aaa [Not from a Debian package] 212s OK 212s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 212s /usr/lib/... [Not from a Debian package] 212s OK 212s **** Test for '^Searching for LPD Worm\.\.\. not found$' 212s Searching for LPD Worm... not found 212s OK 212s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 212s Searching for Ramen Worm rootkit... not found 212s OK 212s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 212s Searching for Maniac rootkit... not found 212s OK 212s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 212s Searching for RK17 rootkit... not found 212s OK 212s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 212s Searching for Ducoci rootkit... not found 212s OK 212s **** Test for '^Searching for Adore Worm\.\.\. not found$' 212s Searching for Adore Worm... not found 212s OK 212s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 212s Searching for ShitC Worm... not found 212s OK 212s **** Test for '^Searching for Omega Worm\.\.\. not found$' 212s Searching for Omega Worm... not found 212s OK 212s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 212s Searching for Sadmind/IIS Worm... not found 212s OK 212s **** Test for '^Searching for MonKit\.\.\. not found$' 212s Searching for MonKit... not found 212s OK 212s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 212s Searching for Showtee rootkit... not found 212s OK 212s **** Test for '^Searching for OpticKit\.\.\. not found$' 212s Searching for OpticKit... not found 212s OK 212s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 212s Searching for T.R.K... not found 212s OK 212s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 212s Searching for Mithra rootkit... not found 212s OK 212s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 212s Searching for OBSD rootkit v1... not tested 212s OK 212s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 212s Searching for LOC rootkit... not found 212s OK 212s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 212s Searching for Romanian rootkit... not found 212s OK 212s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 212s Searching for HKRK rootkit... not found 212s OK 212s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 212s Searching for Suckit rootkit... not found 212s OK 212s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 212s Searching for Volc rootkit... not found 212s OK 212s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 212s Searching for Gold2 rootkit... not found 212s OK 212s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 212s Searching for TC2 rootkit... not found 212s OK 212s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 212s Searching for Anonoying rootkit... not found 212s OK 212s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 212s Searching for ZK rootkit... not found 212s OK 212s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 212s Searching for ShKit rootkit... not found 212s OK 212s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 212s Searching for AjaKit rootkit... not found 212s OK 212s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 212s Searching for zaRwT rootkit... not found 212s OK 212s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 212s Searching for Madalin rootkit... not found 212s OK 212s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 212s Searching for Fu rootkit... not found 212s OK 212s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 212s Searching for Kenga3 rootkit... not found 212s OK 212s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 212s Searching for ESRK rootkit... not found 212s OK 212s **** Test for '^Searching for rootedoor\.\.\. not found$' 212s Searching for rootedoor... not found 212s OK 212s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 212s Searching for ENYELKM rootkit... not found 212s OK 212s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 212s Searching for common ssh-scanners... not found 212s OK 212s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 212s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 212s OK 212s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 212s Searching for Linux/Ebury 1.6... not tested 212s OK 212s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 212s Searching for 64-bit Linux Rootkit... not found 212s OK 212s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 212s Searching for 64-bit Linux Rootkit modules... not found 212s OK 212s **** Test for '^Searching for Mumblehard\.\.\. not found$' 212s Searching for Mumblehard... not found 212s OK 212s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 212s Searching for Backdoor.Linux.Mokes.a... not found 212s OK 212s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 212s Searching for Malicious TinyDNS... not found 212s OK 212s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 212s Searching for Linux.Xor.DDoS... WARNING 212s OK 212s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 212s WARNING: Possible Linux.Xor.DDoS installed: 212s OK 212s **** Test for '^/tmp/clean/.+$' 212s /tmp/clean/ps [Not from a Debian package] 212s /tmp/clean/head [Not from a Debian package] 212s /tmp/clean/cut [Not from a Debian package] 212s /tmp/clean/ls [Not from a Debian package] 212s /tmp/clean/echo [Not from a Debian package] 212s /tmp/clean/awk [Not from a Debian package] 212s /tmp/clean/dpkg-query [Not from a Debian package] 212s /tmp/clean/sed [Not from a Debian package] 212s /tmp/clean/strings [Not from a Debian package] 212s /tmp/clean/netstat [Not from a Debian package] 212s /tmp/clean/uname [Not from a Debian package] 212s /tmp/clean/id [Not from a Debian package] 212s /tmp/clean/grep [Not from a Debian package] 212s /tmp/clean/find [Not from a Debian package] 212s /tmp/clean/dirname [Not from a Debian package] 212s /tmp/clean/xargs [Not from a Debian package] 212s /tmp/clean/ss [Not from a Debian package] 212s OK 212s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 212s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 212s OK 212s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 212s Searching for Linux.Proxy.1.0... not found 212s OK 212s **** Test for '^Searching for CrossRAT\.\.\. not found$' 212s Searching for CrossRAT... not found 212s OK 212s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 212s Searching for Hidden Cobra... not found 212s OK 212s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 212s Searching for Rocke Miner rootkit... not found 212s OK 212s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 212s Searching for PWNLNX4 lkm rootkit... not found 212s OK 212s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 212s Searching for PWNLNX6 lkm rootkit... not found 212s OK 212s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 212s Searching for Umbreon lrk... not found 212s OK 212s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 212s Searching for Kinsing.a backdoor rootkit... not found 212s OK 212s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 212s Searching for RotaJakiro backdoor rootkit... not found 212s OK 212s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 212s Searching for Syslogk LKM rootkit... not found 212s OK 212s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 212s Searching for Kovid LKM rootkit... not tested 212s OK 212s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 212s Searching for Tsunami DDoS Malware rootkit... not found 212s OK 212s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 212s Searching for Linux BPF Door... not found 212s OK 212s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 212s Searching for suspect PHP files... not found 212s OK 212s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 212s Searching for zero-size shell history files in /root... not found 212s OK 212s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 212s Searching for hardlinked shell history files in /root... not found 212s OK 212s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 212s Searching for suspect PHP files... not found 212s OK 212s **** Test for '^Checking `aliens'\.\.\. finished$' 212s Checking `aliens'... finished 212s OK 212s **** Test for '^Checking `asp'\.\.\. not infected$' 212s Checking `asp'... not infected 212s OK 212s **** Test for '^Checking `bindshell'\.\.\. not found$' 212s Checking `bindshell'... not found 212s OK 212s **** Test for '^Checking `lkm'\.\.\. started$' 212s Checking `lkm'... started 212s OK 212s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 212s Searching for Adore LKM... not tested 212s OK 212s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 212s Searching for sebek LKM (Adore based)... not tested 212s OK 212s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 212s Searching for knark LKM rootkit... not found 212s OK 212s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 212s Searching for for hidden processes with chkproc... not found 212s OK 212s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 212s Searching for for hidden directories using chkdirs... not found 212s OK 212s **** Test for '^Checking `lkm'\.\.\. finished$' 212s Checking `lkm'... finished 212s OK 212s **** Test for '^Checking `rexedcs'\.\.\. not found$' 212s Checking `rexedcs'... not found 212s OK 212s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 212s Checking `sniffer'... WARNING 212s OK 212s **** Test for '^WARNING: Output from ifpromisc:$' 212s WARNING: Output from ifpromisc: 212s OK 212s **** Test for '^lo: not promisc and no packet sniffer sockets$' 212s lo: not promisc and no packet sniffer sockets 212s OK 212s **** Test for '^Checking `w55808'\.\.\. not found$' 212s Checking `w55808'... not found 212s OK 212s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 212s Checking `wted'... not found 212s OK 212s **** Test for '^Checking `scalper'\.\.\. not found$' 212s Checking `scalper'... not found 212s OK 212s **** Test for '^Checking `slapper'\.\.\. not found$' 212s Checking `slapper'... not found 212s OK 212s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 212s Checking `z2'... not found 212s OK 212s **** Test for '^Checking `chkutmp'\.\.\.' 212s Checking `chkutmp'... not found 212s OK 212s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 212s Checking `OSX_RSPLUG'... not tested 212s OK 212s ** PASS: Testing: chkrootkit-1-full (/usr/sbin/chkrootkit) done: PASS 212s *** Unexpected (unmatched) lines follow (for info): 212s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 212s ** Testing: chkrootkit-2-quiet (/usr/sbin/chkrootkit -q) ... 212s *** Output 213s WARNING: The following suspicious files and directories were found: 213s /usr/lib/... [Not from a Debian package] 213s /usr/lib/.aaa [Not from a Debian package] 213s /usr/lib/.1 [Not from a Debian package] 213s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 213s /usr/lib/.bbb [Not from a Debian package] 213s /usr/lib/.1DIR [Not from a Debian package] 213s /usr/lib/.DIR-aaa [Not from a Debian package] 213s /usr/lib/...DIR [Not from a Debian package] 213s 215s WARNING: Possible Linux.Xor.DDoS installed: 215s /tmp/clean/ps [Not from a Debian package] 215s /tmp/clean/head [Not from a Debian package] 215s /tmp/clean/cut [Not from a Debian package] 215s /tmp/clean/ls [Not from a Debian package] 215s /tmp/clean/echo [Not from a Debian package] 215s /tmp/clean/awk [Not from a Debian package] 215s /tmp/clean/dpkg-query [Not from a Debian package] 215s /tmp/clean/sed [Not from a Debian package] 215s /tmp/clean/strings [Not from a Debian package] 215s /tmp/clean/netstat [Not from a Debian package] 215s /tmp/clean/uname [Not from a Debian package] 215s /tmp/clean/id [Not from a Debian package] 215s /tmp/clean/grep [Not from a Debian package] 215s /tmp/clean/find [Not from a Debian package] 215s /tmp/clean/dirname [Not from a Debian package] 215s /tmp/clean/xargs [Not from a Debian package] 215s /tmp/clean/ss [Not from a Debian package] 215s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 215s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 215s 223s WARNING: Output from ifpromisc: 223s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 223s 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Test for '^WARNING: The following suspicious files and directories were found:$' 223s WARNING: The following suspicious files and directories were found: 223s OK 223s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 223s /usr/lib/.1 [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 223s /usr/lib/.aaa [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 223s /usr/lib/.1DIR [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 223s /usr/lib/...DIR [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 223s /usr/lib/.bbb [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 223s /usr/lib/.DIR-aaa [Not from a Debian package] 223s OK 223s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 223s /usr/lib/... [Not from a Debian package] 223s OK 223s **** Test for '^$' 223s 223s 223s 223s OK 223s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 223s WARNING: Possible Linux.Xor.DDoS installed: 223s OK 223s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 223s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 223s OK 223s **** Test for '^/tmp/clean/.+$' 223s /tmp/clean/ps [Not from a Debian package] 223s /tmp/clean/head [Not from a Debian package] 223s /tmp/clean/cut [Not from a Debian package] 223s /tmp/clean/ls [Not from a Debian package] 223s /tmp/clean/echo [Not from a Debian package] 223s /tmp/clean/awk [Not from a Debian package] 223s /tmp/clean/dpkg-query [Not from a Debian package] 223s /tmp/clean/sed [Not from a Debian package] 223s /tmp/clean/strings [Not from a Debian package] 223s /tmp/clean/netstat [Not from a Debian package] 223s /tmp/clean/uname [Not from a Debian package] 223s /tmp/clean/id [Not from a Debian package] 223s /tmp/clean/grep [Not from a Debian package] 223s /tmp/clean/find [Not from a Debian package] 223s /tmp/clean/dirname [Not from a Debian package] 223s /tmp/clean/xargs [Not from a Debian package] 223s /tmp/clean/ss [Not from a Debian package] 223s OK 223s ** PASS: Testing: chkrootkit-2-quiet (/usr/sbin/chkrootkit -q) done: PASS 223s *** Unexpected (unmatched) lines follow (for info): 223s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 223s * Testing: filtering of sniffer (-s) 223s ** Testing: chkrootkit-sniffer-01-full (chkrootkit sniffer) ... 223s *** Output 223s ROOTDIR is `/' 223s Checking `sniffer'... WARNING 223s 223s WARNING: Output from ifpromisc: 223s lo: not promisc and no packet sniffer sockets 223s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 223s 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Test for '^ROOTDIR is `/'$' 223s ROOTDIR is `/' 223s OK 223s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 223s Checking `sniffer'... WARNING 223s OK 223s **** Test for '^$' 223s 223s 223s OK 223s **** Test for 'WARNING: Output from ifpromisc:$' 223s WARNING: Output from ifpromisc: 223s OK 223s **** Test for '^lo: not promisc and no packet sniffer sockets$' 223s lo: not promisc and no packet sniffer sockets 223s OK 223s ** PASS: Testing: chkrootkit-sniffer-01-full (chkrootkit sniffer) done: PASS 223s ** Testing: chkrootkit-sniffer-02-full-with-s (chkrootkit -s (PACKET SNIFFER|not promisc) sniffer) ... 223s *** Output 223s ROOTDIR is `/' 223s Checking `sniffer'... not found 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Test for '^ROOTDIR is `/'$' 223s ROOTDIR is `/' 223s OK 223s **** Test for '^Checking `sniffer'\.\.\. not found$' 223s Checking `sniffer'... not found 223s OK 223s ** PASS: Testing: chkrootkit-sniffer-02-full-with-s (chkrootkit -s (PACKET SNIFFER|not promisc) sniffer) done: PASS 223s ** Testing: chkrootkit-sniffer-03-quiet-with-s (chkrootkit -q -s PACKET SNIFFER sniffer) ... 223s *** Output 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Expected is empty, so output should be empty 223s Output is indeed empty: PASS 223s ** PASS: Testing: chkrootkit-sniffer-03-quiet-with-s (chkrootkit -q -s PACKET SNIFFER sniffer) done: PASS 223s * Testing: chkrootkit-daily - should give no output when disabled 223s ** Testing: cron-1-with-no-config (chkrootkit-daily) ... 223s *** Output 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Expected is empty, so output should be empty 223s Output is indeed empty: PASS 223s ** PASS: Testing: cron-1-with-no-config (chkrootkit-daily) done: PASS 223s ** Testing: cron-2-disabled (chkrootkit-daily) ... 223s *** Output 223s **** Files in log 223s total 8.0K 223s drwxr-xr-x 2 root root 4.0K Sep 29 19:50 . 223s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 223s *** Test of content of output follows... 223s **** Expected is empty, so output should be empty 223s Output is indeed empty: PASS 223s ** PASS: Testing: cron-2-disabled (chkrootkit-daily) done: PASS 223s * Testing: chkrootkit-daily (without diff mode, full output, no MAILTO) 223s ** Testing: cron-no-diff-mode-01-full (chkrootkit-daily) ... 223s *** Output 234s ROOTDIR is `/' 234s Checking `amd'... not infected 234s Checking `basename'... not infected 234s Checking `biff'... not infected 234s Checking `chfn'... not infected 234s Checking `chsh'... not infected 234s Checking `cron'... not infected 234s Checking `crontab'... not infected 234s Checking `date'... not infected 234s Checking `du'... not infected 234s Checking `dirname'... not infected 234s Checking `echo'... not infected 234s Checking `egrep'... not infected 234s Checking `env'... not infected 234s Checking `find'... not infected 234s Checking `fingerd'... not infected 234s Checking `gpm'... not infected 234s Checking `grep'... not infected 234s Checking `hdparm'... not infected 234s Checking `su'... not infected 234s Checking `ifconfig'... not infected 234s Checking `inetd'... not infected 234s Checking `inetdconf'... not infected 234s Checking `identd'... not infected 234s Checking `init'... not infected 234s Checking `killall'... not infected 234s Checking `ldsopreload'... not infected 234s Checking `login'... not infected 234s Checking `ls'... not infected 234s Checking `lsof'... not infected 234s Checking `mail'... not infected 234s Checking `mingetty'... not infected 234s Checking `netstat'... not infected 234s Checking `named'... not infected 234s Checking `passwd'... not infected 234s Checking `pidof'... not infected 234s Checking `pop2'... not infected 234s Checking `pop3'... not infected 234s Checking `ps'... not infected 234s Checking `pstree'... not infected 234s Checking `rpcinfo'... not infected 234s Checking `rlogind'... not infected 234s Checking `rshd'... not infected 234s Checking `slogin'... not infected 234s Checking `sendmail'... not infected 234s Checking `sshd'... not infected 234s Checking `syslogd'... not infected 234s Checking `tar'... not infected 234s Checking `tcpd'... not infected 234s Checking `tcpdump'... not infected 234s Checking `top'... not infected 234s Checking `telnetd'... not infected 234s Checking `timed'... not infected 234s Checking `traceroute'... not infected 234s Checking `vdir'... not infected 234s Checking `w'... not infected 234s Checking `write'... not infected 234s Checking `aliens'... started 234s Searching for suspicious files in /dev... not found 234s Searching for known suspicious directories... not found 234s Searching for known suspicious files... not found 234s Searching for sniffer's logs... not found 234s Searching for HiDrootkit rootkit... not found 234s Searching for t0rn rootkit... not found 234s Searching for t0rn v8 (or variation)... not found 234s Searching for Lion rootkit... not found 234s Searching for RSHA rootkit... not found 234s Searching for RH-Sharpe rootkit... not found 234s Searching for Ambient (ark) rootkit... not found 234s Searching for suspicious files and dirs... WARNING 234s 234s WARNING: The following suspicious files and directories were found: 234s /usr/lib/... [Not from a Debian package] 234s /usr/lib/.aaa [Not from a Debian package] 234s /usr/lib/.1 [Not from a Debian package] 234s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 234s /usr/lib/.bbb [Not from a Debian package] 234s /usr/lib/.1DIR [Not from a Debian package] 234s /usr/lib/.DIR-aaa [Not from a Debian package] 234s /usr/lib/...DIR [Not from a Debian package] 234s 234s Searching for LPD Worm... not found 234s Searching for Ramen Worm rootkit... not found 234s Searching for Maniac rootkit... not found 234s Searching for RK17 rootkit... not found 234s Searching for Ducoci rootkit... not found 234s Searching for Adore Worm... not found 234s Searching for ShitC Worm... not found 234s Searching for Omega Worm... not found 234s Searching for Sadmind/IIS Worm... not found 234s Searching for MonKit... not found 234s Searching for Showtee rootkit... not found 234s Searching for OpticKit... not found 234s Searching for T.R.K... not found 234s Searching for Mithra rootkit... not found 234s Searching for OBSD rootkit v1... not tested 234s Searching for LOC rootkit... not found 234s Searching for Romanian rootkit... not found 234s Searching for HKRK rootkit... not found 234s Searching for Suckit rootkit... not found 234s Searching for Volc rootkit... not found 234s Searching for Gold2 rootkit... not found 234s Searching for TC2 rootkit... not found 234s Searching for Anonoying rootkit... not found 234s Searching for ZK rootkit... not found 234s Searching for ShKit rootkit... not found 234s Searching for AjaKit rootkit... not found 234s Searching for zaRwT rootkit... not found 234s Searching for Madalin rootkit... not found 234s Searching for Fu rootkit... not found 234s Searching for Kenga3 rootkit... not found 234s Searching for ESRK rootkit... not found 234s Searching for rootedoor... not found 234s Searching for ENYELKM rootkit... not found 234s Searching for common ssh-scanners... not found 234s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 234s Searching for Linux/Ebury 1.6... not tested 234s Searching for 64-bit Linux Rootkit... not found 234s Searching for 64-bit Linux Rootkit modules... not found 234s Searching for Mumblehard... not found 234s Searching for Backdoor.Linux.Mokes.a... not found 234s Searching for Malicious TinyDNS... not found 234s Searching for Linux.Xor.DDoS... WARNING 234s 234s WARNING: Possible Linux.Xor.DDoS installed: 234s /tmp/clean/ps [Not from a Debian package] 234s /tmp/clean/head [Not from a Debian package] 234s /tmp/clean/cut [Not from a Debian package] 234s /tmp/clean/ls [Not from a Debian package] 234s /tmp/clean/echo [Not from a Debian package] 234s /tmp/clean/awk [Not from a Debian package] 234s /tmp/clean/dpkg-query [Not from a Debian package] 234s /tmp/clean/sed [Not from a Debian package] 234s /tmp/clean/strings [Not from a Debian package] 234s /tmp/clean/netstat [Not from a Debian package] 234s /tmp/clean/uname [Not from a Debian package] 234s /tmp/clean/id [Not from a Debian package] 234s /tmp/clean/grep [Not from a Debian package] 234s /tmp/clean/find [Not from a Debian package] 234s /tmp/clean/dirname [Not from a Debian package] 234s /tmp/clean/xargs [Not from a Debian package] 234s /tmp/clean/ss [Not from a Debian package] 234s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 234s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 234s 234s Searching for Linux.Proxy.1.0... not found 234s Searching for CrossRAT... not found 234s Searching for Hidden Cobra... not found 234s Searching for Rocke Miner rootkit... not found 234s Searching for PWNLNX4 lkm rootkit... not found 234s Searching for PWNLNX6 lkm rootkit... not found 234s Searching for Umbreon lrk... not found 234s Searching for Kinsing.a backdoor rootkit... not found 234s Searching for RotaJakiro backdoor rootkit... not found 234s Searching for Syslogk LKM rootkit... not found 234s Searching for Kovid LKM rootkit... not tested 234s Searching for Tsunami DDoS Malware rootkit... not found 234s Searching for Linux BPF Door... not found 234s Searching for suspect PHP files... not found 234s Searching for zero-size shell history files in /root... not found 234s Searching for hardlinked shell history files in /root... not found 234s Checking `aliens'... finished 234s Checking `asp'... not infected 234s Checking `bindshell'... not found 234s Checking `lkm'... started 234s Searching for Adore LKM... not tested 234s Searching for sebek LKM (Adore based)... not tested 234s Searching for knark LKM rootkit... not found 234s Searching for for hidden processes with chkproc... not found 234s Searching for for hidden directories using chkdirs... not found 234s Checking `lkm'... finished 234s Checking `rexedcs'... not found 234s Checking `sniffer'... WARNING 234s 234s WARNING: Output from ifpromisc: 234s lo: not promisc and no packet sniffer sockets 234s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 234s 234s Checking `w55808'... not found 234s Checking `wted'... not found 234s Checking `scalper'... not found 234s Checking `slapper'... not found 234s Checking `z2'... not found 234s Checking `chkutmp'... not found 234s Checking `OSX_RSPLUG'... not tested 234s **** Files in log 234s total 80K 234s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 234s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 234s -rw-r--r-- 1 root root 21K Nov 26 20:43 chkrootkit-daily.log 234s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today 234s -rw-r--r-- 1 root root 21K Nov 26 20:43 log.today.raw 234s *** Test of content of output follows... 234s **** Test for '^ROOTDIR is `/'$' 234s ROOTDIR is `/' 234s OK 234s **** Test for '^Checking `amd'\.\.\. not infected$' 234s Checking `amd'... not infected 234s OK 234s **** Test for '^Checking `basename'\.\.\. not infected$' 234s Checking `basename'... not infected 234s OK 234s **** Test for '^Checking `biff'\.\.\. not infected$' 234s Checking `biff'... not infected 234s OK 234s **** Test for '^Checking `chfn'\.\.\. not infected$' 234s Checking `chfn'... not infected 234s OK 234s **** Test for '^Checking `chsh'\.\.\. not infected$' 234s Checking `chsh'... not infected 234s OK 234s **** Test for '^Checking `cron'\.\.\. not infected$' 234s Checking `cron'... not infected 234s OK 234s **** Test for '^Checking `crontab'\.\.\. not infected$' 234s Checking `crontab'... not infected 234s OK 234s **** Test for '^Checking `date'\.\.\. not infected$' 234s Checking `date'... not infected 234s OK 234s **** Test for '^Checking `du'\.\.\. not infected$' 234s Checking `du'... not infected 234s OK 234s **** Test for '^Checking `dirname'\.\.\. not infected$' 234s Checking `dirname'... not infected 234s OK 234s **** Test for '^Checking `echo'\.\.\. not infected$' 234s Checking `echo'... not infected 234s OK 234s **** Test for '^Checking `egrep'\.\.\. not infected$' 234s Checking `egrep'... not infected 234s OK 234s **** Test for '^Checking `env'\.\.\. not infected$' 234s Checking `env'... not infected 234s OK 234s **** Test for '^Checking `find'\.\.\. not infected$' 234s Checking `find'... not infected 234s OK 234s **** Test for '^Checking `fingerd'\.\.\. not infected$' 234s Checking `fingerd'... not infected 234s OK 234s **** Test for '^Checking `gpm'\.\.\. not infected$' 234s Checking `gpm'... not infected 234s OK 234s **** Test for '^Checking `grep'\.\.\. not infected$' 234s Checking `grep'... not infected 234s OK 234s **** Test for '^Checking `hdparm'\.\.\. not infected$' 234s Checking `hdparm'... not infected 234s OK 234s **** Test for '^Checking `su'\.\.\. not infected$' 234s Checking `su'... not infected 234s OK 234s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 234s Checking `ifconfig'... not infected 234s OK 234s **** Test for '^Checking `inetd'\.\.\. not infected$' 234s Checking `inetd'... not infected 234s OK 234s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 234s Checking `inetdconf'... not infected 234s OK 234s **** Test for '^Checking `identd'\.\.\. not infected$' 234s Checking `identd'... not infected 234s OK 234s **** Test for '^Checking `init'\.\.\. not infected$' 234s Checking `init'... not infected 234s OK 234s **** Test for '^Checking `killall'\.\.\. not infected$' 234s Checking `killall'... not infected 234s OK 234s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 234s Checking `ldsopreload'... not infected 234s OK 234s **** Test for '^Checking `login'\.\.\. not infected$' 234s Checking `login'... not infected 234s OK 234s **** Test for '^Checking `ls'\.\.\. not infected$' 234s Checking `ls'... not infected 234s OK 234s **** Test for '^Checking `lsof'\.\.\. not infected$' 234s Checking `lsof'... not infected 234s OK 234s **** Test for '^Checking `mail'\.\.\. not infected$' 234s Checking `mail'... not infected 234s OK 234s **** Test for '^Checking `mingetty'\.\.\. not infected$' 234s Checking `mingetty'... not infected 234s OK 234s **** Test for '^Checking `netstat'\.\.\. not infected$' 234s Checking `netstat'... not infected 234s OK 234s **** Test for '^Checking `named'\.\.\. not infected$' 234s Checking `named'... not infected 234s OK 234s **** Test for '^Checking `passwd'\.\.\. not infected$' 234s Checking `passwd'... not infected 234s OK 234s **** Test for '^Checking `pidof'\.\.\. not infected$' 234s Checking `pidof'... not infected 234s OK 234s **** Test for '^Checking `pop2'\.\.\. not infected$' 234s Checking `pop2'... not infected 234s OK 234s **** Test for '^Checking `pop3'\.\.\. not infected$' 234s Checking `pop3'... not infected 234s OK 234s **** Test for '^Checking `ps'\.\.\. not infected$' 234s Checking `ps'... not infected 234s OK 234s **** Test for '^Checking `pstree'\.\.\. not infected$' 234s Checking `pstree'... not infected 234s OK 234s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 234s Checking `rpcinfo'... not infected 234s OK 234s **** Test for '^Checking `rlogind'\.\.\. not infected$' 234s Checking `rlogind'... not infected 234s OK 234s **** Test for '^Checking `rshd'\.\.\. not infected$' 234s Checking `rshd'... not infected 234s OK 234s **** Test for '^Checking `slogin'\.\.\. not infected$' 234s Checking `slogin'... not infected 234s OK 234s **** Test for '^Checking `sendmail'\.\.\. not infected$' 234s Checking `sendmail'... not infected 234s OK 234s **** Test for '^Checking `sshd'\.\.\. not infected$' 234s Checking `sshd'... not infected 234s OK 234s **** Test for '^Checking `syslogd'\.\.\. not infected$' 234s Checking `syslogd'... not infected 234s OK 234s **** Test for '^Checking `tar'\.\.\. not infected$' 234s Checking `tar'... not infected 234s OK 234s **** Test for '^Checking `tcpd'\.\.\. not infected$' 234s Checking `tcpd'... not infected 234s OK 234s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 234s Checking `tcpdump'... not infected 234s OK 234s **** Test for '^Checking `top'\.\.\. not infected$' 234s Checking `top'... not infected 234s OK 234s **** Test for '^Checking `telnetd'\.\.\. not infected$' 234s Checking `telnetd'... not infected 234s OK 234s **** Test for '^Checking `timed'\.\.\. not infected$' 234s Checking `timed'... not infected 234s OK 234s **** Test for '^Checking `traceroute'\.\.\. not infected$' 234s Checking `traceroute'... not infected 234s OK 234s **** Test for '^Checking `vdir'\.\.\. not infected$' 234s Checking `vdir'... not infected 234s OK 234s **** Test for '^Checking `w'\.\.\. not infected$' 234s Checking `w'... not infected 234s OK 234s **** Test for '^Checking `write'\.\.\. not infected$' 234s Checking `write'... not infected 234s OK 234s **** Test for '^Checking `aliens'\.\.\. started$' 234s Checking `aliens'... started 234s OK 234s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 234s Searching for suspicious files in /dev... not found 234s OK 234s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 234s Searching for known suspicious directories... not found 234s OK 234s **** Test for '^Searching for known suspicious files\.\.\. not found$' 234s Searching for known suspicious files... not found 234s OK 234s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 234s Searching for sniffer's logs... not found 234s OK 234s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 234s Searching for HiDrootkit rootkit... not found 234s OK 234s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 234s Searching for t0rn rootkit... not found 234s OK 234s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 234s Searching for t0rn v8 (or variation)... not found 234s OK 234s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 234s Searching for Lion rootkit... not found 234s OK 234s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 234s Searching for RSHA rootkit... not found 234s OK 234s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 234s Searching for RH-Sharpe rootkit... not found 234s OK 234s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 234s Searching for Ambient (ark) rootkit... not found 234s OK 234s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 234s Searching for suspicious files and dirs... WARNING 234s OK 234s **** Test for '^$' 234s 234s 234s 234s 234s 234s 234s OK 234s **** Test for '^WARNING: The following suspicious files and directories were found:$' 234s WARNING: The following suspicious files and directories were found: 234s OK 234s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 234s /usr/lib/.1 [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 234s /usr/lib/.aaa [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 234s /usr/lib/.1DIR [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 234s /usr/lib/...DIR [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 234s /usr/lib/.bbb [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 234s /usr/lib/.DIR-aaa [Not from a Debian package] 234s OK 234s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 234s /usr/lib/... [Not from a Debian package] 234s OK 234s **** Test for '^Searching for LPD Worm\.\.\. not found$' 234s Searching for LPD Worm... not found 234s OK 234s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 234s Searching for Ramen Worm rootkit... not found 234s OK 234s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 234s Searching for Maniac rootkit... not found 234s OK 234s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 234s Searching for RK17 rootkit... not found 234s OK 234s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 234s Searching for Ducoci rootkit... not found 234s OK 234s **** Test for '^Searching for Adore Worm\.\.\. not found$' 234s Searching for Adore Worm... not found 234s OK 234s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 234s Searching for ShitC Worm... not found 234s OK 234s **** Test for '^Searching for Omega Worm\.\.\. not found$' 234s Searching for Omega Worm... not found 234s OK 234s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 234s Searching for Sadmind/IIS Worm... not found 234s OK 234s **** Test for '^Searching for MonKit\.\.\. not found$' 234s Searching for MonKit... not found 234s OK 234s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 234s Searching for Showtee rootkit... not found 234s OK 234s **** Test for '^Searching for OpticKit\.\.\. not found$' 234s Searching for OpticKit... not found 234s OK 234s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 234s Searching for T.R.K... not found 234s OK 234s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 234s Searching for Mithra rootkit... not found 234s OK 234s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 234s Searching for OBSD rootkit v1... not tested 234s OK 234s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 234s Searching for LOC rootkit... not found 234s OK 234s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 234s Searching for Romanian rootkit... not found 234s OK 234s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 234s Searching for HKRK rootkit... not found 234s OK 234s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 234s Searching for Suckit rootkit... not found 234s OK 234s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 234s Searching for Volc rootkit... not found 234s OK 234s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 234s Searching for Gold2 rootkit... not found 234s OK 234s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 234s Searching for TC2 rootkit... not found 234s OK 234s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 234s Searching for Anonoying rootkit... not found 234s OK 234s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 234s Searching for ZK rootkit... not found 234s OK 234s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 234s Searching for ShKit rootkit... not found 234s OK 234s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 234s Searching for AjaKit rootkit... not found 234s OK 234s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 234s Searching for zaRwT rootkit... not found 234s OK 234s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 234s Searching for Madalin rootkit... not found 234s OK 234s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 234s Searching for Fu rootkit... not found 234s OK 234s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 234s Searching for Kenga3 rootkit... not found 234s OK 234s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 234s Searching for ESRK rootkit... not found 234s OK 234s **** Test for '^Searching for rootedoor\.\.\. not found$' 234s Searching for rootedoor... not found 234s OK 234s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 234s Searching for ENYELKM rootkit... not found 234s OK 234s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 234s Searching for common ssh-scanners... not found 234s OK 234s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 234s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 234s OK 234s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 234s Searching for Linux/Ebury 1.6... not tested 234s OK 234s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 234s Searching for 64-bit Linux Rootkit... not found 234s OK 234s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 234s Searching for 64-bit Linux Rootkit modules... not found 234s OK 234s **** Test for '^Searching for Mumblehard\.\.\. not found$' 234s Searching for Mumblehard... not found 234s OK 234s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 234s Searching for Backdoor.Linux.Mokes.a... not found 234s OK 234s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 234s Searching for Malicious TinyDNS... not found 234s OK 234s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 234s Searching for Linux.Xor.DDoS... WARNING 234s OK 234s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 234s WARNING: Possible Linux.Xor.DDoS installed: 234s OK 234s **** Test for '^/tmp/clean/.+$' 234s /tmp/clean/ps [Not from a Debian package] 234s /tmp/clean/head [Not from a Debian package] 234s /tmp/clean/cut [Not from a Debian package] 234s /tmp/clean/ls [Not from a Debian package] 234s /tmp/clean/echo [Not from a Debian package] 234s /tmp/clean/awk [Not from a Debian package] 234s /tmp/clean/dpkg-query [Not from a Debian package] 234s /tmp/clean/sed [Not from a Debian package] 234s /tmp/clean/strings [Not from a Debian package] 234s /tmp/clean/netstat [Not from a Debian package] 234s /tmp/clean/uname [Not from a Debian package] 234s /tmp/clean/id [Not from a Debian package] 234s /tmp/clean/grep [Not from a Debian package] 234s /tmp/clean/find [Not from a Debian package] 234s /tmp/clean/dirname [Not from a Debian package] 234s /tmp/clean/xargs [Not from a Debian package] 234s /tmp/clean/ss [Not from a Debian package] 234s OK 234s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 234s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 234s OK 234s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 234s Searching for Linux.Proxy.1.0... not found 234s OK 234s **** Test for '^Searching for CrossRAT\.\.\. not found$' 234s Searching for CrossRAT... not found 234s OK 234s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 234s Searching for Hidden Cobra... not found 234s OK 234s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 234s Searching for Rocke Miner rootkit... not found 234s OK 234s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 234s Searching for PWNLNX4 lkm rootkit... not found 234s OK 234s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 234s Searching for PWNLNX6 lkm rootkit... not found 234s OK 234s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 234s Searching for Umbreon lrk... not found 234s OK 234s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 234s Searching for Kinsing.a backdoor rootkit... not found 234s OK 234s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 234s Searching for RotaJakiro backdoor rootkit... not found 234s OK 234s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 234s Searching for Syslogk LKM rootkit... not found 234s OK 234s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 234s Searching for Kovid LKM rootkit... not tested 234s OK 234s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 234s Searching for Tsunami DDoS Malware rootkit... not found 234s OK 234s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 234s Searching for Linux BPF Door... not found 234s OK 234s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 234s Searching for suspect PHP files... not found 234s OK 234s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 234s Searching for zero-size shell history files in /root... not found 234s OK 234s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 234s Searching for hardlinked shell history files in /root... not found 234s OK 234s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 234s Searching for suspect PHP files... not found 234s OK 234s **** Test for '^Checking `aliens'\.\.\. finished$' 234s Checking `aliens'... finished 234s OK 234s **** Test for '^Checking `asp'\.\.\. not infected$' 234s Checking `asp'... not infected 234s OK 234s **** Test for '^Checking `bindshell'\.\.\. not found$' 234s Checking `bindshell'... not found 234s OK 234s **** Test for '^Checking `lkm'\.\.\. started$' 234s Checking `lkm'... started 234s OK 234s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 234s Searching for Adore LKM... not tested 234s OK 234s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 234s Searching for sebek LKM (Adore based)... not tested 234s OK 234s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 234s Searching for knark LKM rootkit... not found 234s OK 234s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 234s Searching for for hidden processes with chkproc... not found 234s OK 234s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 234s Searching for for hidden directories using chkdirs... not found 234s OK 234s **** Test for '^Checking `lkm'\.\.\. finished$' 234s Checking `lkm'... finished 234s OK 234s **** Test for '^Checking `rexedcs'\.\.\. not found$' 234s Checking `rexedcs'... not found 234s OK 234s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 234s Checking `sniffer'... WARNING 234s OK 234s **** Test for '^WARNING: Output from ifpromisc:$' 234s WARNING: Output from ifpromisc: 234s OK 234s **** Test for '^lo: not promisc and no packet sniffer sockets$' 234s lo: not promisc and no packet sniffer sockets 234s OK 234s **** Test for '^Checking `w55808'\.\.\. not found$' 234s Checking `w55808'... not found 234s OK 234s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 234s Checking `wted'... not found 234s OK 234s **** Test for '^Checking `scalper'\.\.\. not found$' 234s Checking `scalper'... not found 234s OK 234s **** Test for '^Checking `slapper'\.\.\. not found$' 234s Checking `slapper'... not found 234s OK 234s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 234s Checking `z2'... not found 234s OK 234s **** Test for '^Checking `chkutmp'\.\.\.' 234s Checking `chkutmp'... not found 234s OK 234s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 234s Checking `OSX_RSPLUG'... not tested 234s OK 234s ** PASS: Testing: cron-no-diff-mode-01-full (chkrootkit-daily) done: PASS 234s *** Unexpected (unmatched) lines follow (for info): 234s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 234s ** Testing: cron-no-diff-mode-02-full-filter-and-ignore (chkrootkit-daily) ... 234s *** Output 245s ROOTDIR is `/' 245s Checking `amd'... not infected 245s Checking `basename'... not infected 245s Checking `biff'... not infected 245s Checking `chfn'... not infected 245s Checking `chsh'... not infected 245s Checking `cron'... not infected 245s Checking `crontab'... not infected 245s Checking `date'... not infected 245s Checking `du'... not infected 245s Checking `dirname'... not infected 245s Checking `echo'... not infected 245s Checking `egrep'... not infected 245s Checking `env'... not infected 245s Checking `find'... not infected 245s Checking `fingerd'... not infected 245s Checking `gpm'... not infected 245s Checking `grep'... not infected 245s Checking `hdparm'... not infected 245s Checking `su'... not infected 245s Checking `ifconfig'... not infected 245s Checking `inetd'... not infected 245s Checking `inetdconf'... not infected 245s Checking `identd'... not infected 245s Checking `init'... not infected 245s Checking `killall'... not infected 245s Checking `ldsopreload'... not infected 245s Checking `login'... not infected 245s Checking `ls'... not infected 245s Checking `lsof'... not infected 245s Checking `mail'... not infected 245s Checking `mingetty'... not infected 245s Checking `netstat'... not infected 245s Checking `named'... not infected 245s Checking `passwd'... not infected 245s Checking `pidof'... not infected 245s Checking `pop2'... not infected 245s Checking `pop3'... not infected 245s Checking `ps'... not infected 245s Checking `pstree'... not infected 245s Checking `rpcinfo'... not infected 245s Checking `rlogind'... not infected 245s Checking `rshd'... not infected 245s Checking `slogin'... not infected 245s Checking `sendmail'... not infected 245s Checking `sshd'... not infected 245s Checking `syslogd'... not infected 245s Checking `tar'... not infected 245s Checking `tcpd'... not infected 245s Checking `tcpdump'... not infected 245s Checking `top'... not infected 245s Checking `telnetd'... not infected 245s Checking `timed'... not infected 245s Checking `traceroute'... not infected 245s Checking `vdir'... not infected 245s Checking `w'... not infected 245s Checking `write'... not infected 245s Checking `aliens'... started 245s Searching for suspicious files in /dev... not found 245s Searching for known suspicious directories... not found 245s Searching for known suspicious files... not found 245s Searching for sniffer's logs... not found 245s Searching for HiDrootkit rootkit... not found 245s Searching for t0rn rootkit... not found 245s Searching for t0rn v8 (or variation)... not found 245s Searching for Lion rootkit... not found 245s Searching for RSHA rootkit... not found 245s Searching for RH-Sharpe rootkit... not found 245s Searching for Ambient (ark) rootkit... not found 245s Searching for suspicious files and dirs... WARNING 245s 245s WARNING: The following suspicious files and directories were found: 245s /usr/lib/... [Not from a Debian package] 245s /usr/lib/.1 [Not from a Debian package] 245s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 245s CHANGED-IN-FILTER_bb [Not from a Debian package] 245s /usr/lib/.1DIR [Not from a Debian package] 245s /usr/lib/...DIR [Not from a Debian package] 245s 245s Searching for LPD Worm... not found 245s Searching for Ramen Worm rootkit... not found 245s Searching for Maniac rootkit... not found 245s Searching for RK17 rootkit... not found 245s Searching for Ducoci rootkit... not found 245s Searching for Adore Worm... not found 245s Searching for ShitC Worm... not found 245s Searching for Omega Worm... not found 245s Searching for Sadmind/IIS Worm... not found 245s Searching for MonKit... not found 245s Searching for Showtee rootkit... not found 245s Searching for OpticKit... not found 245s Searching for T.R.K... not found 245s Searching for Mithra rootkit... not found 245s Searching for OBSD rootkit v1... not tested 245s Searching for LOC rootkit... not found 245s Searching for Romanian rootkit... not found 245s Searching for HKRK rootkit... not found 245s Searching for Suckit rootkit... not found 245s Searching for Volc rootkit... not found 245s Searching for Gold2 rootkit... not found 245s Searching for TC2 rootkit... not found 245s Searching for Anonoying rootkit... not found 245s Searching for ZK rootkit... not found 245s Searching for ShKit rootkit... not found 245s Searching for AjaKit rootkit... not found 245s Searching for zaRwT rootkit... not found 245s Searching for Madalin rootkit... not found 245s Searching for Fu rootkit... not found 245s Searching for Kenga3 rootkit... not found 245s Searching for ESRK rootkit... not found 245s Searching for rootedoor... not found 245s Searching for ENYELKM rootkit... not found 245s Searching for common ssh-scanners... not found 245s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 245s Searching for Linux/Ebury 1.6... not tested 245s Searching for 64-bit Linux Rootkit... not found 245s Searching for 64-bit Linux Rootkit modules... not found 245s Searching for Mumblehard... not found 246s Searching for Backdoor.Linux.Mokes.a... not found 246s Searching for Malicious TinyDNS... not found 246s Searching for Linux.Xor.DDoS... WARNING 246s 246s WARNING: Possible Linux.Xor.DDoS installed: 246s /tmp/clean/ps [Not from a Debian package] 246s /tmp/clean/head [Not from a Debian package] 246s /tmp/clean/cut [Not from a Debian package] 246s /tmp/clean/ls [Not from a Debian package] 246s /tmp/clean/echo [Not from a Debian package] 246s /tmp/clean/awk [Not from a Debian package] 246s /tmp/clean/dpkg-query [Not from a Debian package] 246s /tmp/clean/sed [Not from a Debian package] 246s /tmp/clean/strings [Not from a Debian package] 246s /tmp/clean/netstat [Not from a Debian package] 246s /tmp/clean/uname [Not from a Debian package] 246s /tmp/clean/id [Not from a Debian package] 246s /tmp/clean/grep [Not from a Debian package] 246s /tmp/clean/find [Not from a Debian package] 246s /tmp/clean/dirname [Not from a Debian package] 246s /tmp/clean/xargs [Not from a Debian package] 246s /tmp/clean/ss [Not from a Debian package] 246s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 246s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 246s 246s Searching for Linux.Proxy.1.0... not found 246s Searching for CrossRAT... not found 246s Searching for Hidden Cobra... not found 246s Searching for Rocke Miner rootkit... not found 246s Searching for PWNLNX4 lkm rootkit... not found 246s Searching for PWNLNX6 lkm rootkit... not found 246s Searching for Umbreon lrk... not found 246s Searching for Kinsing.a backdoor rootkit... not found 246s Searching for RotaJakiro backdoor rootkit... not found 246s Searching for Syslogk LKM rootkit... not found 246s Searching for Kovid LKM rootkit... not tested 246s Searching for Tsunami DDoS Malware rootkit... not found 246s Searching for Linux BPF Door... not found 246s Searching for suspect PHP files... not found 246s Searching for zero-size shell history files in /root... not found 246s Searching for hardlinked shell history files in /root... not found 246s Checking `aliens'... finished 246s Checking `asp'... not infected 246s Checking `bindshell'... not found 246s Checking `lkm'... started 246s Searching for Adore LKM... not tested 246s Searching for sebek LKM (Adore based)... not tested 246s Searching for knark LKM rootkit... not found 246s Searching for for hidden processes with chkproc... not found 246s Searching for for hidden directories using chkdirs... not found 246s Checking `lkm'... finished 246s Checking `rexedcs'... not found 246s Checking `sniffer'... WARNING 246s 246s WARNING: Output from ifpromisc: 246s lo: not promisc and no packet sniffer sockets 246s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 246s 246s Checking `w55808'... not found 246s Checking `wted'... not found 246s Checking `scalper'... not found 246s Checking `slapper'... not found 246s Checking `z2'... not found 246s Checking `chkutmp'... not found 246s Checking `OSX_RSPLUG'... not tested 246s **** Files in log 246s total 80K 246s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 246s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 246s -rw-r--r-- 1 root root 21K Nov 26 20:44 chkrootkit-daily.log 246s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today 246s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today.raw 246s *** Test of content of output follows... 246s **** Test for '^ROOTDIR is `/'$' 246s ROOTDIR is `/' 246s OK 246s **** Test for '^Checking `amd'\.\.\. not infected$' 246s Checking `amd'... not infected 246s OK 246s **** Test for '^Checking `basename'\.\.\. not infected$' 246s Checking `basename'... not infected 246s OK 246s **** Test for '^Checking `biff'\.\.\. not infected$' 246s Checking `biff'... not infected 246s OK 246s **** Test for '^Checking `chfn'\.\.\. not infected$' 246s Checking `chfn'... not infected 246s OK 246s **** Test for '^Checking `chsh'\.\.\. not infected$' 246s Checking `chsh'... not infected 246s OK 246s **** Test for '^Checking `cron'\.\.\. not infected$' 246s Checking `cron'... not infected 246s OK 246s **** Test for '^Checking `crontab'\.\.\. not infected$' 246s Checking `crontab'... not infected 246s OK 246s **** Test for '^Checking `date'\.\.\. not infected$' 246s Checking `date'... not infected 246s OK 246s **** Test for '^Checking `du'\.\.\. not infected$' 246s Checking `du'... not infected 246s OK 246s **** Test for '^Checking `dirname'\.\.\. not infected$' 246s Checking `dirname'... not infected 246s OK 246s **** Test for '^Checking `echo'\.\.\. not infected$' 246s Checking `echo'... not infected 246s OK 246s **** Test for '^Checking `egrep'\.\.\. not infected$' 246s Checking `egrep'... not infected 246s OK 246s **** Test for '^Checking `env'\.\.\. not infected$' 246s Checking `env'... not infected 246s OK 246s **** Test for '^Checking `find'\.\.\. not infected$' 246s Checking `find'... not infected 246s OK 246s **** Test for '^Checking `fingerd'\.\.\. not infected$' 246s Checking `fingerd'... not infected 246s OK 246s **** Test for '^Checking `gpm'\.\.\. not infected$' 246s Checking `gpm'... not infected 246s OK 246s **** Test for '^Checking `grep'\.\.\. not infected$' 246s Checking `grep'... not infected 246s OK 246s **** Test for '^Checking `hdparm'\.\.\. not infected$' 246s Checking `hdparm'... not infected 246s OK 246s **** Test for '^Checking `su'\.\.\. not infected$' 246s Checking `su'... not infected 246s OK 246s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 246s Checking `ifconfig'... not infected 246s OK 246s **** Test for '^Checking `inetd'\.\.\. not infected$' 246s Checking `inetd'... not infected 246s OK 246s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 246s Checking `inetdconf'... not infected 246s OK 246s **** Test for '^Checking `identd'\.\.\. not infected$' 246s Checking `identd'... not infected 246s OK 246s **** Test for '^Checking `init'\.\.\. not infected$' 246s Checking `init'... not infected 246s OK 246s **** Test for '^Checking `killall'\.\.\. not infected$' 246s Checking `killall'... not infected 246s OK 246s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 246s Checking `ldsopreload'... not infected 246s OK 246s **** Test for '^Checking `login'\.\.\. not infected$' 246s Checking `login'... not infected 246s OK 246s **** Test for '^Checking `ls'\.\.\. not infected$' 246s Checking `ls'... not infected 246s OK 246s **** Test for '^Checking `lsof'\.\.\. not infected$' 246s Checking `lsof'... not infected 246s OK 246s **** Test for '^Checking `mail'\.\.\. not infected$' 246s Checking `mail'... not infected 246s OK 246s **** Test for '^Checking `mingetty'\.\.\. not infected$' 246s Checking `mingetty'... not infected 246s OK 246s **** Test for '^Checking `netstat'\.\.\. not infected$' 246s Checking `netstat'... not infected 246s OK 246s **** Test for '^Checking `named'\.\.\. not infected$' 246s Checking `named'... not infected 246s OK 246s **** Test for '^Checking `passwd'\.\.\. not infected$' 246s Checking `passwd'... not infected 246s OK 246s **** Test for '^Checking `pidof'\.\.\. not infected$' 246s Checking `pidof'... not infected 246s OK 246s **** Test for '^Checking `pop2'\.\.\. not infected$' 246s Checking `pop2'... not infected 246s OK 246s **** Test for '^Checking `pop3'\.\.\. not infected$' 246s Checking `pop3'... not infected 246s OK 246s **** Test for '^Checking `ps'\.\.\. not infected$' 246s Checking `ps'... not infected 246s OK 246s **** Test for '^Checking `pstree'\.\.\. not infected$' 246s Checking `pstree'... not infected 246s OK 246s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 246s Checking `rpcinfo'... not infected 246s OK 246s **** Test for '^Checking `rlogind'\.\.\. not infected$' 246s Checking `rlogind'... not infected 246s OK 246s **** Test for '^Checking `rshd'\.\.\. not infected$' 246s Checking `rshd'... not infected 246s OK 246s **** Test for '^Checking `slogin'\.\.\. not infected$' 246s Checking `slogin'... not infected 246s OK 246s **** Test for '^Checking `sendmail'\.\.\. not infected$' 246s Checking `sendmail'... not infected 246s OK 246s **** Test for '^Checking `sshd'\.\.\. not infected$' 246s Checking `sshd'... not infected 246s OK 246s **** Test for '^Checking `syslogd'\.\.\. not infected$' 246s Checking `syslogd'... not infected 246s OK 246s **** Test for '^Checking `tar'\.\.\. not infected$' 246s Checking `tar'... not infected 246s OK 246s **** Test for '^Checking `tcpd'\.\.\. not infected$' 246s Checking `tcpd'... not infected 246s OK 246s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 246s Checking `tcpdump'... not infected 246s OK 246s **** Test for '^Checking `top'\.\.\. not infected$' 246s Checking `top'... not infected 246s OK 246s **** Test for '^Checking `telnetd'\.\.\. not infected$' 246s Checking `telnetd'... not infected 246s OK 246s **** Test for '^Checking `timed'\.\.\. not infected$' 246s Checking `timed'... not infected 246s OK 246s **** Test for '^Checking `traceroute'\.\.\. not infected$' 246s Checking `traceroute'... not infected 246s OK 246s **** Test for '^Checking `vdir'\.\.\. not infected$' 246s Checking `vdir'... not infected 246s OK 246s **** Test for '^Checking `w'\.\.\. not infected$' 246s Checking `w'... not infected 246s OK 246s **** Test for '^Checking `write'\.\.\. not infected$' 246s Checking `write'... not infected 246s OK 246s **** Test for '^Checking `aliens'\.\.\. started$' 246s Checking `aliens'... started 246s OK 246s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 246s Searching for suspicious files in /dev... not found 246s OK 246s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 246s Searching for known suspicious directories... not found 246s OK 246s **** Test for '^Searching for known suspicious files\.\.\. not found$' 246s Searching for known suspicious files... not found 246s OK 246s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 246s Searching for sniffer's logs... not found 246s OK 246s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 246s Searching for HiDrootkit rootkit... not found 246s OK 246s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 246s Searching for t0rn rootkit... not found 246s OK 246s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 246s Searching for t0rn v8 (or variation)... not found 246s OK 246s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 246s Searching for Lion rootkit... not found 246s OK 246s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 246s Searching for RSHA rootkit... not found 246s OK 246s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 246s Searching for RH-Sharpe rootkit... not found 246s OK 246s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 246s Searching for Ambient (ark) rootkit... not found 246s OK 246s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 246s Searching for suspicious files and dirs... WARNING 246s OK 246s **** Test for '^$' 246s 246s 246s 246s 246s 246s 246s OK 246s **** Test for 'The following suspicious files and directories were found:$' 246s WARNING: The following suspicious files and directories were found: 246s OK 246s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 246s /usr/lib/.1 [Not from a Debian package] 246s OK 246s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 246s /usr/lib/.1DIR [Not from a Debian package] 246s OK 246s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 246s /usr/lib/...DIR [Not from a Debian package] 246s OK 246s **** Test for '^CHANGED-IN-FILTER_bb \[Not from a Debian package\]$' 246s CHANGED-IN-FILTER_bb [Not from a Debian package] 246s OK 246s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 246s /usr/lib/... [Not from a Debian package] 246s OK 246s **** Test for '^Searching for LPD Worm\.\.\. not found$' 246s Searching for LPD Worm... not found 246s OK 246s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 246s Searching for Ramen Worm rootkit... not found 246s OK 246s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 246s Searching for Maniac rootkit... not found 246s OK 246s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 246s Searching for RK17 rootkit... not found 246s OK 246s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 246s Searching for Ducoci rootkit... not found 246s OK 246s **** Test for '^Searching for Adore Worm\.\.\. not found$' 246s Searching for Adore Worm... not found 246s OK 246s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 246s Searching for ShitC Worm... not found 246s OK 246s **** Test for '^Searching for Omega Worm\.\.\. not found$' 246s Searching for Omega Worm... not found 246s OK 246s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 246s Searching for Sadmind/IIS Worm... not found 246s OK 246s **** Test for '^Searching for MonKit\.\.\. not found$' 246s Searching for MonKit... not found 246s OK 246s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 246s Searching for Showtee rootkit... not found 246s OK 246s **** Test for '^Searching for OpticKit\.\.\. not found$' 246s Searching for OpticKit... not found 246s OK 246s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 246s Searching for T.R.K... not found 246s OK 246s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 246s Searching for Mithra rootkit... not found 246s OK 246s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 246s Searching for OBSD rootkit v1... not tested 246s OK 246s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 246s Searching for LOC rootkit... not found 246s OK 246s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 246s Searching for Romanian rootkit... not found 246s OK 246s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 246s Searching for HKRK rootkit... not found 246s OK 246s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 246s Searching for Suckit rootkit... not found 246s OK 246s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 246s Searching for Volc rootkit... not found 246s OK 246s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 246s Searching for Gold2 rootkit... not found 246s OK 246s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 246s Searching for TC2 rootkit... not found 246s OK 246s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 246s Searching for Anonoying rootkit... not found 246s OK 246s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 246s Searching for ZK rootkit... not found 246s OK 246s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 246s Searching for ShKit rootkit... not found 246s OK 246s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 246s Searching for AjaKit rootkit... not found 246s OK 246s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 246s Searching for zaRwT rootkit... not found 246s OK 246s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 246s Searching for Madalin rootkit... not found 246s OK 246s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 246s Searching for Fu rootkit... not found 246s OK 246s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 246s Searching for Kenga3 rootkit... not found 246s OK 246s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 246s Searching for ESRK rootkit... not found 246s OK 246s **** Test for '^Searching for rootedoor\.\.\. not found$' 246s Searching for rootedoor... not found 246s OK 246s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 246s Searching for ENYELKM rootkit... not found 246s OK 246s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 246s Searching for common ssh-scanners... not found 246s OK 246s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 246s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 246s OK 246s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 246s Searching for Linux/Ebury 1.6... not tested 246s OK 246s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 246s Searching for 64-bit Linux Rootkit... not found 246s OK 246s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 246s Searching for 64-bit Linux Rootkit modules... not found 246s OK 246s **** Test for '^Searching for Mumblehard\.\.\. not found$' 246s Searching for Mumblehard... not found 246s OK 246s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 246s Searching for Backdoor.Linux.Mokes.a... not found 246s OK 246s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 246s Searching for Malicious TinyDNS... not found 246s OK 246s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 246s Searching for Linux.Xor.DDoS... WARNING 246s OK 246s **** Test for 'WARNING: Possible Linux\.Xor\.DDoS installed:$' 246s WARNING: Possible Linux.Xor.DDoS installed: 246s OK 246s **** Test for '^/tmp/clean/.+$' 246s /tmp/clean/ps [Not from a Debian package] 246s /tmp/clean/head [Not from a Debian package] 246s /tmp/clean/cut [Not from a Debian package] 246s /tmp/clean/ls [Not from a Debian package] 246s /tmp/clean/echo [Not from a Debian package] 246s /tmp/clean/awk [Not from a Debian package] 246s /tmp/clean/dpkg-query [Not from a Debian package] 246s /tmp/clean/sed [Not from a Debian package] 246s /tmp/clean/strings [Not from a Debian package] 246s /tmp/clean/netstat [Not from a Debian package] 246s /tmp/clean/uname [Not from a Debian package] 246s /tmp/clean/id [Not from a Debian package] 246s /tmp/clean/grep [Not from a Debian package] 246s /tmp/clean/find [Not from a Debian package] 246s /tmp/clean/dirname [Not from a Debian package] 246s /tmp/clean/xargs [Not from a Debian package] 246s /tmp/clean/ss [Not from a Debian package] 246s OK 246s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 246s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 246s OK 246s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 246s Searching for Linux.Proxy.1.0... not found 246s OK 246s **** Test for '^Searching for CrossRAT\.\.\. not found$' 246s Searching for CrossRAT... not found 246s OK 246s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 246s Searching for Hidden Cobra... not found 246s OK 246s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 246s Searching for Rocke Miner rootkit... not found 246s OK 246s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 246s Searching for PWNLNX4 lkm rootkit... not found 246s OK 246s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 246s Searching for PWNLNX6 lkm rootkit... not found 246s OK 246s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 246s Searching for Umbreon lrk... not found 246s OK 246s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 246s Searching for Kinsing.a backdoor rootkit... not found 246s OK 246s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 246s Searching for RotaJakiro backdoor rootkit... not found 246s OK 246s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 246s Searching for Syslogk LKM rootkit... not found 246s OK 246s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 246s Searching for Kovid LKM rootkit... not tested 246s OK 246s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 246s Searching for Tsunami DDoS Malware rootkit... not found 246s OK 246s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 246s Searching for Linux BPF Door... not found 246s OK 246s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 246s Searching for zero-size shell history files in /root... not found 246s OK 246s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 246s Searching for hardlinked shell history files in /root... not found 246s OK 246s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 246s Searching for suspect PHP files... not found 246s OK 246s **** Test for '^Checking `aliens'\.\.\. finished$' 246s Checking `aliens'... finished 246s OK 246s **** Test for '^Checking `asp'\.\.\. not infected$' 246s Checking `asp'... not infected 246s OK 246s **** Test for '^Checking `bindshell'\.\.\. not found' 246s Checking `bindshell'... not found 246s OK 246s **** Test for '^Checking `lkm'\.\.\. started$' 246s Checking `lkm'... started 246s OK 246s **** Test for '^Checking `rexedcs'\.\.\. not found$' 246s Checking `rexedcs'... not found 246s OK 246s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 246s Searching for for hidden processes with chkproc... not found 246s OK 246s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 246s Searching for for hidden directories using chkdirs... not found 246s OK 246s **** Test for '^Checking `lkm'\.\.\. finished$' 246s Checking `lkm'... finished 246s OK 246s **** Test for '^Searching for Adore LKM\.\.\. not tested' 246s Searching for Adore LKM... not tested 246s OK 246s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested' 246s Searching for sebek LKM (Adore based)... not tested 246s OK 246s **** Test for '^Searching for knark LKM rootkit\.\.\. not found' 246s Searching for knark LKM rootkit... not found 246s OK 246s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 246s Checking `sniffer'... WARNING 246s OK 246s **** Test for '^WARNING: Output from ifpromisc:$' 246s WARNING: Output from ifpromisc: 246s OK 246s **** Test for '^lo: not promisc and no packet sniffer sockets$' 246s lo: not promisc and no packet sniffer sockets 246s OK 246s **** Test for '^Checking `w55808'\.\.\. not found$' 246s Checking `w55808'... not found 246s OK 246s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 246s Checking `wted'... not found 246s OK 246s **** Test for '^Checking `scalper'\.\.\. not found$' 246s Checking `scalper'... not found 246s OK 246s **** Test for '^Checking `slapper'\.\.\. not found$' 246s Checking `slapper'... not found 246s OK 246s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 246s Checking `z2'... not found 246s OK 246s **** Test for '^Checking `chkutmp'\.\.\.' 246s Checking `chkutmp'... not found 246s OK 246s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 246s Checking `OSX_RSPLUG'... not tested 246s OK 246s ** PASS: Testing: cron-no-diff-mode-02-full-filter-and-ignore (chkrootkit-daily) done: PASS 246s *** Unexpected (unmatched) lines follow (for info): 246s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 246s * Testing: chkrootkit-daily (without diff mode, quiet output, no MAILTO) 246s ** Testing: cron-no-diff-mode-03-quiet (chkrootkit-daily) ... 246s *** Output 257s WARNING: The following suspicious files and directories were found: 257s /usr/lib/... [Not from a Debian package] 257s /usr/lib/.aaa [Not from a Debian package] 257s /usr/lib/.1 [Not from a Debian package] 257s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 257s /usr/lib/.bbb [Not from a Debian package] 257s /usr/lib/.1DIR [Not from a Debian package] 257s /usr/lib/.DIR-aaa [Not from a Debian package] 257s /usr/lib/...DIR [Not from a Debian package] 257s 257s WARNING: Possible Linux.Xor.DDoS installed: 257s /tmp/clean/ps [Not from a Debian package] 257s /tmp/clean/head [Not from a Debian package] 257s /tmp/clean/cut [Not from a Debian package] 257s /tmp/clean/ls [Not from a Debian package] 257s /tmp/clean/echo [Not from a Debian package] 257s /tmp/clean/awk [Not from a Debian package] 257s /tmp/clean/dpkg-query [Not from a Debian package] 257s /tmp/clean/sed [Not from a Debian package] 257s /tmp/clean/strings [Not from a Debian package] 257s /tmp/clean/netstat [Not from a Debian package] 257s /tmp/clean/uname [Not from a Debian package] 257s /tmp/clean/id [Not from a Debian package] 257s /tmp/clean/grep [Not from a Debian package] 257s /tmp/clean/find [Not from a Debian package] 257s /tmp/clean/dirname [Not from a Debian package] 257s /tmp/clean/xargs [Not from a Debian package] 257s /tmp/clean/ss [Not from a Debian package] 257s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 257s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 257s 257s WARNING: Output from ifpromisc: 257s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 257s 257s **** Files in log 257s total 44K 257s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 257s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 257s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 257s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 257s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 257s *** Test of content of output follows... 257s **** Test for '^WARNING: The following suspicious files and directories were found:$' 257s WARNING: The following suspicious files and directories were found: 257s OK 257s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 257s /usr/lib/.1 [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 257s /usr/lib/.aaa [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 257s /usr/lib/.1DIR [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 257s /usr/lib/...DIR [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 257s /usr/lib/.bbb [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 257s /usr/lib/.DIR-aaa [Not from a Debian package] 257s OK 257s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 257s /usr/lib/... [Not from a Debian package] 257s OK 257s **** Test for '^$' 257s 257s 257s 257s OK 257s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 257s WARNING: Possible Linux.Xor.DDoS installed: 257s OK 257s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 257s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 257s OK 257s **** Test for '^/tmp/clean/.+$' 257s /tmp/clean/ps [Not from a Debian package] 257s /tmp/clean/head [Not from a Debian package] 257s /tmp/clean/cut [Not from a Debian package] 257s /tmp/clean/ls [Not from a Debian package] 257s /tmp/clean/echo [Not from a Debian package] 257s /tmp/clean/awk [Not from a Debian package] 257s /tmp/clean/dpkg-query [Not from a Debian package] 257s /tmp/clean/sed [Not from a Debian package] 257s /tmp/clean/strings [Not from a Debian package] 257s /tmp/clean/netstat [Not from a Debian package] 257s /tmp/clean/uname [Not from a Debian package] 257s /tmp/clean/id [Not from a Debian package] 257s /tmp/clean/grep [Not from a Debian package] 257s /tmp/clean/find [Not from a Debian package] 257s /tmp/clean/dirname [Not from a Debian package] 257s /tmp/clean/xargs [Not from a Debian package] 257s /tmp/clean/ss [Not from a Debian package] 257s OK 257s ** PASS: Testing: cron-no-diff-mode-03-quiet (chkrootkit-daily) done: PASS 257s *** Unexpected (unmatched) lines follow (for info): 257s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 257s ** Testing: cron-no-diff-mode-04-quiet-no-ionice (chkrootkit-daily) ... 257s *** Output 268s WARNING: The following suspicious files and directories were found: 268s /usr/lib/... [Not from a Debian package] 268s /usr/lib/.aaa [Not from a Debian package] 268s /usr/lib/.1 [Not from a Debian package] 268s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 268s /usr/lib/.bbb [Not from a Debian package] 268s /usr/lib/.1DIR [Not from a Debian package] 268s /usr/lib/.DIR-aaa [Not from a Debian package] 268s /usr/lib/...DIR [Not from a Debian package] 268s 268s WARNING: Possible Linux.Xor.DDoS installed: 268s /tmp/clean/ps [Not from a Debian package] 268s /tmp/clean/head [Not from a Debian package] 268s /tmp/clean/cut [Not from a Debian package] 268s /tmp/clean/ls [Not from a Debian package] 268s /tmp/clean/echo [Not from a Debian package] 268s /tmp/clean/awk [Not from a Debian package] 268s /tmp/clean/dpkg-query [Not from a Debian package] 268s /tmp/clean/sed [Not from a Debian package] 268s /tmp/clean/strings [Not from a Debian package] 268s /tmp/clean/netstat [Not from a Debian package] 268s /tmp/clean/uname [Not from a Debian package] 268s /tmp/clean/id [Not from a Debian package] 268s /tmp/clean/grep [Not from a Debian package] 268s /tmp/clean/find [Not from a Debian package] 268s /tmp/clean/dirname [Not from a Debian package] 268s /tmp/clean/xargs [Not from a Debian package] 268s /tmp/clean/ss [Not from a Debian package] 268s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 268s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 268s 268s WARNING: Output from ifpromisc: 268s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 268s 268s **** Files in log 268s total 44K 268s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 268s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 268s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 268s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 268s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 268s *** Test of content of output follows... 268s **** Test for '^WARNING: The following suspicious files and directories were found:$' 268s WARNING: The following suspicious files and directories were found: 268s OK 268s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 268s /usr/lib/.1 [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 268s /usr/lib/.aaa [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 268s /usr/lib/.1DIR [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 268s /usr/lib/...DIR [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 268s /usr/lib/.bbb [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 268s /usr/lib/.DIR-aaa [Not from a Debian package] 268s OK 268s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 268s /usr/lib/... [Not from a Debian package] 268s OK 268s **** Test for '^$' 268s 268s 268s 268s OK 268s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 268s WARNING: Possible Linux.Xor.DDoS installed: 268s OK 268s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 268s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 268s OK 268s **** Test for '^/tmp/clean/.+$' 268s /tmp/clean/ps [Not from a Debian package] 268s /tmp/clean/head [Not from a Debian package] 268s /tmp/clean/cut [Not from a Debian package] 268s /tmp/clean/ls [Not from a Debian package] 268s /tmp/clean/echo [Not from a Debian package] 268s /tmp/clean/awk [Not from a Debian package] 268s /tmp/clean/dpkg-query [Not from a Debian package] 268s /tmp/clean/sed [Not from a Debian package] 268s /tmp/clean/strings [Not from a Debian package] 268s /tmp/clean/netstat [Not from a Debian package] 268s /tmp/clean/uname [Not from a Debian package] 268s /tmp/clean/id [Not from a Debian package] 268s /tmp/clean/grep [Not from a Debian package] 268s /tmp/clean/find [Not from a Debian package] 268s /tmp/clean/dirname [Not from a Debian package] 268s /tmp/clean/xargs [Not from a Debian package] 268s /tmp/clean/ss [Not from a Debian package] 268s OK 268s ** PASS: Testing: cron-no-diff-mode-04-quiet-no-ionice (chkrootkit-daily) done: PASS 268s *** Unexpected (unmatched) lines follow (for info): 268s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 268s ** Testing: cron-no-diff-mode-05-quiet-filter-and-ignore (chkrootkit-daily) ... 268s *** Output 279s WARNING: The following suspicious files and directories were found: 279s /usr/lib/... [Not from a Debian package] 279s /usr/lib/.1 [Not from a Debian package] 279s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 279s CHANGED-IN-FILTER_bb [Not from a Debian package] 279s /usr/lib/.1DIR [Not from a Debian package] 279s /usr/lib/.DIR-aaa [Not from a Debian package] 279s /usr/lib/...DIR [Not from a Debian package] 279s 279s WARNING: Possible Linux.Xor.DDoS installed: 279s /tmp/clean/ps [Not from a Debian package] 279s /tmp/clean/head [Not from a Debian package] 279s /tmp/clean/cut [Not from a Debian package] 279s /tmp/clean/ls [Not from a Debian package] 279s /tmp/clean/echo [Not from a Debian package] 279s /tmp/clean/awk [Not from a Debian package] 279s /tmp/clean/dpkg-query [Not from a Debian package] 279s /tmp/clean/sed [Not from a Debian package] 279s /tmp/clean/strings [Not from a Debian package] 279s /tmp/clean/netstat [Not from a Debian package] 279s /tmp/clean/uname [Not from a Debian package] 279s /tmp/clean/id [Not from a Debian package] 279s /tmp/clean/grep [Not from a Debian package] 279s /tmp/clean/find [Not from a Debian package] 279s /tmp/clean/dirname [Not from a Debian package] 279s /tmp/clean/xargs [Not from a Debian package] 279s /tmp/clean/ss [Not from a Debian package] 279s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 279s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 279s 279s WARNING: Output from ifpromisc: 279s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 279s 279s **** Files in log 279s total 44K 279s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 279s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 279s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 279s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 279s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 279s *** Test of content of output follows... 279s **** Test for 'WARNING: The following suspicious files and directories were found:$' 279s WARNING: The following suspicious files and directories were found: 279s OK 279s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 279s /usr/lib/.1 [Not from a Debian package] 279s OK 279s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 279s /usr/lib/.1DIR [Not from a Debian package] 279s OK 279s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 279s /usr/lib/...DIR [Not from a Debian package] 279s OK 279s **** Test for '^CHANGED-IN-FILTER_bb \[Not from a Debian package\]$' 279s CHANGED-IN-FILTER_bb [Not from a Debian package] 279s OK 279s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 279s /usr/lib/.DIR-aaa [Not from a Debian package] 279s OK 279s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 279s /usr/lib/... [Not from a Debian package] 279s OK 279s **** Test for '^$' 279s 279s 279s 279s OK 279s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 279s WARNING: Possible Linux.Xor.DDoS installed: 279s OK 279s **** Test for '^/tmp/clean/.+ \[Not from a Debian package\]$' 279s /tmp/clean/ps [Not from a Debian package] 279s /tmp/clean/head [Not from a Debian package] 279s /tmp/clean/cut [Not from a Debian package] 279s /tmp/clean/ls [Not from a Debian package] 279s /tmp/clean/echo [Not from a Debian package] 279s /tmp/clean/awk [Not from a Debian package] 279s /tmp/clean/dpkg-query [Not from a Debian package] 279s /tmp/clean/sed [Not from a Debian package] 279s /tmp/clean/strings [Not from a Debian package] 279s /tmp/clean/netstat [Not from a Debian package] 279s /tmp/clean/uname [Not from a Debian package] 279s /tmp/clean/id [Not from a Debian package] 279s /tmp/clean/grep [Not from a Debian package] 279s /tmp/clean/find [Not from a Debian package] 279s /tmp/clean/dirname [Not from a Debian package] 279s /tmp/clean/xargs [Not from a Debian package] 279s /tmp/clean/ss [Not from a Debian package] 279s OK 279s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 279s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 279s OK 279s ** PASS: Testing: cron-no-diff-mode-05-quiet-filter-and-ignore (chkrootkit-daily) done: PASS 279s *** Unexpected (unmatched) lines follow (for info): 279s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 279s ** Testing: cron-no-diff-mode-06-quiet-invalid-filter-is-ignored (chkrootkit-daily) ... 279s *** Output 279s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored' 290s WARNING: The following suspicious files and directories were found: 290s /usr/lib/... [Not from a Debian package] 290s /usr/lib/.1 [Not from a Debian package] 290s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 290s /usr/lib/.bbb [Not from a Debian package] 290s /usr/lib/.1DIR [Not from a Debian package] 290s /usr/lib/.DIR-aaa [Not from a Debian package] 290s /usr/lib/...DIR [Not from a Debian package] 290s 290s WARNING: Possible Linux.Xor.DDoS installed: 290s /tmp/clean/ps [Not from a Debian package] 290s /tmp/clean/head [Not from a Debian package] 290s /tmp/clean/cut [Not from a Debian package] 290s /tmp/clean/ls [Not from a Debian package] 290s /tmp/clean/echo [Not from a Debian package] 290s /tmp/clean/awk [Not from a Debian package] 290s /tmp/clean/dpkg-query [Not from a Debian package] 290s /tmp/clean/sed [Not from a Debian package] 290s /tmp/clean/strings [Not from a Debian package] 290s /tmp/clean/netstat [Not from a Debian package] 290s /tmp/clean/uname [Not from a Debian package] 290s /tmp/clean/id [Not from a Debian package] 290s /tmp/clean/grep [Not from a Debian package] 290s /tmp/clean/find [Not from a Debian package] 290s /tmp/clean/dirname [Not from a Debian package] 290s /tmp/clean/xargs [Not from a Debian package] 290s /tmp/clean/ss [Not from a Debian package] 290s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 290s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 290s 290s WARNING: Output from ifpromisc: 290s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 290s 290s **** Files in log 290s total 44K 290s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 290s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 290s -rw-r--r-- 1 root root 11K Nov 26 20:44 chkrootkit-daily.log 290s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today 290s -rw-r--r-- 1 root root 11K Nov 26 20:44 log.today.raw 290s *** Test of content of output follows... 290s **** Test for '^Ignoring invalid \$FILTER='sed s/this/is/invalid/sed/and/will/be/ignored'$' 290s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored' 290s OK 290s **** Test for '^WARNING: The following suspicious files and directories were found:$' 290s WARNING: The following suspicious files and directories were found: 290s OK 290s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 290s /usr/lib/.1 [Not from a Debian package] 290s OK 290s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 290s /usr/lib/.1DIR [Not from a Debian package] 290s OK 290s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 290s /usr/lib/...DIR [Not from a Debian package] 290s OK 290s **** Test for '^(/usr)?/lib/.bbb \[Not from a Debian package\]$' 290s /usr/lib/.bbb [Not from a Debian package] 290s OK 290s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 290s /usr/lib/.DIR-aaa [Not from a Debian package] 290s OK 290s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 290s /usr/lib/... [Not from a Debian package] 290s OK 290s **** Test for '^$' 290s 290s 290s 290s OK 290s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 290s WARNING: Possible Linux.Xor.DDoS installed: 290s OK 290s **** Test for '^/tmp/clean/.+$' 290s /tmp/clean/ps [Not from a Debian package] 290s /tmp/clean/head [Not from a Debian package] 290s /tmp/clean/cut [Not from a Debian package] 290s /tmp/clean/ls [Not from a Debian package] 290s /tmp/clean/echo [Not from a Debian package] 290s /tmp/clean/awk [Not from a Debian package] 290s /tmp/clean/dpkg-query [Not from a Debian package] 290s /tmp/clean/sed [Not from a Debian package] 290s /tmp/clean/strings [Not from a Debian package] 290s /tmp/clean/netstat [Not from a Debian package] 290s /tmp/clean/uname [Not from a Debian package] 290s /tmp/clean/id [Not from a Debian package] 290s /tmp/clean/grep [Not from a Debian package] 290s /tmp/clean/find [Not from a Debian package] 290s /tmp/clean/dirname [Not from a Debian package] 290s /tmp/clean/xargs [Not from a Debian package] 290s /tmp/clean/ss [Not from a Debian package] 290s OK 290s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 290s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 290s OK 290s ** PASS: Testing: cron-no-diff-mode-06-quiet-invalid-filter-is-ignored (chkrootkit-daily) done: PASS 290s *** Unexpected (unmatched) lines follow (for info): 290s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 290s * Testing: chkrootkit-daily (with DIFF_MODE, full output, no MAILTO) 290s ** Testing: cron-with-diff-mode-01-full (chkrootkit-daily) ... 290s *** Output 302s No file /var/log/chkrootkit/log.expected 302s This file should contain expected output from chkrootkit 302s 302s Today's run produced the following output: 302s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 302s ROOTDIR is `/' 302s Checking `amd'... not infected 302s Checking `basename'... not infected 302s Checking `biff'... not infected 302s Checking `chfn'... not infected 302s Checking `chsh'... not infected 302s Checking `cron'... not infected 302s Checking `crontab'... not infected 302s Checking `date'... not infected 302s Checking `du'... not infected 302s Checking `dirname'... not infected 302s Checking `echo'... not infected 302s Checking `egrep'... not infected 302s Checking `env'... not infected 302s Checking `find'... not infected 302s Checking `fingerd'... not infected 302s Checking `gpm'... not infected 302s Checking `grep'... not infected 302s Checking `hdparm'... not infected 302s Checking `su'... not infected 302s Checking `ifconfig'... not infected 302s Checking `inetd'... not infected 302s Checking `inetdconf'... not infected 302s Checking `identd'... not infected 302s Checking `init'... not infected 302s Checking `killall'... not infected 302s Checking `ldsopreload'... not infected 302s Checking `login'... not infected 302s Checking `ls'... not infected 302s Checking `lsof'... not infected 302s Checking `mail'... not infected 302s Checking `mingetty'... not infected 302s Checking `netstat'... not infected 302s Checking `named'... not infected 302s Checking `passwd'... not infected 302s Checking `pidof'... not infected 302s Checking `pop2'... not infected 302s Checking `pop3'... not infected 302s Checking `ps'... not infected 302s Checking `pstree'... not infected 302s Checking `rpcinfo'... not infected 302s Checking `rlogind'... not infected 302s Checking `rshd'... not infected 302s Checking `slogin'... not infected 302s Checking `sendmail'... not infected 302s Checking `sshd'... not infected 302s Checking `syslogd'... not infected 302s Checking `tar'... not infected 302s Checking `tcpd'... not infected 302s Checking `tcpdump'... not infected 302s Checking `top'... not infected 302s Checking `telnetd'... not infected 302s Checking `timed'... not infected 302s Checking `traceroute'... not infected 302s Checking `vdir'... not infected 302s Checking `w'... not infected 302s Checking `write'... not infected 302s Checking `aliens'... started 302s Searching for suspicious files in /dev... not found 302s Searching for known suspicious directories... not found 302s Searching for known suspicious files... not found 302s Searching for sniffer's logs... not found 302s Searching for HiDrootkit rootkit... not found 302s Searching for t0rn rootkit... not found 302s Searching for t0rn v8 (or variation)... not found 302s Searching for Lion rootkit... not found 302s Searching for RSHA rootkit... not found 302s Searching for RH-Sharpe rootkit... not found 302s Searching for Ambient (ark) rootkit... not found 302s Searching for suspicious files and dirs... WARNING 302s 302s WARNING: The following suspicious files and directories were found: 302s /usr/lib/... [Not from a Debian package] 302s /usr/lib/.aaa [Not from a Debian package] 302s /usr/lib/.1 [Not from a Debian package] 302s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 302s /usr/lib/.bbb [Not from a Debian package] 302s /usr/lib/.1DIR [Not from a Debian package] 302s /usr/lib/.DIR-aaa [Not from a Debian package] 302s /usr/lib/...DIR [Not from a Debian package] 302s 302s Searching for LPD Worm... not found 302s Searching for Ramen Worm rootkit... not found 302s Searching for Maniac rootkit... not found 302s Searching for RK17 rootkit... not found 302s Searching for Ducoci rootkit... not found 302s Searching for Adore Worm... not found 302s Searching for ShitC Worm... not found 302s Searching for Omega Worm... not found 302s Searching for Sadmind/IIS Worm... not found 302s Searching for MonKit... not found 302s Searching for Showtee rootkit... not found 302s Searching for OpticKit... not found 302s Searching for T.R.K... not found 302s Searching for Mithra rootkit... not found 302s Searching for OBSD rootkit v1... not tested 302s Searching for LOC rootkit... not found 302s Searching for Romanian rootkit... not found 302s Searching for HKRK rootkit... not found 302s Searching for Suckit rootkit... not found 302s Searching for Volc rootkit... not found 302s Searching for Gold2 rootkit... not found 302s Searching for TC2 rootkit... not found 302s Searching for Anonoying rootkit... not found 302s Searching for ZK rootkit... not found 302s Searching for ShKit rootkit... not found 302s Searching for AjaKit rootkit... not found 302s Searching for zaRwT rootkit... not found 302s Searching for Madalin rootkit... not found 302s Searching for Fu rootkit... not found 302s Searching for Kenga3 rootkit... not found 302s Searching for ESRK rootkit... not found 302s Searching for rootedoor... not found 302s Searching for ENYELKM rootkit... not found 302s Searching for common ssh-scanners... not found 302s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 302s Searching for Linux/Ebury 1.6... not tested 302s Searching for 64-bit Linux Rootkit... not found 302s Searching for 64-bit Linux Rootkit modules... not found 302s Searching for Mumblehard... not found 302s Searching for Backdoor.Linux.Mokes.a... not found 302s Searching for Malicious TinyDNS... not found 302s Searching for Linux.Xor.DDoS... WARNING 302s 302s WARNING: Possible Linux.Xor.DDoS installed: 302s /tmp/clean/ps [Not from a Debian package] 302s /tmp/clean/head [Not from a Debian package] 302s /tmp/clean/cut [Not from a Debian package] 302s /tmp/clean/ls [Not from a Debian package] 302s /tmp/clean/echo [Not from a Debian package] 302s /tmp/clean/awk [Not from a Debian package] 302s /tmp/clean/dpkg-query [Not from a Debian package] 302s /tmp/clean/sed [Not from a Debian package] 302s /tmp/clean/strings [Not from a Debian package] 302s /tmp/clean/netstat [Not from a Debian package] 302s /tmp/clean/uname [Not from a Debian package] 302s /tmp/clean/id [Not from a Debian package] 302s /tmp/clean/grep [Not from a Debian package] 302s /tmp/clean/find [Not from a Debian package] 302s /tmp/clean/dirname [Not from a Debian package] 302s /tmp/clean/xargs [Not from a Debian package] 302s /tmp/clean/ss [Not from a Debian package] 302s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 302s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 302s 302s Searching for Linux.Proxy.1.0... not found 302s Searching for CrossRAT... not found 302s Searching for Hidden Cobra... not found 302s Searching for Rocke Miner rootkit... not found 302s Searching for PWNLNX4 lkm rootkit... not found 302s Searching for PWNLNX6 lkm rootkit... not found 302s Searching for Umbreon lrk... not found 302s Searching for Kinsing.a backdoor rootkit... not found 302s Searching for RotaJakiro backdoor rootkit... not found 302s Searching for Syslogk LKM rootkit... not found 302s Searching for Kovid LKM rootkit... not tested 302s Searching for Tsunami DDoS Malware rootkit... not found 302s Searching for Linux BPF Door... not found 302s Searching for suspect PHP files... not found 302s Searching for zero-size shell history files in /root... not found 302s Searching for hardlinked shell history files in /root... not found 302s Checking `aliens'... finished 302s Checking `asp'... not infected 302s Checking `bindshell'... not found 302s Checking `lkm'... started 302s Searching for Adore LKM... not tested 302s Searching for sebek LKM (Adore based)... not tested 302s Searching for knark LKM rootkit... not found 302s Searching for for hidden processes with chkproc... not found 302s Searching for for hidden directories using chkdirs... not found 302s Checking `lkm'... finished 302s Checking `rexedcs'... not found 302s Checking `sniffer'... WARNING 302s 302s WARNING: Output from ifpromisc: 302s lo: not promisc and no packet sniffer sockets 302s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 302s 302s Checking `w55808'... not found 302s Checking `wted'... not found 302s Checking `scalper'... not found 302s Checking `slapper'... not found 302s Checking `z2'... not found 302s Checking `chkutmp'... not found 302s Checking `OSX_RSPLUG'... not tested 302s --- [ END: cat /var/log/chkrootkit/log.today ] --- 302s 302s To create this file containing all output from today's run, do (as root) 302s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 302s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 302s **** Files in log 302s total 80K 302s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 302s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 302s -rw-r--r-- 1 root root 22K Nov 26 20:44 chkrootkit-daily.log 302s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today 302s -rw-r--r-- 1 root root 21K Nov 26 20:44 log.today.raw 302s *** Test of content of output follows... 302s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 302s No file /var/log/chkrootkit/log.expected 302s OK 302s **** Test for '^This file should contain expected output from chkrootkit$' 302s This file should contain expected output from chkrootkit 302s OK 302s **** Test for '^$' 302s 302s 302s 302s 302s 302s 302s 302s 302s OK 302s **** Test for '^Today's run produced the following output:$' 302s Today's run produced the following output: 302s OK 302s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 302s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 302s OK 302s **** Test for '^ROOTDIR is `/'$' 302s ROOTDIR is `/' 302s OK 302s **** Test for '^Checking `amd'\.\.\. not infected$' 302s Checking `amd'... not infected 302s OK 302s **** Test for '^Checking `basename'\.\.\. not infected$' 302s Checking `basename'... not infected 302s OK 302s **** Test for '^Checking `biff'\.\.\. not infected$' 302s Checking `biff'... not infected 302s OK 302s **** Test for '^Checking `chfn'\.\.\. not infected$' 302s Checking `chfn'... not infected 302s OK 302s **** Test for '^Checking `chsh'\.\.\. not infected$' 302s Checking `chsh'... not infected 302s OK 302s **** Test for '^Checking `cron'\.\.\. not infected$' 302s Checking `cron'... not infected 302s OK 302s **** Test for '^Checking `crontab'\.\.\. not infected$' 302s Checking `crontab'... not infected 302s OK 302s **** Test for '^Checking `date'\.\.\. not infected$' 302s Checking `date'... not infected 302s OK 302s **** Test for '^Checking `du'\.\.\. not infected$' 302s Checking `du'... not infected 302s OK 302s **** Test for '^Checking `dirname'\.\.\. not infected$' 302s Checking `dirname'... not infected 302s OK 302s **** Test for '^Checking `echo'\.\.\. not infected$' 302s Checking `echo'... not infected 302s OK 302s **** Test for '^Checking `egrep'\.\.\. not infected$' 302s Checking `egrep'... not infected 302s OK 302s **** Test for '^Checking `env'\.\.\. not infected$' 302s Checking `env'... not infected 302s OK 302s **** Test for '^Checking `find'\.\.\. not infected$' 302s Checking `find'... not infected 302s OK 302s **** Test for '^Checking `fingerd'\.\.\. not infected$' 302s Checking `fingerd'... not infected 302s OK 302s **** Test for '^Checking `gpm'\.\.\. not infected$' 302s Checking `gpm'... not infected 302s OK 302s **** Test for '^Checking `grep'\.\.\. not infected$' 302s Checking `grep'... not infected 302s OK 302s **** Test for '^Checking `hdparm'\.\.\. not infected$' 302s Checking `hdparm'... not infected 302s OK 302s **** Test for '^Checking `su'\.\.\. not infected$' 302s Checking `su'... not infected 302s OK 302s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 302s Checking `ifconfig'... not infected 302s OK 302s **** Test for '^Checking `inetd'\.\.\. not infected$' 302s Checking `inetd'... not infected 302s OK 302s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 302s Checking `inetdconf'... not infected 302s OK 302s **** Test for '^Checking `identd'\.\.\. not infected$' 302s Checking `identd'... not infected 302s OK 302s **** Test for '^Checking `init'\.\.\. not infected$' 302s Checking `init'... not infected 302s OK 302s **** Test for '^Checking `killall'\.\.\. not infected$' 302s Checking `killall'... not infected 302s OK 302s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 302s Checking `ldsopreload'... not infected 302s OK 302s **** Test for '^Checking `login'\.\.\. not infected$' 302s Checking `login'... not infected 302s OK 302s **** Test for '^Checking `ls'\.\.\. not infected$' 302s Checking `ls'... not infected 302s OK 302s **** Test for '^Checking `lsof'\.\.\. not infected$' 302s Checking `lsof'... not infected 302s OK 302s **** Test for '^Checking `mail'\.\.\. not infected$' 302s Checking `mail'... not infected 302s OK 302s **** Test for '^Checking `mingetty'\.\.\. not infected$' 302s Checking `mingetty'... not infected 302s OK 302s **** Test for '^Checking `netstat'\.\.\. not infected$' 302s Checking `netstat'... not infected 302s OK 302s **** Test for '^Checking `named'\.\.\. not infected$' 302s Checking `named'... not infected 302s OK 302s **** Test for '^Checking `passwd'\.\.\. not infected$' 302s Checking `passwd'... not infected 302s OK 302s **** Test for '^Checking `pidof'\.\.\. not infected$' 302s Checking `pidof'... not infected 302s OK 302s **** Test for '^Checking `pop2'\.\.\. not infected$' 302s Checking `pop2'... not infected 302s OK 302s **** Test for '^Checking `pop3'\.\.\. not infected$' 302s Checking `pop3'... not infected 302s OK 302s **** Test for '^Checking `ps'\.\.\. not infected$' 302s Checking `ps'... not infected 302s OK 302s **** Test for '^Checking `pstree'\.\.\. not infected$' 302s Checking `pstree'... not infected 302s OK 302s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 302s Checking `rpcinfo'... not infected 302s OK 302s **** Test for '^Checking `rlogind'\.\.\. not infected$' 302s Checking `rlogind'... not infected 302s OK 302s **** Test for '^Checking `rshd'\.\.\. not infected$' 302s Checking `rshd'... not infected 302s OK 302s **** Test for '^Checking `slogin'\.\.\. not infected$' 302s Checking `slogin'... not infected 302s OK 302s **** Test for '^Checking `sendmail'\.\.\. not infected$' 302s Checking `sendmail'... not infected 302s OK 302s **** Test for '^Checking `sshd'\.\.\. not infected$' 302s Checking `sshd'... not infected 302s OK 302s **** Test for '^Checking `syslogd'\.\.\. not infected$' 302s Checking `syslogd'... not infected 302s OK 302s **** Test for '^Checking `tar'\.\.\. not infected$' 302s Checking `tar'... not infected 302s OK 302s **** Test for '^Checking `tcpd'\.\.\. not infected$' 302s Checking `tcpd'... not infected 302s OK 302s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 302s Checking `tcpdump'... not infected 302s OK 302s **** Test for '^Checking `top'\.\.\. not infected$' 302s Checking `top'... not infected 302s OK 302s **** Test for '^Checking `telnetd'\.\.\. not infected$' 302s Checking `telnetd'... not infected 302s OK 302s **** Test for '^Checking `timed'\.\.\. not infected$' 302s Checking `timed'... not infected 302s OK 302s **** Test for '^Checking `traceroute'\.\.\. not infected$' 302s Checking `traceroute'... not infected 302s OK 302s **** Test for '^Checking `vdir'\.\.\. not infected$' 302s Checking `vdir'... not infected 302s OK 302s **** Test for '^Checking `w'\.\.\. not infected$' 302s Checking `w'... not infected 302s OK 302s **** Test for '^Checking `write'\.\.\. not infected$' 302s Checking `write'... not infected 302s OK 302s **** Test for '^Checking `aliens'\.\.\. started$' 302s Checking `aliens'... started 302s OK 302s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 302s Searching for suspicious files in /dev... not found 302s OK 302s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 302s Searching for known suspicious directories... not found 302s OK 302s **** Test for '^Searching for known suspicious files\.\.\. not found$' 302s Searching for known suspicious files... not found 302s OK 302s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 302s Searching for sniffer's logs... not found 302s OK 302s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 302s Searching for HiDrootkit rootkit... not found 302s OK 302s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 302s Searching for t0rn rootkit... not found 302s OK 302s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 302s Searching for t0rn v8 (or variation)... not found 302s OK 302s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 302s Searching for Lion rootkit... not found 302s OK 302s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 302s Searching for RSHA rootkit... not found 302s OK 302s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 302s Searching for RH-Sharpe rootkit... not found 302s OK 302s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 302s Searching for Ambient (ark) rootkit... not found 302s OK 302s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 302s Searching for suspicious files and dirs... WARNING 302s OK 302s **** Test for '^WARNING: The following suspicious files and directories were found:$' 302s WARNING: The following suspicious files and directories were found: 302s OK 302s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 302s /usr/lib/.1 [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 302s /usr/lib/.aaa [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 302s /usr/lib/.1DIR [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 302s /usr/lib/...DIR [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 302s /usr/lib/.bbb [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 302s /usr/lib/.DIR-aaa [Not from a Debian package] 302s OK 302s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 302s /usr/lib/... [Not from a Debian package] 302s OK 302s **** Test for '^$' 302s 302s 302s 302s 302s 302s 302s 302s 302s OK 302s **** Test for '^Searching for LPD Worm\.\.\. not found$' 302s Searching for LPD Worm... not found 302s OK 302s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 302s Searching for Ramen Worm rootkit... not found 302s OK 302s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 302s Searching for Maniac rootkit... not found 302s OK 302s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 302s Searching for RK17 rootkit... not found 302s OK 302s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 302s Searching for Ducoci rootkit... not found 302s OK 302s **** Test for '^Searching for Adore Worm\.\.\. not found$' 302s Searching for Adore Worm... not found 302s OK 302s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 302s Searching for ShitC Worm... not found 302s OK 302s **** Test for '^Searching for Omega Worm\.\.\. not found$' 302s Searching for Omega Worm... not found 302s OK 302s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 302s Searching for Sadmind/IIS Worm... not found 302s OK 302s **** Test for '^Searching for MonKit\.\.\. not found$' 302s Searching for MonKit... not found 302s OK 302s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 302s Searching for Showtee rootkit... not found 302s OK 302s **** Test for '^Searching for OpticKit\.\.\. not found$' 302s Searching for OpticKit... not found 302s OK 302s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 302s Searching for T.R.K... not found 302s OK 302s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 302s Searching for Mithra rootkit... not found 302s OK 302s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 302s Searching for OBSD rootkit v1... not tested 302s OK 302s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 302s Searching for LOC rootkit... not found 302s OK 302s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 302s Searching for Romanian rootkit... not found 302s OK 302s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 302s Searching for HKRK rootkit... not found 302s OK 302s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 302s Searching for Suckit rootkit... not found 302s OK 302s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 302s Searching for Volc rootkit... not found 302s OK 302s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 302s Searching for Gold2 rootkit... not found 302s OK 302s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 302s Searching for TC2 rootkit... not found 302s OK 302s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 302s Searching for Anonoying rootkit... not found 302s OK 302s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 302s Searching for ZK rootkit... not found 302s OK 302s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 302s Searching for ShKit rootkit... not found 302s OK 302s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 302s Searching for AjaKit rootkit... not found 302s OK 302s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 302s Searching for zaRwT rootkit... not found 302s OK 302s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 302s Searching for Madalin rootkit... not found 302s OK 302s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 302s Searching for Fu rootkit... not found 302s OK 302s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 302s Searching for Kenga3 rootkit... not found 302s OK 302s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 302s Searching for ESRK rootkit... not found 302s OK 302s **** Test for '^Searching for rootedoor\.\.\. not found$' 302s Searching for rootedoor... not found 302s OK 302s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 302s Searching for ENYELKM rootkit... not found 302s OK 302s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 302s Searching for common ssh-scanners... not found 302s OK 302s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 302s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 302s OK 302s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 302s Searching for Linux/Ebury 1.6... not tested 302s OK 302s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 302s Searching for 64-bit Linux Rootkit... not found 302s OK 302s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 302s Searching for 64-bit Linux Rootkit modules... not found 302s OK 302s **** Test for '^Searching for Mumblehard\.\.\. not found$' 302s Searching for Mumblehard... not found 302s OK 302s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 302s Searching for Backdoor.Linux.Mokes.a... not found 302s OK 302s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 302s Searching for Malicious TinyDNS... not found 302s OK 302s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 302s Searching for Linux.Xor.DDoS... WARNING 302s OK 302s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 302s WARNING: Possible Linux.Xor.DDoS installed: 302s OK 302s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 302s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 302s OK 302s **** Test for '^/tmp/clean/.+$' 302s /tmp/clean/ps [Not from a Debian package] 302s /tmp/clean/head [Not from a Debian package] 302s /tmp/clean/cut [Not from a Debian package] 302s /tmp/clean/ls [Not from a Debian package] 302s /tmp/clean/echo [Not from a Debian package] 302s /tmp/clean/awk [Not from a Debian package] 302s /tmp/clean/dpkg-query [Not from a Debian package] 302s /tmp/clean/sed [Not from a Debian package] 302s /tmp/clean/strings [Not from a Debian package] 302s /tmp/clean/netstat [Not from a Debian package] 302s /tmp/clean/uname [Not from a Debian package] 302s /tmp/clean/id [Not from a Debian package] 302s /tmp/clean/grep [Not from a Debian package] 302s /tmp/clean/find [Not from a Debian package] 302s /tmp/clean/dirname [Not from a Debian package] 302s /tmp/clean/xargs [Not from a Debian package] 302s /tmp/clean/ss [Not from a Debian package] 302s OK 302s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 302s Searching for Linux.Proxy.1.0... not found 302s OK 302s **** Test for '^Searching for CrossRAT\.\.\. not found$' 302s Searching for CrossRAT... not found 302s OK 302s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 302s Searching for Hidden Cobra... not found 302s OK 302s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 302s Searching for Rocke Miner rootkit... not found 302s OK 302s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 302s Searching for PWNLNX4 lkm rootkit... not found 302s OK 302s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 302s Searching for PWNLNX6 lkm rootkit... not found 302s OK 302s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 302s Searching for Umbreon lrk... not found 302s OK 302s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 302s Searching for Kinsing.a backdoor rootkit... not found 302s OK 302s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 302s Searching for RotaJakiro backdoor rootkit... not found 302s OK 302s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 302s Searching for Syslogk LKM rootkit... not found 302s OK 302s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 302s Searching for Kovid LKM rootkit... not tested 302s OK 302s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 302s Searching for Tsunami DDoS Malware rootkit... not found 302s OK 302s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 302s Searching for Linux BPF Door... not found 302s OK 302s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 302s Searching for suspect PHP files... not found 302s OK 302s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 302s Searching for zero-size shell history files in /root... not found 302s OK 302s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 302s Searching for hardlinked shell history files in /root... not found 302s OK 302s **** Test for '^Checking `aliens'\.\.\. finished$' 302s Checking `aliens'... finished 302s OK 302s **** Test for '^Checking `asp'\.\.\. not infected$' 302s Checking `asp'... not infected 302s OK 302s **** Test for '^Checking `bindshell'\.\.\. not found$' 302s Checking `bindshell'... not found 302s OK 302s **** Test for '^Checking `lkm'\.\.\. started$' 302s Checking `lkm'... started 302s OK 302s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 302s Searching for Adore LKM... not tested 302s OK 302s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 302s Searching for sebek LKM (Adore based)... not tested 302s OK 302s **** Test for '^Searching for knark LKM rootkit... not found$' 302s Searching for knark LKM rootkit... not found 302s OK 302s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 302s Searching for for hidden processes with chkproc... not found 302s OK 302s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 302s Searching for for hidden directories using chkdirs... not found 302s OK 302s **** Test for '^Checking `lkm'\.\.\. finished$' 302s Checking `lkm'... finished 302s OK 302s **** Test for '^Checking `rexedcs'\.\.\. not found$' 302s Checking `rexedcs'... not found 302s OK 302s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 302s Checking `sniffer'... WARNING 302s OK 302s **** Test for '^WARNING: Output from ifpromisc:$' 302s WARNING: Output from ifpromisc: 302s OK 302s **** Test for '^lo: not promisc and no packet sniffer sockets$' 302s lo: not promisc and no packet sniffer sockets 302s OK 302s **** Test for '^Checking `w55808'\.\.\. not found$' 302s Checking `w55808'... not found 302s OK 302s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 302s Checking `wted'... not found 302s OK 302s **** Test for '^Checking `scalper'\.\.\. not found$' 302s Checking `scalper'... not found 302s OK 302s **** Test for '^Checking `slapper'\.\.\. not found$' 302s Checking `slapper'... not found 302s OK 302s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 302s Checking `z2'... not found 302s OK 302s **** Test for '^Checking `chkutmp'\.\.\.' 302s Checking `chkutmp'... not found 302s OK 302s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 302s Checking `OSX_RSPLUG'... not tested 302s OK 302s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 302s --- [ END: cat /var/log/chkrootkit/log.today ] --- 302s OK 302s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 302s To create this file containing all output from today's run, do (as root) 302s OK 302s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 302s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 302s OK 302s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 302s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 302s OK 302s ** PASS: Testing: cron-with-diff-mode-01-full (chkrootkit-daily) done: PASS 302s *** Unexpected (unmatched) lines follow (for info): 302s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 302s ** Testing: cron-with-diff-mode-02-full-rerun (chkrootkit-daily) ... 302s *** Output 314s No file /var/log/chkrootkit/log.expected 314s This file should contain expected output from chkrootkit 314s 314s Today's run produced the following output: 314s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 314s ROOTDIR is `/' 314s Checking `amd'... not infected 314s Checking `basename'... not infected 314s Checking `biff'... not infected 314s Checking `chfn'... not infected 314s Checking `chsh'... not infected 314s Checking `cron'... not infected 314s Checking `crontab'... not infected 314s Checking `date'... not infected 314s Checking `du'... not infected 314s Checking `dirname'... not infected 314s Checking `echo'... not infected 314s Checking `egrep'... not infected 314s Checking `env'... not infected 314s Checking `find'... not infected 314s Checking `fingerd'... not infected 314s Checking `gpm'... not infected 314s Checking `grep'... not infected 314s Checking `hdparm'... not infected 314s Checking `su'... not infected 314s Checking `ifconfig'... not infected 314s Checking `inetd'... not infected 314s Checking `inetdconf'... not infected 314s Checking `identd'... not infected 314s Checking `init'... not infected 314s Checking `killall'... not infected 314s Checking `ldsopreload'... not infected 314s Checking `login'... not infected 314s Checking `ls'... not infected 314s Checking `lsof'... not infected 314s Checking `mail'... not infected 314s Checking `mingetty'... not infected 314s Checking `netstat'... not infected 314s Checking `named'... not infected 314s Checking `passwd'... not infected 314s Checking `pidof'... not infected 314s Checking `pop2'... not infected 314s Checking `pop3'... not infected 314s Checking `ps'... not infected 314s Checking `pstree'... not infected 314s Checking `rpcinfo'... not infected 314s Checking `rlogind'... not infected 314s Checking `rshd'... not infected 314s Checking `slogin'... not infected 314s Checking `sendmail'... not infected 314s Checking `sshd'... not infected 314s Checking `syslogd'... not infected 314s Checking `tar'... not infected 314s Checking `tcpd'... not infected 314s Checking `tcpdump'... not infected 314s Checking `top'... not infected 314s Checking `telnetd'... not infected 314s Checking `timed'... not infected 314s Checking `traceroute'... not infected 314s Checking `vdir'... not infected 314s Checking `w'... not infected 314s Checking `write'... not infected 314s Checking `aliens'... started 314s Searching for suspicious files in /dev... not found 314s Searching for known suspicious directories... not found 314s Searching for known suspicious files... not found 314s Searching for sniffer's logs... not found 314s Searching for HiDrootkit rootkit... not found 314s Searching for t0rn rootkit... not found 314s Searching for t0rn v8 (or variation)... not found 314s Searching for Lion rootkit... not found 314s Searching for RSHA rootkit... not found 314s Searching for RH-Sharpe rootkit... not found 314s Searching for Ambient (ark) rootkit... not found 314s Searching for suspicious files and dirs... WARNING 314s 314s WARNING: The following suspicious files and directories were found: 314s /usr/lib/... [Not from a Debian package] 314s /usr/lib/.aaa [Not from a Debian package] 314s /usr/lib/.1 [Not from a Debian package] 314s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 314s /usr/lib/.bbb [Not from a Debian package] 314s /usr/lib/.1DIR [Not from a Debian package] 314s /usr/lib/.DIR-aaa [Not from a Debian package] 314s /usr/lib/...DIR [Not from a Debian package] 314s 314s Searching for LPD Worm... not found 314s Searching for Ramen Worm rootkit... not found 314s Searching for Maniac rootkit... not found 314s Searching for RK17 rootkit... not found 314s Searching for Ducoci rootkit... not found 314s Searching for Adore Worm... not found 314s Searching for ShitC Worm... not found 314s Searching for Omega Worm... not found 314s Searching for Sadmind/IIS Worm... not found 314s Searching for MonKit... not found 314s Searching for Showtee rootkit... not found 314s Searching for OpticKit... not found 314s Searching for T.R.K... not found 314s Searching for Mithra rootkit... not found 314s Searching for OBSD rootkit v1... not tested 314s Searching for LOC rootkit... not found 314s Searching for Romanian rootkit... not found 314s Searching for HKRK rootkit... not found 314s Searching for Suckit rootkit... not found 314s Searching for Volc rootkit... not found 314s Searching for Gold2 rootkit... not found 314s Searching for TC2 rootkit... not found 314s Searching for Anonoying rootkit... not found 314s Searching for ZK rootkit... not found 314s Searching for ShKit rootkit... not found 314s Searching for AjaKit rootkit... not found 314s Searching for zaRwT rootkit... not found 314s Searching for Madalin rootkit... not found 314s Searching for Fu rootkit... not found 314s Searching for Kenga3 rootkit... not found 314s Searching for ESRK rootkit... not found 314s Searching for rootedoor... not found 314s Searching for ENYELKM rootkit... not found 314s Searching for common ssh-scanners... not found 314s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 314s Searching for Linux/Ebury 1.6... not tested 314s Searching for 64-bit Linux Rootkit... not found 314s Searching for 64-bit Linux Rootkit modules... not found 314s Searching for Mumblehard... not found 314s Searching for Backdoor.Linux.Mokes.a... not found 314s Searching for Malicious TinyDNS... not found 314s Searching for Linux.Xor.DDoS... WARNING 314s 314s WARNING: Possible Linux.Xor.DDoS installed: 314s /tmp/clean/ps [Not from a Debian package] 314s /tmp/clean/head [Not from a Debian package] 314s /tmp/clean/cut [Not from a Debian package] 314s /tmp/clean/ls [Not from a Debian package] 314s /tmp/clean/echo [Not from a Debian package] 314s /tmp/clean/awk [Not from a Debian package] 314s /tmp/clean/dpkg-query [Not from a Debian package] 314s /tmp/clean/sed [Not from a Debian package] 314s /tmp/clean/strings [Not from a Debian package] 314s /tmp/clean/netstat [Not from a Debian package] 314s /tmp/clean/uname [Not from a Debian package] 314s /tmp/clean/id [Not from a Debian package] 314s /tmp/clean/grep [Not from a Debian package] 314s /tmp/clean/find [Not from a Debian package] 314s /tmp/clean/dirname [Not from a Debian package] 314s /tmp/clean/xargs [Not from a Debian package] 314s /tmp/clean/ss [Not from a Debian package] 314s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 314s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 314s 314s Searching for Linux.Proxy.1.0... not found 314s Searching for CrossRAT... not found 314s Searching for Hidden Cobra... not found 314s Searching for Rocke Miner rootkit... not found 314s Searching for PWNLNX4 lkm rootkit... not found 314s Searching for PWNLNX6 lkm rootkit... not found 314s Searching for Umbreon lrk... not found 314s Searching for Kinsing.a backdoor rootkit... not found 314s Searching for RotaJakiro backdoor rootkit... not found 314s Searching for Syslogk LKM rootkit... not found 314s Searching for Kovid LKM rootkit... not tested 314s Searching for Tsunami DDoS Malware rootkit... not found 314s Searching for Linux BPF Door... not found 314s Searching for suspect PHP files... not found 314s Searching for zero-size shell history files in /root... not found 314s Searching for hardlinked shell history files in /root... not found 314s Checking `aliens'... finished 314s Checking `asp'... not infected 314s Checking `bindshell'... not found 314s Checking `lkm'... started 314s Searching for Adore LKM... not tested 314s Searching for sebek LKM (Adore based)... not tested 314s Searching for knark LKM rootkit... not found 314s Searching for for hidden processes with chkproc... not found 314s Searching for for hidden directories using chkdirs... not found 314s Checking `lkm'... finished 314s Checking `rexedcs'... not found 314s Checking `sniffer'... WARNING 314s 314s WARNING: Output from ifpromisc: 314s lo: not promisc and no packet sniffer sockets 314s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 314s 314s Checking `w55808'... not found 314s Checking `wted'... not found 314s Checking `scalper'... not found 314s Checking `slapper'... not found 314s Checking `z2'... not found 314s Checking `chkutmp'... not found 314s Checking `OSX_RSPLUG'... not tested 314s --- [ END: cat /var/log/chkrootkit/log.today ] --- 314s 314s To create this file containing all output from today's run, do (as root) 314s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 314s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 314s **** Files in log 314s total 80K 314s drwxr-xr-x 2 root root 4.0K Nov 26 20:43 . 314s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 314s -rw-r--r-- 1 root root 22K Nov 26 20:45 chkrootkit-daily.log 314s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 314s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 314s *** Test of content of output follows... 314s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 314s No file /var/log/chkrootkit/log.expected 314s OK 314s **** Test for '^This file should contain expected output from chkrootkit$' 314s This file should contain expected output from chkrootkit 314s OK 314s **** Test for '^$' 314s 314s 314s 314s 314s 314s 314s 314s 314s OK 314s **** Test for '^Today's run produced the following output:$' 314s Today's run produced the following output: 314s OK 314s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 314s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 314s OK 314s **** Test for '^ROOTDIR is `/'$' 314s ROOTDIR is `/' 314s OK 314s **** Test for '^Checking `amd'\.\.\. not infected$' 314s Checking `amd'... not infected 314s OK 314s **** Test for '^Checking `basename'\.\.\. not infected$' 314s Checking `basename'... not infected 314s OK 314s **** Test for '^Checking `biff'\.\.\. not infected$' 314s Checking `biff'... not infected 314s OK 314s **** Test for '^Checking `chfn'\.\.\. not infected$' 314s Checking `chfn'... not infected 314s OK 314s **** Test for '^Checking `chsh'\.\.\. not infected$' 314s Checking `chsh'... not infected 314s OK 314s **** Test for '^Checking `cron'\.\.\. not infected$' 314s Checking `cron'... not infected 314s OK 314s **** Test for '^Checking `crontab'\.\.\. not infected$' 314s Checking `crontab'... not infected 314s OK 314s **** Test for '^Checking `date'\.\.\. not infected$' 314s Checking `date'... not infected 314s OK 314s **** Test for '^Checking `du'\.\.\. not infected$' 314s Checking `du'... not infected 314s OK 314s **** Test for '^Checking `dirname'\.\.\. not infected$' 314s Checking `dirname'... not infected 314s OK 314s **** Test for '^Checking `echo'\.\.\. not infected$' 314s Checking `echo'... not infected 314s OK 314s **** Test for '^Checking `egrep'\.\.\. not infected$' 314s Checking `egrep'... not infected 314s OK 314s **** Test for '^Checking `env'\.\.\. not infected$' 314s Checking `env'... not infected 314s OK 314s **** Test for '^Checking `find'\.\.\. not infected$' 314s Checking `find'... not infected 314s OK 314s **** Test for '^Checking `fingerd'\.\.\. not infected$' 314s Checking `fingerd'... not infected 314s OK 314s **** Test for '^Checking `gpm'\.\.\. not infected$' 314s Checking `gpm'... not infected 314s OK 314s **** Test for '^Checking `grep'\.\.\. not infected$' 314s Checking `grep'... not infected 314s OK 314s **** Test for '^Checking `hdparm'\.\.\. not infected$' 314s Checking `hdparm'... not infected 314s OK 314s **** Test for '^Checking `su'\.\.\. not infected$' 314s Checking `su'... not infected 314s OK 314s **** Test for '^Checking `ifconfig'\.\.\. not infected$' 314s Checking `ifconfig'... not infected 314s OK 314s **** Test for '^Checking `inetd'\.\.\. not infected$' 314s Checking `inetd'... not infected 314s OK 314s **** Test for '^Checking `inetdconf'\.\.\. not infected$' 314s Checking `inetdconf'... not infected 314s OK 314s **** Test for '^Checking `identd'\.\.\. not infected$' 314s Checking `identd'... not infected 314s OK 314s **** Test for '^Checking `init'\.\.\. not infected$' 314s Checking `init'... not infected 314s OK 314s **** Test for '^Checking `killall'\.\.\. not infected$' 314s Checking `killall'... not infected 314s OK 314s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 314s Checking `ldsopreload'... not infected 314s OK 314s **** Test for '^Checking `login'\.\.\. not infected$' 314s Checking `login'... not infected 314s OK 314s **** Test for '^Checking `ls'\.\.\. not infected$' 314s Checking `ls'... not infected 314s OK 314s **** Test for '^Checking `lsof'\.\.\. not infected$' 314s Checking `lsof'... not infected 314s OK 314s **** Test for '^Checking `mail'\.\.\. not infected$' 314s Checking `mail'... not infected 314s OK 314s **** Test for '^Checking `mingetty'\.\.\. not infected$' 314s Checking `mingetty'... not infected 314s OK 314s **** Test for '^Checking `netstat'\.\.\. not infected$' 314s Checking `netstat'... not infected 314s OK 314s **** Test for '^Checking `named'\.\.\. not infected$' 314s Checking `named'... not infected 314s OK 314s **** Test for '^Checking `passwd'\.\.\. not infected$' 314s Checking `passwd'... not infected 314s OK 314s **** Test for '^Checking `pidof'\.\.\. not infected$' 314s Checking `pidof'... not infected 314s OK 314s **** Test for '^Checking `pop2'\.\.\. not infected$' 314s Checking `pop2'... not infected 314s OK 314s **** Test for '^Checking `pop3'\.\.\. not infected$' 314s Checking `pop3'... not infected 314s OK 314s **** Test for '^Checking `ps'\.\.\. not infected$' 314s Checking `ps'... not infected 314s OK 314s **** Test for '^Checking `pstree'\.\.\. not infected$' 314s Checking `pstree'... not infected 314s OK 314s **** Test for '^Checking `rpcinfo'\.\.\. not infected$' 314s Checking `rpcinfo'... not infected 314s OK 314s **** Test for '^Checking `rlogind'\.\.\. not infected$' 314s Checking `rlogind'... not infected 314s OK 314s **** Test for '^Checking `rshd'\.\.\. not infected$' 314s Checking `rshd'... not infected 314s OK 314s **** Test for '^Checking `slogin'\.\.\. not infected$' 314s Checking `slogin'... not infected 314s OK 314s **** Test for '^Checking `sendmail'\.\.\. not infected$' 314s Checking `sendmail'... not infected 314s OK 314s **** Test for '^Checking `sshd'\.\.\. not infected$' 314s Checking `sshd'... not infected 314s OK 314s **** Test for '^Checking `syslogd'\.\.\. not infected$' 314s Checking `syslogd'... not infected 314s OK 314s **** Test for '^Checking `tar'\.\.\. not infected$' 314s Checking `tar'... not infected 314s OK 314s **** Test for '^Checking `tcpd'\.\.\. not infected$' 314s Checking `tcpd'... not infected 314s OK 314s **** Test for '^Checking `tcpdump'\.\.\. not infected$' 314s Checking `tcpdump'... not infected 314s OK 314s **** Test for '^Checking `top'\.\.\. not infected$' 314s Checking `top'... not infected 314s OK 314s **** Test for '^Checking `telnetd'\.\.\. not infected$' 314s Checking `telnetd'... not infected 314s OK 314s **** Test for '^Checking `timed'\.\.\. not infected$' 314s Checking `timed'... not infected 314s OK 314s **** Test for '^Checking `traceroute'\.\.\. not infected$' 314s Checking `traceroute'... not infected 314s OK 314s **** Test for '^Checking `vdir'\.\.\. not infected$' 314s Checking `vdir'... not infected 314s OK 314s **** Test for '^Checking `w'\.\.\. not infected$' 314s Checking `w'... not infected 314s OK 314s **** Test for '^Checking `write'\.\.\. not infected$' 314s Checking `write'... not infected 314s OK 314s **** Test for '^Checking `aliens'\.\.\. started$' 314s Checking `aliens'... started 314s OK 314s **** Test for '^Searching for suspicious files in /dev\.\.\. not found$' 314s Searching for suspicious files in /dev... not found 314s OK 314s **** Test for '^Searching for known suspicious directories\.\.\. not found$' 314s Searching for known suspicious directories... not found 314s OK 314s **** Test for '^Searching for known suspicious files\.\.\. not found$' 314s Searching for known suspicious files... not found 314s OK 314s **** Test for '^Searching for sniffer's logs\.\.\. not found$' 314s Searching for sniffer's logs... not found 314s OK 314s **** Test for '^Searching for HiDrootkit rootkit\.\.\. not found$' 314s Searching for HiDrootkit rootkit... not found 314s OK 314s **** Test for '^Searching for t0rn rootkit\.\.\. not found$' 314s Searching for t0rn rootkit... not found 314s OK 314s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 314s Searching for t0rn v8 (or variation)... not found 314s OK 314s **** Test for '^Searching for Lion rootkit\.\.\. not found$' 314s Searching for Lion rootkit... not found 314s OK 314s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 314s Searching for RSHA rootkit... not found 314s OK 314s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. not found$' 314s Searching for RH-Sharpe rootkit... not found 314s OK 314s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 314s Searching for Ambient (ark) rootkit... not found 314s OK 314s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 314s Searching for suspicious files and dirs... WARNING 314s OK 314s **** Test for '^WARNING: The following suspicious files and directories were found:$' 314s WARNING: The following suspicious files and directories were found: 314s OK 314s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 314s /usr/lib/.1 [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 314s /usr/lib/.aaa [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 314s /usr/lib/.1DIR [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 314s /usr/lib/...DIR [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 314s /usr/lib/.bbb [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 314s /usr/lib/.DIR-aaa [Not from a Debian package] 314s OK 314s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 314s /usr/lib/... [Not from a Debian package] 314s OK 314s **** Test for '^$' 314s 314s 314s 314s 314s 314s 314s 314s 314s OK 314s **** Test for '^Searching for LPD Worm\.\.\. not found$' 314s Searching for LPD Worm... not found 314s OK 314s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 314s Searching for Ramen Worm rootkit... not found 314s OK 314s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 314s Searching for Maniac rootkit... not found 314s OK 314s **** Test for '^Searching for RK17 rootkit\.\.\. not found$' 314s Searching for RK17 rootkit... not found 314s OK 314s **** Test for '^Searching for Ducoci rootkit\.\.\. not found$' 314s Searching for Ducoci rootkit... not found 314s OK 314s **** Test for '^Searching for Adore Worm\.\.\. not found$' 314s Searching for Adore Worm... not found 314s OK 314s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 314s Searching for ShitC Worm... not found 314s OK 314s **** Test for '^Searching for Omega Worm\.\.\. not found$' 314s Searching for Omega Worm... not found 314s OK 314s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. not found$' 314s Searching for Sadmind/IIS Worm... not found 314s OK 314s **** Test for '^Searching for MonKit\.\.\. not found$' 314s Searching for MonKit... not found 314s OK 314s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 314s Searching for Showtee rootkit... not found 314s OK 314s **** Test for '^Searching for OpticKit\.\.\. not found$' 314s Searching for OpticKit... not found 314s OK 314s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 314s Searching for T.R.K... not found 314s OK 314s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 314s Searching for Mithra rootkit... not found 314s OK 314s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 314s Searching for OBSD rootkit v1... not tested 314s OK 314s **** Test for '^Searching for LOC rootkit\.\.\. not found$' 314s Searching for LOC rootkit... not found 314s OK 314s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 314s Searching for Romanian rootkit... not found 314s OK 314s **** Test for '^Searching for HKRK rootkit\.\.\. not found$' 314s Searching for HKRK rootkit... not found 314s OK 314s **** Test for '^Searching for Suckit rootkit\.\.\. not found$' 314s Searching for Suckit rootkit... not found 314s OK 314s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 314s Searching for Volc rootkit... not found 314s OK 314s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 314s Searching for Gold2 rootkit... not found 314s OK 314s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 314s Searching for TC2 rootkit... not found 314s OK 314s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 314s Searching for Anonoying rootkit... not found 314s OK 314s **** Test for '^Searching for ZK rootkit\.\.\. not found$' 314s Searching for ZK rootkit... not found 314s OK 314s **** Test for '^Searching for ShKit rootkit\.\.\. not found$' 314s Searching for ShKit rootkit... not found 314s OK 314s **** Test for '^Searching for AjaKit rootkit\.\.\. not found$' 314s Searching for AjaKit rootkit... not found 314s OK 314s **** Test for '^Searching for zaRwT rootkit\.\.\. not found$' 314s Searching for zaRwT rootkit... not found 314s OK 314s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 314s Searching for Madalin rootkit... not found 314s OK 314s **** Test for '^Searching for Fu rootkit\.\.\. not found$' 314s Searching for Fu rootkit... not found 314s OK 314s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 314s Searching for Kenga3 rootkit... not found 314s OK 314s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 314s Searching for ESRK rootkit... not found 314s OK 314s **** Test for '^Searching for rootedoor\.\.\. not found$' 314s Searching for rootedoor... not found 314s OK 314s **** Test for '^Searching for ENYELKM rootkit\.\.\. not found$' 314s Searching for ENYELKM rootkit... not found 314s OK 314s **** Test for '^Searching for common ssh-scanners\.\.\. not found$' 314s Searching for common ssh-scanners... not found 314s OK 314s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. (not found|not tested)$' 314s Searching for Linux/Ebury 1.4 - Operation Windigo... not tested 314s OK 314s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. (not found|not tested)$' 314s Searching for Linux/Ebury 1.6... not tested 314s OK 314s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. not found$' 314s Searching for 64-bit Linux Rootkit... not found 314s OK 314s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. not found$' 314s Searching for 64-bit Linux Rootkit modules... not found 314s OK 314s **** Test for '^Searching for Mumblehard\.\.\. not found$' 314s Searching for Mumblehard... not found 314s OK 314s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. not found$' 314s Searching for Backdoor.Linux.Mokes.a... not found 314s OK 314s **** Test for '^Searching for Malicious TinyDNS\.\.\. not found$' 314s Searching for Malicious TinyDNS... not found 314s OK 314s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 314s Searching for Linux.Xor.DDoS... WARNING 314s OK 314s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 314s WARNING: Possible Linux.Xor.DDoS installed: 314s OK 314s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 314s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 314s OK 314s **** Test for '^/tmp/clean/.+$' 314s /tmp/clean/ps [Not from a Debian package] 314s /tmp/clean/head [Not from a Debian package] 314s /tmp/clean/cut [Not from a Debian package] 314s /tmp/clean/ls [Not from a Debian package] 314s /tmp/clean/echo [Not from a Debian package] 314s /tmp/clean/awk [Not from a Debian package] 314s /tmp/clean/dpkg-query [Not from a Debian package] 314s /tmp/clean/sed [Not from a Debian package] 314s /tmp/clean/strings [Not from a Debian package] 314s /tmp/clean/netstat [Not from a Debian package] 314s /tmp/clean/uname [Not from a Debian package] 314s /tmp/clean/id [Not from a Debian package] 314s /tmp/clean/grep [Not from a Debian package] 314s /tmp/clean/find [Not from a Debian package] 314s /tmp/clean/dirname [Not from a Debian package] 314s /tmp/clean/xargs [Not from a Debian package] 314s /tmp/clean/ss [Not from a Debian package] 314s OK 314s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. not found$' 314s Searching for Linux.Proxy.1.0... not found 314s OK 314s **** Test for '^Searching for CrossRAT\.\.\. not found$' 314s Searching for CrossRAT... not found 314s OK 314s **** Test for '^Searching for Hidden Cobra\.\.\. not found$' 314s Searching for Hidden Cobra... not found 314s OK 314s **** Test for '^Searching for Rocke Miner rootkit\.\.\. not found$' 314s Searching for Rocke Miner rootkit... not found 314s OK 314s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. not found$' 314s Searching for PWNLNX4 lkm rootkit... not found 314s OK 314s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. not found$' 314s Searching for PWNLNX6 lkm rootkit... not found 314s OK 314s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 314s Searching for Umbreon lrk... not found 314s OK 314s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. not found$' 314s Searching for Kinsing.a backdoor rootkit... not found 314s OK 314s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. not found$' 314s Searching for RotaJakiro backdoor rootkit... not found 314s OK 314s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not found$' 314s Searching for Syslogk LKM rootkit... not found 314s OK 314s **** Test for '^Searching for Kovid LKM rootkit\.\.\. not tested$' 314s Searching for Kovid LKM rootkit... not tested 314s OK 314s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. not found$' 314s Searching for Tsunami DDoS Malware rootkit... not found 314s OK 314s **** Test for '^Searching for Linux BPF Door\.\.\. not found$' 314s Searching for Linux BPF Door... not found 314s OK 314s **** Test for '^Searching for suspect PHP files\.\.\. not found$' 314s Searching for suspect PHP files... not found 314s OK 314s **** Test for '^Searching for zero-size shell history files in /root\.\.\. not found$' 314s Searching for zero-size shell history files in /root... not found 314s OK 314s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. not found$' 314s Searching for hardlinked shell history files in /root... not found 314s OK 314s **** Test for '^Checking `aliens'\.\.\. finished$' 314s Checking `aliens'... finished 314s OK 314s **** Test for '^Checking `asp'\.\.\. not infected$' 314s Checking `asp'... not infected 314s OK 314s **** Test for '^Checking `bindshell'\.\.\. not found$' 314s Checking `bindshell'... not found 314s OK 314s **** Test for '^Checking `lkm'\.\.\. started$' 314s Checking `lkm'... started 314s OK 314s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 314s Searching for Adore LKM... not tested 314s OK 314s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 314s Searching for sebek LKM (Adore based)... not tested 314s OK 314s **** Test for '^Searching for knark LKM rootkit... not found$' 314s Searching for knark LKM rootkit... not found 314s OK 314s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 314s Searching for for hidden processes with chkproc... not found 314s OK 314s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 314s Searching for for hidden directories using chkdirs... not found 314s OK 314s **** Test for '^Checking `lkm'\.\.\. finished$' 314s Checking `lkm'... finished 314s OK 314s **** Test for '^Checking `rexedcs'\.\.\. not found$' 314s Checking `rexedcs'... not found 314s OK 314s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 314s Checking `sniffer'... WARNING 314s OK 314s **** Test for '^WARNING: Output from ifpromisc:$' 314s WARNING: Output from ifpromisc: 314s OK 314s **** Test for '^lo: not promisc and no packet sniffer sockets$' 314s lo: not promisc and no packet sniffer sockets 314s OK 314s **** Test for '^Checking `w55808'\.\.\. not found$' 314s Checking `w55808'... not found 314s OK 314s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 314s Checking `wted'... not found 314s OK 314s **** Test for '^Checking `scalper'\.\.\. not found$' 314s Checking `scalper'... not found 314s OK 314s **** Test for '^Checking `slapper'\.\.\. not found$' 314s Checking `slapper'... not found 314s OK 314s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 314s Checking `z2'... not found 314s OK 314s **** Test for '^Checking `chkutmp'\.\.\.' 314s Checking `chkutmp'... not found 314s OK 314s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 314s Checking `OSX_RSPLUG'... not tested 314s OK 314s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 314s --- [ END: cat /var/log/chkrootkit/log.today ] --- 314s OK 314s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 314s To create this file containing all output from today's run, do (as root) 314s OK 314s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 314s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 314s OK 314s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 314s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 314s OK 314s ** PASS: Testing: cron-with-diff-mode-02-full-rerun (chkrootkit-daily) done: PASS 314s *** Unexpected (unmatched) lines follow (for info): 314s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 314s ** Testing: cron-with-diff-mode-03-full-after-update (chkrootkit-daily) ... 314s *** Output 326s **** Files in log 326s total 80K 326s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 326s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 326s -rw-r--r-- 1 root root 0 Nov 26 20:45 chkrootkit-daily.log 326s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 326s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 326s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 326s *** Test of content of output follows... 326s **** Expected is empty, so output should be empty 326s Output is indeed empty: PASS 326s ** PASS: Testing: cron-with-diff-mode-03-full-after-update (chkrootkit-daily) done: PASS 326s ** Testing: cron-with-diff-mode-04-full-no-ionice (chkrootkit-daily) ... 326s *** Output 338s **** Files in log 338s total 80K 338s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 338s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 338s -rw-r--r-- 1 root root 0 Nov 26 20:45 chkrootkit-daily.log 338s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 338s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 338s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 338s *** Test of content of output follows... 338s **** Expected is empty, so output should be empty 338s Output is indeed empty: PASS 338s ** PASS: Testing: cron-with-diff-mode-04-full-no-ionice (chkrootkit-daily) done: PASS 338s ** Testing: cron-with-diff-mode-05-full-filter-and-ignore (chkrootkit-daily) ... 338s *** Output 349s chkrootkit output was not as expected. 349s 349s The difference is: 349s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 349s --- /var/log/chkrootkit/log.expected 2024-11-26 20:45:10.417968289 +0000 349s +++ /var/log/chkrootkit/log.today 2024-11-26 20:45:45.127962163 +0000 349s @@ -71,10 +71,9 @@ 349s 349s WARNING: The following suspicious files and directories were found: 349s /usr/lib/... [Not from a Debian package] 349s -/usr/lib/.aaa [Not from a Debian package] 349s /usr/lib/.1 [Not from a Debian package] 349s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 349s -/usr/lib/.bbb [Not from a Debian package] 349s +/usr/lib/.bCHANGED-IN-FILTER_ 349s /usr/lib/.1DIR [Not from a Debian package] 349s /usr/lib/.DIR-aaa [Not from a Debian package] 349s /usr/lib/...DIR [Not from a Debian package] 349s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 349s 349s To update the expected output, run (as root) 349s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 349s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 349s **** Files in log 349s total 84K 349s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 349s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 349s -rw-r--r-- 1 root root 1.1K Nov 26 20:45 chkrootkit-daily.log 349s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.expected 349s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today 349s -rw-r--r-- 1 root root 21K Nov 26 20:45 log.today.raw 349s *** Test of content of output follows... 349s **** Test for '^chkrootkit output was not as expected\.$' 349s chkrootkit output was not as expected. 349s OK 349s **** Test for '^$' 349s 349s 349s OK 349s **** Test for '^The difference is:$' 349s The difference is: 349s OK 349s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 349s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 349s OK 349s **** Test for '^--- /var/log/chkrootkit/log\.expected' 349s --- /var/log/chkrootkit/log.expected 2024-11-26 20:45:10.417968289 +0000 349s OK 349s **** Test for '^\++ /var/log/chkrootkit/log\.today' 349s +++ /var/log/chkrootkit/log.today 2024-11-26 20:45:45.127962163 +0000 349s OK 349s **** Test for '^@@[@0-9, +-]+$' 349s @@ -71,10 +71,9 @@ 349s OK 349s **** Test for '^[[:space:]]' 349s 349s WARNING: The following suspicious files and directories were found: 349s /usr/lib/... [Not from a Debian package] 349s /usr/lib/.1 [Not from a Debian package] 349s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 349s /usr/lib/.1DIR [Not from a Debian package] 349s /usr/lib/.DIR-aaa [Not from a Debian package] 349s /usr/lib/...DIR [Not from a Debian package] 349s OK 349s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 349s -/usr/lib/.aaa [Not from a Debian package] 349s OK 349s **** Test for '^-(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 349s -/usr/lib/.bbb [Not from a Debian package] 349s OK 349s **** Test for '^\+(/usr)?/lib/\.bCHANGED-IN-FILTER_$' 349s +/usr/lib/.bCHANGED-IN-FILTER_ 349s OK 349s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 349s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 349s OK 349s **** Test for '^To update the expected output, run \(as root\)$' 349s To update the expected output, run (as root) 349s OK 349s **** Test for '^# cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log\.expected$' 349s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 349s OK 349s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 349s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 349s OK 349s ** PASS: Testing: cron-with-diff-mode-05-full-filter-and-ignore (chkrootkit-daily) done: PASS 349s * Testing: chkrootkit-daily (diff mode, quiet output, no MAILTO) 349s ** Testing: cron-with-diff-mode-06-quiet (chkrootkit-daily) ... 349s *** Output 360s No file /var/log/chkrootkit/log.expected 360s This file should contain expected output from chkrootkit 360s 360s Today's run produced the following output: 360s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 360s WARNING: The following suspicious files and directories were found: 360s /usr/lib/... [Not from a Debian package] 360s /usr/lib/.aaa [Not from a Debian package] 360s /usr/lib/.1 [Not from a Debian package] 360s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 360s /usr/lib/.bbb [Not from a Debian package] 360s /usr/lib/.1DIR [Not from a Debian package] 360s /usr/lib/.DIR-aaa [Not from a Debian package] 360s /usr/lib/...DIR [Not from a Debian package] 360s 360s WARNING: Possible Linux.Xor.DDoS installed: 360s /tmp/clean/ps [Not from a Debian package] 360s /tmp/clean/head [Not from a Debian package] 360s /tmp/clean/cut [Not from a Debian package] 360s /tmp/clean/ls [Not from a Debian package] 360s /tmp/clean/echo [Not from a Debian package] 360s /tmp/clean/awk [Not from a Debian package] 360s /tmp/clean/dpkg-query [Not from a Debian package] 360s /tmp/clean/sed [Not from a Debian package] 360s /tmp/clean/strings [Not from a Debian package] 360s /tmp/clean/netstat [Not from a Debian package] 360s /tmp/clean/uname [Not from a Debian package] 360s /tmp/clean/id [Not from a Debian package] 360s /tmp/clean/grep [Not from a Debian package] 360s /tmp/clean/find [Not from a Debian package] 360s /tmp/clean/dirname [Not from a Debian package] 360s /tmp/clean/xargs [Not from a Debian package] 360s /tmp/clean/ss [Not from a Debian package] 360s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 360s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 360s 360s WARNING: Output from ifpromisc: 360s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 360s 360s --- [ END: cat /var/log/chkrootkit/log.today ] --- 360s 360s To create this file containing all output from today's run, do (as root) 360s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 360s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 360s **** Files in log 360s total 44K 360s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 360s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 360s -rw-r--r-- 1 root root 11K Nov 26 20:45 chkrootkit-daily.log 360s -rw-r--r-- 1 root root 11K Nov 26 20:45 log.today 360s -rw-r--r-- 1 root root 11K Nov 26 20:45 log.today.raw 360s *** Test of content of output follows... 360s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 360s No file /var/log/chkrootkit/log.expected 360s OK 360s **** Test for '^This file should contain expected output from chkrootkit$' 360s This file should contain expected output from chkrootkit 360s OK 360s **** Test for '^$' 360s 360s 360s 360s 360s 360s OK 360s **** Test for '^Today's run produced the following output:$' 360s Today's run produced the following output: 360s OK 360s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 360s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 360s OK 360s **** Test for '^WARNING: The following suspicious files and directories were found:$' 360s WARNING: The following suspicious files and directories were found: 360s OK 360s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 360s /usr/lib/.1 [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 360s /usr/lib/.aaa [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 360s /usr/lib/.1DIR [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 360s /usr/lib/...DIR [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 360s /usr/lib/.bbb [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 360s /usr/lib/.DIR-aaa [Not from a Debian package] 360s OK 360s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 360s /usr/lib/... [Not from a Debian package] 360s OK 360s **** Test for '^$' 360s 360s 360s 360s 360s 360s OK 360s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 360s WARNING: Possible Linux.Xor.DDoS installed: 360s OK 360s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 360s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 360s OK 360s **** Test for '^/tmp/clean/.+$' 360s /tmp/clean/ps [Not from a Debian package] 360s /tmp/clean/head [Not from a Debian package] 360s /tmp/clean/cut [Not from a Debian package] 360s /tmp/clean/ls [Not from a Debian package] 360s /tmp/clean/echo [Not from a Debian package] 360s /tmp/clean/awk [Not from a Debian package] 360s /tmp/clean/dpkg-query [Not from a Debian package] 360s /tmp/clean/sed [Not from a Debian package] 360s /tmp/clean/strings [Not from a Debian package] 360s /tmp/clean/netstat [Not from a Debian package] 360s /tmp/clean/uname [Not from a Debian package] 360s /tmp/clean/id [Not from a Debian package] 360s /tmp/clean/grep [Not from a Debian package] 360s /tmp/clean/find [Not from a Debian package] 360s /tmp/clean/dirname [Not from a Debian package] 360s /tmp/clean/xargs [Not from a Debian package] 360s /tmp/clean/ss [Not from a Debian package] 360s OK 360s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 360s --- [ END: cat /var/log/chkrootkit/log.today ] --- 360s OK 360s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 360s To create this file containing all output from today's run, do (as root) 360s OK 360s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 360s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 360s OK 360s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 360s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 360s OK 360s ** PASS: Testing: cron-with-diff-mode-06-quiet (chkrootkit-daily) done: PASS 360s *** Unexpected (unmatched) lines follow (for info): 360s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 360s ** Testing: cron-with-diff-mode-07-quiet-rerun (chkrootkit-daily) ... 360s *** Output 371s No file /var/log/chkrootkit/log.expected 371s This file should contain expected output from chkrootkit 371s 371s Today's run produced the following output: 371s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 371s WARNING: The following suspicious files and directories were found: 371s /usr/lib/... [Not from a Debian package] 371s /usr/lib/.aaa [Not from a Debian package] 371s /usr/lib/.1 [Not from a Debian package] 371s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 371s /usr/lib/.bbb [Not from a Debian package] 371s /usr/lib/.1DIR [Not from a Debian package] 371s /usr/lib/.DIR-aaa [Not from a Debian package] 371s /usr/lib/...DIR [Not from a Debian package] 371s 371s WARNING: Possible Linux.Xor.DDoS installed: 371s /tmp/clean/ps [Not from a Debian package] 371s /tmp/clean/head [Not from a Debian package] 371s /tmp/clean/cut [Not from a Debian package] 371s /tmp/clean/ls [Not from a Debian package] 371s /tmp/clean/echo [Not from a Debian package] 371s /tmp/clean/awk [Not from a Debian package] 371s /tmp/clean/dpkg-query [Not from a Debian package] 371s /tmp/clean/sed [Not from a Debian package] 371s /tmp/clean/strings [Not from a Debian package] 371s /tmp/clean/netstat [Not from a Debian package] 371s /tmp/clean/uname [Not from a Debian package] 371s /tmp/clean/id [Not from a Debian package] 371s /tmp/clean/grep [Not from a Debian package] 371s /tmp/clean/find [Not from a Debian package] 371s /tmp/clean/dirname [Not from a Debian package] 371s /tmp/clean/xargs [Not from a Debian package] 371s /tmp/clean/ss [Not from a Debian package] 371s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 371s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 371s 371s WARNING: Output from ifpromisc: 371s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 371s 371s --- [ END: cat /var/log/chkrootkit/log.today ] --- 371s 371s To create this file containing all output from today's run, do (as root) 371s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 371s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 371s **** Files in log 371s total 44K 371s drwxr-xr-x 2 root root 4.0K Nov 26 20:45 . 371s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 371s -rw-r--r-- 1 root root 11K Nov 26 20:46 chkrootkit-daily.log 371s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 371s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 371s *** Test of content of output follows... 371s **** Test for '^No file /var/log/chkrootkit/log\.expected$' 371s No file /var/log/chkrootkit/log.expected 371s OK 371s **** Test for '^This file should contain expected output from chkrootkit$' 371s This file should contain expected output from chkrootkit 371s OK 371s **** Test for '^$' 371s 371s 371s 371s 371s 371s OK 371s **** Test for '^Today's run produced the following output:$' 371s Today's run produced the following output: 371s OK 371s **** Test for '^--- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 371s --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 371s OK 371s **** Test for '^WARNING: The following suspicious files and directories were found:$' 371s WARNING: The following suspicious files and directories were found: 371s OK 371s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 371s /usr/lib/.1 [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 371s /usr/lib/.aaa [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 371s /usr/lib/.1DIR [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 371s /usr/lib/...DIR [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 371s /usr/lib/.bbb [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 371s /usr/lib/.DIR-aaa [Not from a Debian package] 371s OK 371s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 371s /usr/lib/... [Not from a Debian package] 371s OK 371s **** Test for '^$' 371s 371s 371s 371s 371s 371s OK 371s **** Test for '^WARNING: Possible Linux.Xor.DDoS installed:$' 371s WARNING: Possible Linux.Xor.DDoS installed: 371s OK 371s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 371s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 371s OK 371s **** Test for '^/tmp/clean/.+$' 371s /tmp/clean/ps [Not from a Debian package] 371s /tmp/clean/head [Not from a Debian package] 371s /tmp/clean/cut [Not from a Debian package] 371s /tmp/clean/ls [Not from a Debian package] 371s /tmp/clean/echo [Not from a Debian package] 371s /tmp/clean/awk [Not from a Debian package] 371s /tmp/clean/dpkg-query [Not from a Debian package] 371s /tmp/clean/sed [Not from a Debian package] 371s /tmp/clean/strings [Not from a Debian package] 371s /tmp/clean/netstat [Not from a Debian package] 371s /tmp/clean/uname [Not from a Debian package] 371s /tmp/clean/id [Not from a Debian package] 371s /tmp/clean/grep [Not from a Debian package] 371s /tmp/clean/find [Not from a Debian package] 371s /tmp/clean/dirname [Not from a Debian package] 371s /tmp/clean/xargs [Not from a Debian package] 371s /tmp/clean/ss [Not from a Debian package] 371s OK 371s **** Test for '^--- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 371s --- [ END: cat /var/log/chkrootkit/log.today ] --- 371s OK 371s **** Test for '^To create this file containing all output from today's run, do \(as root\)$' 371s To create this file containing all output from today's run, do (as root) 371s OK 371s **** Test for '^# cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 371s # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 371s OK 371s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 371s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 371s OK 371s ** PASS: Testing: cron-with-diff-mode-07-quiet-rerun (chkrootkit-daily) done: PASS 371s *** Unexpected (unmatched) lines follow (for info): 371s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 371s ** Testing: cron-with-diff-mode-08-quiet-after-update (chkrootkit-daily) ... 371s *** Output 381s **** Files in log 381s total 44K 381s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 381s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 381s -rw-r--r-- 1 root root 0 Nov 26 20:46 chkrootkit-daily.log 381s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 381s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 381s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 381s *** Test of content of output follows... 381s **** Expected is empty, so output should be empty 381s Output is indeed empty: PASS 381s ** PASS: Testing: cron-with-diff-mode-08-quiet-after-update (chkrootkit-daily) done: PASS 381s ** Testing: cron-with-diff-mode-09-quiet-filter-and-ignore (chkrootkit-daily) ... 381s *** Output 393s chkrootkit output was not as expected. 393s 393s The difference is: 393s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 393s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:07.117959421 +0000 393s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:28.587957478 +0000 393s @@ -1,11 +1,9 @@ 393s WARNING: The following suspicious files and directories were found: 393s /usr/lib/... [Not from a Debian package] 393s -/usr/lib/.aaa [Not from a Debian package] 393s /usr/lib/.1 [Not from a Debian package] 393s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 393s -/usr/lib/.bbb [Not from a Debian package] 393s +/usr/lib/.bCHANGED-IN-FILTER_ 393s /usr/lib/.1DIR [Not from a Debian package] 393s -/usr/lib/.DIR-aaa [Not from a Debian package] 393s /usr/lib/...DIR [Not from a Debian package] 393s 393s WARNING: Possible Linux.Xor.DDoS installed: 393s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 393s 393s To update the expected output, run (as root) 393s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 393s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 393s **** Files in log 393s total 48K 393s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 393s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 393s -rw-r--r-- 1 root root 1.2K Nov 26 20:46 chkrootkit-daily.log 393s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 393s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 393s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 393s *** Test of content of output follows... 393s **** Test for '^chkrootkit output was not as expected\.$' 393s chkrootkit output was not as expected. 393s OK 393s **** Test for '^$' 393s 393s 393s OK 393s **** Test for '^The difference is:$' 393s The difference is: 393s OK 393s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---' 393s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 393s OK 393s **** Test for '^--- /var/log/chkrootkit/log\.expected' 393s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:07.117959421 +0000 393s OK 393s **** Test for '^\++ /var/log/chkrootkit/log\.today' 393s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:28.587957478 +0000 393s OK 393s **** Test for '^@@[0-9, +-]+' 393s @@ -1,11 +1,9 @@ 393s OK 393s **** Test for '^[[:space:]]' 393s WARNING: The following suspicious files and directories were found: 393s /usr/lib/... [Not from a Debian package] 393s /usr/lib/.1 [Not from a Debian package] 393s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 393s /usr/lib/.1DIR [Not from a Debian package] 393s /usr/lib/...DIR [Not from a Debian package] 393s 393s WARNING: Possible Linux.Xor.DDoS installed: 393s OK 393s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 393s -/usr/lib/.aaa [Not from a Debian package] 393s OK 393s **** Test for '^-(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 393s -/usr/lib/.bbb [Not from a Debian package] 393s OK 393s **** Test for '^-(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 393s -/usr/lib/.DIR-aaa [Not from a Debian package] 393s OK 393s **** Test for '^\+(/usr)?/lib/\.bCHANGED-IN-FILTER_$' 393s +/usr/lib/.bCHANGED-IN-FILTER_ 393s OK 393s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 393s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 393s OK 393s **** Test for '^$' 393s 393s 393s OK 393s **** Test for '^To update the expected output, run \(as root\)$' 393s To update the expected output, run (as root) 393s OK 393s **** Test for '^# cp -a -f /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 393s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 393s OK 393s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 393s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 393s OK 393s ** PASS: Testing: cron-with-diff-mode-09-quiet-filter-and-ignore (chkrootkit-daily) done: PASS 393s ** Testing: cron-with-diff-mode-10-quiet-invalid-filter-is-ignored (chkrootkit-daily) ... 393s *** Output 393s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode' 403s chkrootkit output was not as expected. 403s 403s The difference is: 403s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 403s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:07.117959421 +0000 403s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:39.287957798 +0000 403s @@ -1,11 +1,9 @@ 403s WARNING: The following suspicious files and directories were found: 403s /usr/lib/... [Not from a Debian package] 403s -/usr/lib/.aaa [Not from a Debian package] 403s /usr/lib/.1 [Not from a Debian package] 403s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 403s /usr/lib/.bbb [Not from a Debian package] 403s /usr/lib/.1DIR [Not from a Debian package] 403s -/usr/lib/.DIR-aaa [Not from a Debian package] 403s /usr/lib/...DIR [Not from a Debian package] 403s 403s WARNING: Possible Linux.Xor.DDoS installed: 403s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 403s 403s To update the expected output, run (as root) 403s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 403s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 403s **** Files in log 403s total 48K 403s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 403s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 403s -rw-r--r-- 1 root root 1.1K Nov 26 20:46 chkrootkit-daily.log 403s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.expected 403s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 403s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 403s *** Test of content of output follows... 403s **** Test for '^Ignoring invalid \$FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode'$' 403s Ignoring invalid $FILTER='sed s/this/is/invalid/sed/and/will/be/ignored/with/diff/mode' 403s OK 403s **** Test for '^chkrootkit output was not as expected\.$' 403s chkrootkit output was not as expected. 403s OK 403s **** Test for '^$' 403s 403s 403s OK 403s **** Test for '^The difference is:$' 403s The difference is: 403s OK 403s **** Test for '^--- \[ BEGIN: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 403s --- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 403s OK 403s **** Test for '^--- /var/log/chkrootkit/log\.expected' 403s --- /var/log/chkrootkit/log.expected 2024-11-26 20:46:07.117959421 +0000 403s OK 403s **** Test for '^\++ /var/log/chkrootkit/log\.today' 403s +++ /var/log/chkrootkit/log.today 2024-11-26 20:46:39.287957798 +0000 403s OK 403s **** Test for '^@@[@0-9, +-]+' 403s @@ -1,11 +1,9 @@ 403s OK 403s **** Test for '^[[:space:]]' 403s WARNING: The following suspicious files and directories were found: 403s /usr/lib/... [Not from a Debian package] 403s /usr/lib/.1 [Not from a Debian package] 403s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 403s /usr/lib/.bbb [Not from a Debian package] 403s /usr/lib/.1DIR [Not from a Debian package] 403s /usr/lib/...DIR [Not from a Debian package] 403s 403s WARNING: Possible Linux.Xor.DDoS installed: 403s OK 403s **** Test for '^-(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 403s -/usr/lib/.aaa [Not from a Debian package] 403s OK 403s **** Test for '^-(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 403s -/usr/lib/.DIR-aaa [Not from a Debian package] 403s OK 403s **** Test for '^--- \[ END: diff -u /var/log/chkrootkit/log\.expected /var/log/chkrootkit/log\.today \] ---$' 403s --- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] --- 403s OK 403s **** Test for '^$' 403s 403s 403s OK 403s **** Test for '^To update the expected output, run \(as root\)$' 403s To update the expected output, run (as root) 403s OK 403s **** Test for '^# cp -a -f /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 403s # cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 403s OK 403s **** Test for '^# \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 403s # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 403s OK 403s ** PASS: Testing: cron-with-diff-mode-10-quiet-invalid-filter-is-ignored (chkrootkit-daily) done: PASS 403s * test MAILTO 403s ** Mocking out 'mail' command: /usr/sbin/mail 403s -rwxr-xr-x 1 root root 69 Nov 26 20:43 /usr/sbin/mail 403s /usr/sbin/mail: 403s #!/bin/sh 403s echo "mail called with $# args:" 403s for x in "$@"; do 403s echo "<$x>" 403s done 403s while read -r line; do 403s echo "> $line" 403s done 403s exit 0 403s mail called with 4 args: 403s 403s <1> 403s <2> 403s <3> 403s > stdin 403s ** Testing: chkrootkit-daily-mail-01 (chkrootkit-daily) ... 403s *** Output 414s mail called with 3 args: 414s <-s> 414s <[chkrootkit] alert for autopkgtest.local> 414s 414s > No file /var/log/chkrootkit/log.expected 414s > This file should contain expected output from chkrootkit 414s > 414s > Today's run produced the following output: 414s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 414s > WARNING: The following suspicious files and directories were found: 414s > /usr/lib/... [Not from a Debian package] 414s > /usr/lib/.aaa [Not from a Debian package] 414s > /usr/lib/.1 [Not from a Debian package] 414s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 414s > /usr/lib/.bbb [Not from a Debian package] 414s > /usr/lib/.1DIR [Not from a Debian package] 414s > /usr/lib/.DIR-aaa [Not from a Debian package] 414s > /usr/lib/...DIR [Not from a Debian package] 414s > 414s > WARNING: Possible Linux.Xor.DDoS installed: 414s > /tmp/clean/ps [Not from a Debian package] 414s > /tmp/clean/head [Not from a Debian package] 414s > /tmp/clean/cut [Not from a Debian package] 414s > /tmp/clean/ls [Not from a Debian package] 414s > /tmp/clean/echo [Not from a Debian package] 414s > /tmp/clean/awk [Not from a Debian package] 414s > /tmp/clean/dpkg-query [Not from a Debian package] 414s > /tmp/clean/sed [Not from a Debian package] 414s > /tmp/clean/strings [Not from a Debian package] 414s > /tmp/clean/netstat [Not from a Debian package] 414s > /tmp/clean/uname [Not from a Debian package] 414s > /tmp/clean/id [Not from a Debian package] 414s > /tmp/clean/grep [Not from a Debian package] 414s > /tmp/clean/find [Not from a Debian package] 414s > /tmp/clean/dirname [Not from a Debian package] 414s > /tmp/clean/xargs [Not from a Debian package] 414s > /tmp/clean/ss [Not from a Debian package] 414s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 414s > /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 414s > 414s > WARNING: Output from ifpromisc: 414s > enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 414s > 414s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 414s > 414s > To create this file containing all output from today's run, do (as root) 414s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 414s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 414s **** Files in log 414s total 44K 414s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 414s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 414s -rw-r--r-- 1 root root 11K Nov 26 20:46 chkrootkit-daily.log 414s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today 414s -rw-r--r-- 1 root root 11K Nov 26 20:46 log.today.raw 414s *** Test of content of output follows... 414s **** Test for '^mail called with 3 args:$' 414s mail called with 3 args: 414s OK 414s **** Test for '^<-s>$' 414s <-s> 414s OK 414s **** Test for '^<\[chkrootkit\] alert for' 414s <[chkrootkit] alert for autopkgtest.local> 414s OK 414s **** Test for '^$' 414s 414s OK 414s **** Test for '^> No file /var/log/chkrootkit/log\.expected$' 414s > No file /var/log/chkrootkit/log.expected 414s OK 414s **** Test for '^> This file should contain expected output from chkrootkit$' 414s > This file should contain expected output from chkrootkit 414s OK 414s **** Test for '^> $' 414s > 414s > 414s > 414s > 414s > 414s OK 414s **** Test for '^> Today's run produced the following output:$' 414s > Today's run produced the following output: 414s OK 414s **** Test for '^> --- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 414s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 414s OK 414s **** Test for '^> WARNING: The following suspicious files and directories were found:$' 414s > WARNING: The following suspicious files and directories were found: 414s OK 414s **** Test for '^> (/usr)?/lib/\.1 \[Not from a Debian package\]$' 414s > /usr/lib/.1 [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.aaa \[Not from a Debian package\]$' 414s > /usr/lib/.aaa [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 414s > /usr/lib/.1DIR [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 414s > /usr/lib/...DIR [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.bbb \[Not from a Debian package\]$' 414s > /usr/lib/.bbb [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 414s > /usr/lib/.DIR-aaa [Not from a Debian package] 414s OK 414s **** Test for '^> (/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 414s > /usr/lib/... [Not from a Debian package] 414s OK 414s **** Test for '^> $' 414s > 414s > 414s > 414s > 414s > 414s OK 414s **** Test for '^> WARNING: Possible Linux\.Xor\.DDoS installed:$' 414s > WARNING: Possible Linux.Xor.DDoS installed: 414s OK 414s **** Test for '^> /tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 414s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 414s OK 414s **** Test for '^> /tmp/clean/.+$' 414s > /tmp/clean/ps [Not from a Debian package] 414s > /tmp/clean/head [Not from a Debian package] 414s > /tmp/clean/cut [Not from a Debian package] 414s > /tmp/clean/ls [Not from a Debian package] 414s > /tmp/clean/echo [Not from a Debian package] 414s > /tmp/clean/awk [Not from a Debian package] 414s > /tmp/clean/dpkg-query [Not from a Debian package] 414s > /tmp/clean/sed [Not from a Debian package] 414s > /tmp/clean/strings [Not from a Debian package] 414s > /tmp/clean/netstat [Not from a Debian package] 414s > /tmp/clean/uname [Not from a Debian package] 414s > /tmp/clean/id [Not from a Debian package] 414s > /tmp/clean/grep [Not from a Debian package] 414s > /tmp/clean/find [Not from a Debian package] 414s > /tmp/clean/dirname [Not from a Debian package] 414s > /tmp/clean/xargs [Not from a Debian package] 414s > /tmp/clean/ss [Not from a Debian package] 414s OK 414s **** Test for '^> --- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 414s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 414s OK 414s **** Test for '^> To create this file containing all output from today's run, do \(as root\)$' 414s > To create this file containing all output from today's run, do (as root) 414s OK 414s **** Test for '^> # cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 414s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 414s OK 414s **** Test for '^> # \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 414s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 414s OK 414s ** PASS: Testing: chkrootkit-daily-mail-01 (chkrootkit-daily) done: PASS 414s *** Unexpected (unmatched) lines follow (for info): 414s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 414s ** Testing: chkrootkit-daily-mail-02-rerun (chkrootkit-daily) ... 414s *** Output 424s mail called with 3 args: 424s <-s> 424s <[chkrootkit] alert for autopkgtest.local> 424s 424s > No file /var/log/chkrootkit/log.expected 424s > This file should contain expected output from chkrootkit 424s > 424s > Today's run produced the following output: 424s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 424s > WARNING: The following suspicious files and directories were found: 424s > /usr/lib/... [Not from a Debian package] 424s > /usr/lib/.aaa [Not from a Debian package] 424s > /usr/lib/.1 [Not from a Debian package] 424s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 424s > /usr/lib/.bbb [Not from a Debian package] 424s > /usr/lib/.1DIR [Not from a Debian package] 424s > /usr/lib/.DIR-aaa [Not from a Debian package] 424s > /usr/lib/...DIR [Not from a Debian package] 424s > 424s > WARNING: Possible Linux.Xor.DDoS installed: 424s > /tmp/clean/ps [Not from a Debian package] 424s > /tmp/clean/head [Not from a Debian package] 424s > /tmp/clean/cut [Not from a Debian package] 424s > /tmp/clean/ls [Not from a Debian package] 424s > /tmp/clean/echo [Not from a Debian package] 424s > /tmp/clean/awk [Not from a Debian package] 424s > /tmp/clean/dpkg-query [Not from a Debian package] 424s > /tmp/clean/sed [Not from a Debian package] 424s > /tmp/clean/strings [Not from a Debian package] 424s > /tmp/clean/netstat [Not from a Debian package] 424s > /tmp/clean/uname [Not from a Debian package] 424s > /tmp/clean/id [Not from a Debian package] 424s > /tmp/clean/grep [Not from a Debian package] 424s > /tmp/clean/find [Not from a Debian package] 424s > /tmp/clean/dirname [Not from a Debian package] 424s > /tmp/clean/xargs [Not from a Debian package] 424s > /tmp/clean/ss [Not from a Debian package] 424s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 424s > /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 424s > 424s > WARNING: Output from ifpromisc: 424s > enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 424s > 424s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 424s > 424s > To create this file containing all output from today's run, do (as root) 424s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 424s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 424s **** Files in log 424s total 44K 424s drwxr-xr-x 2 root root 4.0K Nov 26 20:46 . 424s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 424s -rw-r--r-- 1 root root 11K Nov 26 20:47 chkrootkit-daily.log 424s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 424s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 424s *** Test of content of output follows... 424s **** Test for '^mail called with 3 args:$' 424s mail called with 3 args: 424s OK 424s **** Test for '^<-s>$' 424s <-s> 424s OK 424s **** Test for '^<\[chkrootkit\] alert for' 424s <[chkrootkit] alert for autopkgtest.local> 424s OK 424s **** Test for '^$' 424s 424s OK 424s **** Test for '^> No file /var/log/chkrootkit/log\.expected$' 424s > No file /var/log/chkrootkit/log.expected 424s OK 424s **** Test for '^> This file should contain expected output from chkrootkit$' 424s > This file should contain expected output from chkrootkit 424s OK 424s **** Test for '^> $' 424s > 424s > 424s > 424s > 424s > 424s OK 424s **** Test for '^> Today's run produced the following output:$' 424s > Today's run produced the following output: 424s OK 424s **** Test for '^> --- \[ BEGIN: cat /var/log/chkrootkit/log\.today \] ---$' 424s > --- [ BEGIN: cat /var/log/chkrootkit/log.today ] --- 424s OK 424s **** Test for '^> WARNING: The following suspicious files and directories were found:$' 424s > WARNING: The following suspicious files and directories were found: 424s OK 424s **** Test for '^> (/usr)?/lib/\.1 \[Not from a Debian package\]$' 424s > /usr/lib/.1 [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.aaa \[Not from a Debian package\]$' 424s > /usr/lib/.aaa [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 424s > /usr/lib/.1DIR [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 424s > /usr/lib/...DIR [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.bbb \[Not from a Debian package\]$' 424s > /usr/lib/.bbb [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 424s > /usr/lib/.DIR-aaa [Not from a Debian package] 424s OK 424s **** Test for '^> (/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 424s > /usr/lib/... [Not from a Debian package] 424s OK 424s **** Test for '^> $' 424s > 424s > 424s > 424s > 424s > 424s OK 424s **** Test for '^> WARNING: Possible Linux\.Xor\.DDoS installed:$' 424s > WARNING: Possible Linux.Xor.DDoS installed: 424s OK 424s **** Test for '^> /tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 424s > /tmp/test-chkrootkit-false-positive [Not from a Debian package] 424s OK 424s **** Test for '^> /tmp/clean/.+$' 424s > /tmp/clean/ps [Not from a Debian package] 424s > /tmp/clean/head [Not from a Debian package] 424s > /tmp/clean/cut [Not from a Debian package] 424s > /tmp/clean/ls [Not from a Debian package] 424s > /tmp/clean/echo [Not from a Debian package] 424s > /tmp/clean/awk [Not from a Debian package] 424s > /tmp/clean/dpkg-query [Not from a Debian package] 424s > /tmp/clean/sed [Not from a Debian package] 424s > /tmp/clean/strings [Not from a Debian package] 424s > /tmp/clean/netstat [Not from a Debian package] 424s > /tmp/clean/uname [Not from a Debian package] 424s > /tmp/clean/id [Not from a Debian package] 424s > /tmp/clean/grep [Not from a Debian package] 424s > /tmp/clean/find [Not from a Debian package] 424s > /tmp/clean/dirname [Not from a Debian package] 424s > /tmp/clean/xargs [Not from a Debian package] 424s > /tmp/clean/ss [Not from a Debian package] 424s OK 424s **** Test for '^> --- \[ END: cat /var/log/chkrootkit/log\.today \] ---$' 424s > --- [ END: cat /var/log/chkrootkit/log.today ] --- 424s OK 424s **** Test for '^> To create this file containing all output from today's run, do \(as root\)$' 424s > To create this file containing all output from today's run, do (as root) 424s OK 424s **** Test for '^> # cp -a /var/log/chkrootkit/log\.today /var/log/chkrootkit/log\.expected$' 424s > # cp -a /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected 424s OK 424s **** Test for '^> # \(note that unedited output is in /var/log/chkrootkit/log\.today\.raw\)$' 424s > # (note that unedited output is in /var/log/chkrootkit/log.today.raw) 424s OK 424s ** PASS: Testing: chkrootkit-daily-mail-02-rerun (chkrootkit-daily) done: PASS 424s *** Unexpected (unmatched) lines follow (for info): 424s > /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 424s ** Testing: chkrootkit-daily-mail-03-no-diff-means-no-mail (chkrootkit-daily) ... 424s *** Output 435s **** Files in log 435s total 44K 435s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 435s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 435s -rw-r--r-- 1 root root 0 Nov 26 20:47 chkrootkit-daily.log 435s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.expected 435s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 435s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 435s *** Test of content of output follows... 435s **** Expected is empty, so output should be empty 435s Output is indeed empty: PASS 435s ** PASS: Testing: chkrootkit-daily-mail-03-no-diff-means-no-mail (chkrootkit-daily) done: PASS 435s * Test chkrootkit tests report infected files 435s ** setting up false positive 'fake rootkits' for every test 435s Ensuring amd shows as INFECTED 435s mv /usr/sbin/amd /usr/sbin/amd.to_replace 435s /usr/sbin/amd 435s Ensuring basename shows as INFECTED 435s mv /usr/bin/basename /usr/bin/basename.to_replace 435s /usr/bin/basename 435s Ensuring biff shows as INFECTED 435s mv /usr/sbin/biff /usr/sbin/biff.to_replace 435s /usr/sbin/biff 435s Ensuring chfn shows as INFECTED 435s mv /usr/bin/chfn /usr/bin/chfn.to_replace 435s /usr/bin/chfn 435s Ensuring chsh shows as INFECTED 435s mv /usr/bin/chsh /usr/bin/chsh.to_replace 435s /usr/bin/chsh 435s Ensuring cron shows as INFECTED 435s mv /usr/sbin/cron /usr/sbin/cron.to_replace 435s /usr/sbin/cron 435s Ensuring date shows as INFECTED 435s mv /usr/bin/date /usr/bin/date.to_replace 435s /usr/bin/date 435s Ensuring du shows as INFECTED 435s mv /usr/bin/du /usr/bin/du.to_replace 435s /usr/bin/du 435s Ensuring dirname shows as INFECTED 435s mv /usr/bin/dirname /usr/bin/dirname.to_replace 435s /usr/bin/dirname 435s Ensuring echo shows as INFECTED 435s mv /usr/bin/echo /usr/bin/echo.to_replace 435s /usr/bin/echo 435s Ensuring egrep shows as INFECTED 435s mv /usr/bin/egrep /usr/bin/egrep.to_replace 435s /usr/bin/egrep 435s Ensuring env shows as INFECTED 435s mv /usr/bin/env /usr/bin/env.to_replace 435s /usr/bin/env 435s Ensuring find shows as INFECTED 435s mv /usr/bin/find /usr/bin/find.to_replace 435s /usr/bin/find 435s Ensuring fingerd shows as INFECTED 435s mv /usr/sbin/fingerd /usr/sbin/fingerd.to_replace 435s /usr/sbin/fingerd 435s Ensuring gpm shows as INFECTED 435s mv /usr/sbin/gpm /usr/sbin/gpm.to_replace 435s /usr/sbin/gpm 435s Ensuring grep shows as INFECTED 435s mv /usr/bin/grep /usr/bin/grep.to_replace 435s /usr/bin/grep 435s Ensuring hdparm shows as INFECTED 435s mv /usr/sbin/hdparm /usr/sbin/hdparm.to_replace 435s /usr/sbin/hdparm 435s Ensuring su shows as INFECTED 435s mv /usr/bin/su /usr/bin/su.to_replace 435s /usr/bin/su 435s Ensuring ifconfig shows as INFECTED 435s mv /usr/sbin/ifconfig /usr/sbin/ifconfig.to_replace 435s /usr/sbin/ifconfig 435s Ensuring inetd shows as INFECTED 435s mv /usr/sbin/inetd /usr/sbin/inetd.to_replace 435s /usr/sbin/inetd 435s Ensuring in.identd shows as INFECTED 435s mv /usr/sbin/in.identd /usr/sbin/in.identd.to_replace 435s /usr/sbin/in.identd 435s Ensuring init shows as INFECTED 435s mv /usr/sbin/init /usr/sbin/init.to_replace 435s /usr/lib/systemd/systemd 435s Ensuring killall shows as INFECTED 435s mv /usr/bin/killall /usr/bin/killall.to_replace 435s /usr/bin/killall 435s Ensuring login shows as INFECTED 435s mv /usr/bin/login /usr/bin/login.to_replace 435s /usr/bin/login 435s Ensuring ls shows as INFECTED 435s mv /usr/bin/ls /usr/bin/ls.to_replace 435s /usr/bin/ls 435s Ensuring lsof shows as INFECTED 435s mv /usr/bin/lsof /usr/bin/lsof.to_replace 435s /usr/bin/lsof 435s Ensuring mail shows as INFECTED 435s mv /usr/sbin/mail /usr/sbin/mail.to_replace 435s /usr/sbin/mail 435s Ensuring mingetty shows as INFECTED 435s mv /usr/sbin/mingetty /usr/sbin/mingetty.to_replace 435s /usr/sbin/mingetty 435s Ensuring netstat shows as INFECTED 435s mv /usr/bin/netstat /usr/bin/netstat.to_replace 435s /usr/bin/netstat 435s Ensuring named shows as INFECTED 435s mv /usr/sbin/named /usr/sbin/named.to_replace 435s /usr/sbin/named 435s Ensuring passwd shows as INFECTED 435s mv /usr/bin/passwd /usr/bin/passwd.to_replace 435s /usr/bin/passwd 435s Ensuring pidof shows as INFECTED 435s mv /usr/bin/pidof /usr/bin/pidof.to_replace 435s /usr/sbin/killall5 435s Ensuring in.pop2d shows as INFECTED 435s mv /usr/sbin/in.pop2d /usr/sbin/in.pop2d.to_replace 435s /usr/sbin/in.pop2d 435s Ensuring in.pop3d shows as INFECTED 435s mv /usr/sbin/in.pop3d /usr/sbin/in.pop3d.to_replace 435s /usr/sbin/in.pop3d 435s Ensuring ps shows as INFECTED 435s mv /usr/bin/ps /usr/bin/ps.to_replace 435s /usr/bin/ps 435s Ensuring pstree shows as INFECTED 435s mv /usr/bin/pstree /usr/bin/pstree.to_replace 435s /usr/bin/pstree 435s Ensuring rpcinfo shows as INFECTED 435s mv /usr/sbin/rpcinfo /usr/sbin/rpcinfo.to_replace 435s /usr/sbin/rpcinfo 435s Ensuring in.rlogind shows as INFECTED 435s making new: /usr/sbin/in.rlogind 435s /usr/sbin/in.rlogind 435s Ensuring slogin shows as INFECTED 435s mv /usr/bin/slogin /usr/bin/slogin.to_replace 435s /usr/bin/ssh 435s Ensuring sendmail shows as INFECTED 435s mv /usr/sbin/sendmail /usr/sbin/sendmail.to_replace 435s /usr/sbin/sendmail 435s Ensuring sshd shows as INFECTED 435s mv /usr/sbin/sshd /usr/sbin/sshd.to_replace 435s /usr/sbin/sshd 435s Ensuring syslogd shows as INFECTED 435s mv /usr/sbin/syslogd /usr/sbin/syslogd.to_replace 435s /usr/sbin/syslogd 435s Ensuring tar shows as INFECTED 435s mv /usr/bin/tar /usr/bin/tar.to_replace 435s /usr/bin/tar 435s Ensuring tcpd shows as INFECTED 435s mv /usr/sbin/tcpd /usr/sbin/tcpd.to_replace 435s /usr/sbin/tcpd 435s Ensuring top shows as INFECTED 435s mv /usr/bin/top /usr/bin/top.to_replace 435s /usr/bin/top 435s Ensuring telnetd shows as INFECTED 435s mv /usr/sbin/telnetd /usr/sbin/telnetd.to_replace 435s /usr/sbin/telnetd 435s Ensuring timed shows as INFECTED 435s mv /usr/sbin/timed /usr/sbin/timed.to_replace 435s /usr/sbin/timed 435s Ensuring traceroute shows as INFECTED 435s mv /usr/sbin/traceroute /usr/sbin/traceroute.to_replace 435s /usr/sbin/traceroute 435s Ensuring vdir shows as INFECTED 435s mv /usr/bin/vdir /usr/bin/vdir.to_replace 435s /usr/bin/vdir 435s Ensuring w shows as INFECTED 435s mv /usr/bin/w /usr/bin/w.to_replace 435s /usr/bin/w 435s Ensuring write shows as INFECTED 435s mv /usr/bin/write /usr/bin/write.to_replace 435s /usr/bin/write 435s Ensuring asp shows as INFECTED 435s making new: /usr/sbin/asp 435s /usr/sbin/asp 435s Ensuring crontab shows as INFECTED 435s mv /usr/bin/crontab /usr/bin/crontab.to_replace 435s /usr/bin/crontab 435s Ensuring epic shows as INFECTED 435s making new: /usr/sbin/epic 435s /usr/sbin/epic 435s for chk_crontab: mocking: crontab at /usr/bin/crontab 435s modifying tar so chk-tar finds an issue 435s -rwsr-sr-x 1 root root 249 Nov 26 20:47 /usr/bin/tar 435s To delete: /usr/sbin/in.rlogind /usr/sbin/asp /usr/sbin/epic 435s To replace (with .pre-rootkit): /usr/sbin/amd /usr/bin/basename /usr/sbin/biff /usr/bin/chfn /usr/bin/chsh /usr/sbin/cron /usr/bin/date /usr/bin/du /usr/bin/dirname /usr/bin/echo /usr/bin/egrep /usr/bin/env /usr/bin/find /usr/sbin/fingerd /usr/sbin/gpm /usr/bin/grep /usr/sbin/hdparm /usr/bin/su /usr/sbin/ifconfig /usr/sbin/inetd /usr/sbin/in.identd /usr/lib/systemd/systemd /usr/bin/killall /usr/bin/login /usr/bin/ls /usr/bin/lsof /usr/sbin/mail /usr/sbin/mingetty /usr/bin/netstat /usr/sbin/named /usr/bin/passwd /usr/sbin/killall5 /usr/sbin/in.pop2d /usr/sbin/in.pop3d /usr/bin/ps /usr/bin/pstree /usr/sbin/rpcinfo /usr/bin/ssh /usr/sbin/sendmail /usr/sbin/sshd /usr/sbin/syslogd /usr/bin/tar /usr/sbin/tcpd /usr/bin/top /usr/sbin/telnetd /usr/sbin/timed /usr/sbin/traceroute /usr/bin/vdir /usr/bin/w /usr/bin/write /usr/bin/crontab 435s modifying netstat for chk_netstat and bindshell 435s modifying ls so syslogk and kovid are detected 435s modifying grep so a Linux BPF Door is detected 435s mk: /usr/bin/atm in dir: /usr/bin 435s mk: /tmp/tcp.log in dir: /tmp 435s mk: /var/lib/games/.k/foo in dir: /var/lib/games/.k 435s mk: /usr/src/.poop/foo in dir: /usr/src/.poop 435s mk: /dev/.golf/foo in dir: /dev/.golf 435s mk: /dev/tux/foo in dir: /dev/tux 435s mk: /usr/include/. ./foo in dir: /usr/include/. . 435s mk: /usr/lib/tcl5.3/foo in dir: /usr/lib/tcl5.3 435s mk: /etc/ttyhash in dir: /etc 435s mk: /usr/local/lib/libproc.a in dir: /usr/local/lib 435s mk: /bin/mjy in dir: /bin 435s mk: /usr/bin/n3tstat in dir: /usr/bin 435s mk: /bin/lps in dir: /bin 435s mk: /usr/lib/.ark? in dir: /usr/lib 435s mk: /usr/lib/number.cgi in dir: /usr/lib 435s mk: /www/httpd/cgi-bin/last.cgi in dir: /www/httpd/cgi-bin 435s mk: /usr/bin/red.tar in dir: /usr/bin 435s mk: /bin/dy in dir: /bin 435s mk: /dev/chr in dir: /dev 435s mk: /dev/cucl in dir: /dev 435s mk: /usr/include/chk.h in dir: /usr/include 435s mk: /usr/bin/xsf in dir: /usr/bin 435s mk: /usr/lib/locale/uboot in dir: /usr/lib/locale 435s mk: /tmp/xp in dir: /tmp 435s mk: /usr/bin/volc in dir: /usr/bin 435s mk: /usr/include/proc.h in dir: /usr/include 435s mk: /etc/rc.d/init.d/network in dir: /etc/rc.d/init.d 435s mk: /usr/bin/ishit in dir: /usr/bin 435s mk: /usr/sbin/initcheck in dir: /usr/sbin 435s mk: /usr/sbin/mech in dir: /usr/sbin 435s mk: /etc/sysconfig/console/load.zk in dir: /etc/sysconfig/console 435s mk: /etc/ld.so.hash in dir: /etc 435s mk: /bin/imout in dir: /bin 435s mk: /usr/include/icekey.h in dir: /usr/include 435s mk: /sbin/xc in dir: /sbin 435s mk: /sbin/rootedoor in dir: /sbin 435s mk: /etc/.enyelkmOCULTAR.ko/foo in dir: /etc/.enyelkmOCULTAR.ko 435s mk: /var/tmp/vuln.txt in dir: /var/tmp 435s mk: /usr/local/hide/foo in dir: /usr/local/hide 435s mk: /lib/modules/module_init.ko in dir: /lib/modules 435s mk: /tmp/ss0-0 in dir: /tmp 435s mk: /usr/var/mediamgrs.jar in dir: /usr/var 435s mk: /tmp/.ICE-unix/engine.so in dir: /tmp/.ICE-unix 435s mk: /etc/xig in dir: /etc 435s mk: /var/tmp/.1/x in dir: /var/tmp/.1 435s mk: /var/run/.tmp/y in dir: /var/run/.tmp 435s mk: /tmp/suterusu/pwnlnx6 in dir: /tmp/suterusu 435s mk: /usr/share/libc.so.69 in dir: /usr/share 435s mk: /tmp/kdevtmpfsi in dir: /tmp 435s mk: /bin/systemd-daemon in dir: /bin 435s mk: /syslogk in dir: / 435s mk: /root/.whatever.history in dir: /root 435s mk: /root/.whatever.history.hardlink in dir: /root 435s mk: /tmp/name.php in dir: /tmp 435s mk: /bin/.ps in dir: /bin 435s mk: /usr/bin/mailrc in dir: /usr/bin 435s mk: /www/httpd/cgi-bin/bogus.cgi in dir: /www/httpd/cgi-bin 435s mk: /bin/frgy in dir: /bin 435s mk: /dev/cuc in dir: /dev 435s mk: /usr/lib/libpikapp.a in dir: /usr/lib 435s mk: /var/spool/cron/crontabs/foo in dir: /var/spool/cron/crontabs 435s mk: /etc/rc.local in dir: /etc 435s mk: /sbin/ssh in dir: /sbin 435s mk: /dev/bad-file in dir: /dev 435s mk: /etc/passwd in dir: /etc 435s mk: /etc/inetd.conf in dir: /etc 435s mk: /lib/x86_64-linux-gnu/libkeyutils.so.1 in dir: /lib/x86_64-linux-gnu 435s mk: /home/ ./tinyDNS in dir: /home/ . 435s mk: /tmp/by-content in dir: /tmp 435s mk: /bin/in.rexedcs in dir: /bin 435s mk: /tmp/.uua in dir: /tmp 435s mk: /tmp/.bugtraq.c in dir: /tmp 435s mk: /tmp/.../r in dir: /tmp/... 435s mk: /bin/cls in dir: /bin 435s mk: /tmp/sp ace/aaa' exit 1; " in dir: /tmp/sp ace 435s To move back to .pre-rootkit: /etc/rc.local /etc/passwd /etc/inetd.conf 435s To rm: /usr/bin/atm /tmp/tcp.log /var/lib/games/.k/foo /usr/src/.poop/foo /dev/.golf/foo /dev/tux/foo /usr/include/. ./foo /usr/lib/tcl5.3/foo /etc/ttyhash /usr/local/lib/libproc.a /bin/mjy /usr/bin/n3tstat /bin/lps /usr/lib/.ark? /usr/lib/number.cgi /www/httpd/cgi-bin/last.cgi /usr/bin/red.tar /bin/dy /dev/chr /dev/cucl /usr/include/chk.h /usr/bin/xsf /usr/lib/locale/uboot /tmp/xp /usr/bin/volc /usr/include/proc.h /etc/rc.d/init.d/network /usr/bin/ishit /usr/sbin/initcheck /usr/sbin/mech /etc/sysconfig/console/load.zk /etc/ld.so.hash /bin/imout /usr/include/icekey.h /sbin/xc /sbin/rootedoor /etc/.enyelkmOCULTAR.ko/foo /var/tmp/vuln.txt /usr/local/hide/foo /lib/modules/module_init.ko /tmp/ss0-0 /usr/var/mediamgrs.jar /tmp/.ICE-unix/engine.so /etc/xig /var/tmp/.1/x /var/run/.tmp/y /tmp/suterusu/pwnlnx6 /usr/share/libc.so.69 /tmp/kdevtmpfsi /bin/systemd-daemon /syslogk /root/.whatever.history /root/.whatever.history.hardlink /tmp/name.php /bin/.ps /usr/bin/mailrc /www/httpd/cgi-bin/bogus.cgi /bin/frgy /dev/cuc /usr/lib/libpikapp.a /var/spool/cron/crontabs/foo /sbin/ssh /dev/bad-file /lib/x86_64-linux-gnu/libkeyutils.so.1 /home/ ./tinyDNS /tmp/by-content /bin/in.rexedcs /tmp/.uua /tmp/.bugtraq.c /tmp/.../r /bin/cls /tmp/sp ace/aaa' exit 1; " 435s for chk_ldsopreload 435s for chk_rshd 435s susp dev 435s for chk_inetdconf 435s /etc/shells 435s # /etc/shells: valid login shells 435s /bin/sh 435s /usr/bin/sh 435s /bin/bash 435s /usr/bin/bash 435s /bin/rbash 435s /usr/bin/rbash 435s /usr/bin/dash 435s /usr/bin/screen 435s /usr/bin/tmux 435s asp 435s stream tcp nowait /bin/sh 435s asp 435s dont know how to fake some lkms (cant make a file in /proc): not tested: sniffer, z2, chkutmp. OSX_RSPLUG never runs under linux. chk_ldsopreload seems to be broken 435s ** Testing: all-tests-can-find-something-01 (chkrootkit -p /tmp/clean) ... 435s *** Output 435s ROOTDIR is `/' 435s Checking `amd'... INFECTED 435s Checking `basename'... INFECTED 435s Checking `biff'... INFECTED 435s Checking `chfn'... INFECTED 435s Checking `chsh'... INFECTED 435s Checking `cron'... INFECTED 435s Checking `crontab'... WARNING 435s WARNING: crontab for nobody found, possible Lupper.Worm. 435s Checking for Lupper.Worm... INFECTED 435s Checking `date'... INFECTED 435s Checking `du'... INFECTED 435s Checking `dirname'... INFECTED 435s Checking `echo'... INFECTED 435s Checking `egrep'... INFECTED 435s Checking `env'... INFECTED 435s Checking `find'... INFECTED 435s Checking `fingerd'... INFECTED 435s Checking `gpm'... INFECTED 435s Checking `grep'... INFECTED 435s Checking `hdparm'... INFECTED 435s Checking `su'... INFECTED 435s Checking `ifconfig'... INFECTED 435s Checking `inetd'... INFECTED 435s Checking `inetdconf'... INFECTED 435s Checking `identd'... INFECTED 435s Checking `init'... INFECTED 435s Checking `killall'... INFECTED 435s Checking `ldsopreload'... not infected 435s Checking `login'... INFECTED 435s Checking `ls'... INFECTED 435s Checking `lsof'... INFECTED 435s Checking `mail'... INFECTED 435s Checking `mingetty'... INFECTED 435s Checking `netstat'... INFECTED 435s Checking `named'... INFECTED 435s Checking `passwd'... INFECTED 435s Checking `pidof'... INFECTED 435s Checking `pop2'... INFECTED 435s Checking `pop3'... INFECTED 435s Checking `ps'... INFECTED 435s Checking `pstree'... INFECTED 435s Checking `rpcinfo'... INFECTED 436s Checking `rlogind'... INFECTED 436s Checking `rshd'... INFECTED 436s Checking `slogin'... INFECTED 436s Checking `sendmail'... INFECTED 436s Checking `sshd'... INFECTED but disabled 436s Checking `syslogd'... INFECTED 436s Checking `tar'... INFECTED 436s Checking `tcpd'... INFECTED 436s Checking `tcpdump'... INFECTED 436s Checking `top'... INFECTED 436s Checking `telnetd'... INFECTED 436s Checking `timed'... INFECTED 436s Checking `traceroute'... INFECTED 436s Checking `vdir'... INFECTED 436s Checking `w'... INFECTED 436s Checking `write'... INFECTED 436s Checking `aliens'... started 436s Searching for suspicious files in /dev... WARNING 436s 436s WARNING: The following suspicious files were found in /dev: 436s /dev/bad-file 436s 436s Searching for known suspicious directories... WARNING 436s 436s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 436s /var/run/.tmp/ [Not from a Debian package] 436s /var/run/.tmp/y [Not from a Debian package] 436s 436s Searching for known suspicious files... WARNING 436s 436s WARNING: The following known suspicious files were found: 436s /usr/bin/atm [Not from a Debian package] 436s /etc/ld.so.hash [Not from a Debian package] 436s 436s Searching for sniffer's logs... WARNING 436s 436s WARNING: The following potential sniffer's logs were found: 436s /tmp/tcp.log [Not from a Debian package] 436s 436s Searching for HiDrootkit rootkit... WARNING 436s 436s WARNING: Possible HiDrootkit rootkit installed: 436s /var/lib/games/.k/ [Not from a Debian package] 436s 436s Searching for t0rn rootkit... WARNING 436s 436s WARNING: Possible t0rn rootkit installed: 436s /etc/ttyhash [Not from a Debian package] 436s 436s Searching for t0rn v8 (or variation)... WARNING 436s 436s WARNING: Possible t0rn v8 (or variation) rootkit installed: 436s /usr/local/lib/libproc.a [Not from a Debian package] 436s 436s Searching for Lion rootkit... WARNING 436s 436s WARNING: Possible Lion rootkit installed: 436s /bin/mjy [Not from a Debian package] 436s 436s Searching for RSHA rootkit... WARNING 436s 436s WARNING: Possible RSHA rootkit installed: 436s /usr/bin/n3tstat [Not from a Debian package] 436s 436s Searching for RH-Sharpe rootkit... WARNING 436s 436s WARNING: Possible RH-Sharpe rootkit installed: 436s /bin/lps [Not from a Debian package] 436s 436s Searching for Ambient (ark) rootkit... WARNING 436s 436s WARNING: Possible Ambient's rootkit (ark) installed: 436s /usr/lib/.ark? [Not from a Debian package] 436s 436s Searching for suspicious files and dirs... WARNING 436s 436s WARNING: The following suspicious files and directories were found: 436s /usr/lib/... [Not from a Debian package] 436s /usr/lib/.aaa [Not from a Debian package] 436s /usr/lib/.1 [Not from a Debian package] 436s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 436s /usr/lib/.bbb [Not from a Debian package] 436s /usr/lib/.1DIR [Not from a Debian package] 436s /usr/lib/.DIR-aaa [Not from a Debian package] 436s /usr/lib/...DIR [Not from a Debian package] 436s /usr/lib/.ark? [Not from a Debian package] 436s 436s Searching for LPD Worm... WARNING 436s 436s WARNING: Possible LPD worm installed (based on files found) 436s 436s Searching for Ramen Worm rootkit... WARNING 436s 436s WARNING: Possible Ramen Worm rootkit installed: 436s /usr/src/.poop/ [Not from a Debian package] 436s 436s Searching for Maniac rootkit... WARNING 436s 436s WARNING: Possible Maniac rootkit installed: 436s /usr/bin/mailrc [Not from a Debian package] 436s 437s Searching for RK17 rootkit... WARNING 437s 437s WARNING: Possible RK17 rootkit installed: 437s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 437s /usr/lib/number.cgi [Not from a Debian package] 437s 437s Searching for Ducoci rootkit... WARNING 437s 437s WARNING: Possible Ducoci rootkit installed: 437s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 437s 437s Searching for Adore Worm... WARNING 437s 437s WARNING: Possible Adore Worm installed: 437s /usr/bin/red.tar [Not from a Debian package] 437s 437s Searching for ShitC Worm... WARNING 437s 437s WARNING: Possible ShitC Worm installed: 437s /usr/bin/dy [Not from a Debian package] 437s /usr/bin/frgy [Not from a Debian package] 437s 437s Searching for Omega Worm... WARNING 437s 437s WARNING: Possible Omega Worm installed: 437s /dev/chr [Not from a Debian package] 437s 437s Searching for Sadmind/IIS Worm... WARNING 437s 437s WARNING: Possible Sadmin/IIS Worm installed: 437s /dev/cuc [Not from a Debian package] 437s 437s Searching for MonKit... WARNING 437s 437s WARNING: Possible MonKit installed: 437s /usr/lib/libpikapp.a [Not from a Debian package] 437s 437s Searching for Showtee rootkit... WARNING 437s 437s WARNING: Possible Showtee rootkit installed: 437s /usr/include/proc.h [Not from a Debian package] 437s /usr/include/chk.h [Not from a Debian package] 437s 437s Searching for OpticKit... WARNING 437s 437s WARNING: Possible OpticKit installed: 437s /usr/bin/xsf [Not from a Debian package] 437s 437s Searching for T.R.K... WARNING 437s 437s WARNING: Possible T.R.K installed: 437s /usr/bin/xsf [Not from a Debian package] 437s 437s Searching for Mithra rootkit... WARNING 437s 437s WARNING: Possible Mithra installed: 437s /usr/lib/locale/uboot [Not from a Debian package] 437s 437s Searching for OBSD rootkit v1... not tested 437s Searching for LOC rootkit... WARNING 437s 437s WARNING: Possible LOC rootkit installed: 437s /tmp/xp [Not from a Debian package] 437s /usr/sbin/epic [Not from a Debian package] 437s Searching for Romanian rootkit... WARNING 437s 437s WARNING: Possible Romanian rootkit installed: 437s /usr/include/proc.h [Not from a Debian package] 437s 437s Searching for HKRK rootkit... WARNING 437s 437s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 437s 437s Searching for Suckit rootkit... WARNING 437s 437s WARNING: Possible Suckit: 437s /dev/.golf/ 437s 437s Searching for Volc rootkit... WARNING 437s 437s WARNING: Possible Volc rootkit installed: 437s /usr/bin/volc [Not from a Debian package] 437s 437s Searching for Gold2 rootkit... WARNING 437s 437s WARNING: Possible Gold2 rootkit installed: 437s /usr/bin/ishit [Not from a Debian package] 437s 437s Searching for TC2 rootkit... WARNING 437s 437s WARNING: Possible TC2 rootkit installed: 437s /usr/sbin/initcheck [Not from a Debian package] 437s 437s Searching for Anonoying rootkit... WARNING 437s 437s WARNING: Possible Anonoying rootkit installed: 437s /usr/sbin/mech [Not from a Debian package] 437s 437s Searching for ZK rootkit... WARNING 437s 437s WARNING: Possible ZK rootkit installed: 437s /etc/sysconfig/console/load.zk [Not from a Debian package] 437s 437s Searching for ShKit rootkit... WARNING 437s 437s WARNING: Possible ShKit rootkit installed: 437s /etc/ld.so.hash [Not from a Debian package] 437s 437s Searching for AjaKit rootkit... WARNING 437s 437s WARNING: Possible AjaKit rootkit installed: 437s /dev/tux/ [Not from a Debian package] 437s 437s Searching for zaRwT rootkit... WARNING 437s 437s WARNING: Possible zaRwT rootkit installed: 437s /bin/imout [Not from a Debian package] 437s 437s Searching for Madalin rootkit... WARNING 437s 437s WARNING: Possible Madalin rootkit installed: 437s /usr/include/icekey.h [Not from a Debian package] 437s 437s Searching for Fu rootkit... WARNING 437s 437s WARNING: Possible Fu rootkit installed: 437s /sbin/xc [Not from a Debian package] 437s 437s Searching for Kenga3 rootkit... WARNING 437s 437s WARNING: Possible Kenga3 rootkit installed: 437s /usr/include/. ./ [Not from a Debian package] 437s /usr/include/. ./foo [Not from a Debian package] 437s 437s Searching for ESRK rootkit... WARNING 437s 437s WARNING: Possible ESRK rootkit installed: 437s /usr/lib/tcl5.3/ [Not from a Debian package] 437s 438s Searching for rootedoor... WARNING 438s 438s WARNING: Possible rootedoor installed: 438s /usr/sbin/rootedoor [Not from a Debian package] 438s /sbin/rootedoor [Not from a Debian package] 438s /sbin/rootedoor [Not from a Debian package] 438s /usr/sbin/rootedoor [Not from a Debian package] 438s 438s Searching for ENYELKM rootkit... WARNING 438s 438s WARNING: Possible ENYELKM rootkit installed: 438s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 438s 438s Searching for common ssh-scanners... WARNING 438s 438s WARNING: Possible ssh-scanner installed: 438s /var/tmp/vuln.txt [Not from a Debian package] 438s 438s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 438s 438s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 438s 438s Searching for Linux/Ebury 1.6... WARNING 438s 438s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 438s Searching for 64-bit Linux Rootkit... WARNING 438s 438s WARNING: Possible 64-bit Linux Rootkit: 438s /usr/local/hide/ [Not from a Debian package] 438s /usr/local/hide/foo [Not from a Debian package] 438s /etc/rc.local [Not from a Debian package] 438s 438s Searching for 64-bit Linux Rootkit modules... WARNING 438s 438s WARNING: Possible 64-bit rootkit modules installed: 438s /lib/modules/module_init.ko [Not from a Debian package] 438s 438s Searching for Mumblehard... WARNING 438s 438s WARNING: Possible Mumblehard backdoor installed: 438s /var/spool/cron/crontabs/foo [Not from a Debian package] 438s 438s Searching for Backdoor.Linux.Mokes.a... WARNING 438s 438s WARNING: Possible Backdoor.Linux.Mokes.a installed: 438s /tmp/ss0-0 [Not from a Debian package] 438s 438s Searching for Malicious TinyDNS... WARNING 438s 438s WARNING: Possible Malicious TinyDNS installed: 438s /home/ ./ [Not from a Debian package] 438s /home/ ./tinyDNS [Not from a Debian package] 438s 440s Searching for Linux.Xor.DDoS... WARNING 440s 440s WARNING: Possible Linux.Xor.DDoS installed: 440s /tmp/clean/ps [Not from a Debian package] 440s /tmp/clean/head [Not from a Debian package] 440s /tmp/clean/ls.orig [Not from a Debian package] 440s /tmp/clean/cut [Not from a Debian package] 440s /tmp/clean/ls [Not from a Debian package] 440s /tmp/clean/echo [Not from a Debian package] 440s /tmp/clean/awk [Not from a Debian package] 440s /tmp/clean/grep.orig [Not from a Debian package] 440s /tmp/clean/dpkg-query [Not from a Debian package] 440s /tmp/clean/sed [Not from a Debian package] 440s /tmp/clean/strings [Not from a Debian package] 440s /tmp/clean/netstat [Not from a Debian package] 440s /tmp/clean/uname [Not from a Debian package] 440s /tmp/clean/id [Not from a Debian package] 440s /tmp/clean/grep [Not from a Debian package] 440s /tmp/clean/find [Not from a Debian package] 440s /tmp/clean/dirname [Not from a Debian package] 440s /tmp/clean/xargs [Not from a Debian package] 440s /tmp/clean/ss [Not from a Debian package] 440s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 440s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 440s 440s Searching for Linux.Proxy.1.0... WARNING 440s 440s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 440s 440s Searching for CrossRAT... WARNING 440s 440s WARNING: Possible Malicious CrossRAT installed: 440s /usr/var/mediamgrs.jar [Not from a Debian package] 440s 440s Searching for Hidden Cobra... WARNING 440s 440s WARNING: Possible Malicious Hidden Cobra installed: 440s /tmp/.ICE-unix/engine.so [Not from a Debian package] 440s 440s Searching for Rocke Miner rootkit... WARNING 440s 440s WARNING: Possible Rocke Miner rootkit installed: 440s /etc/xig [Not from a Debian package] 440s 440s Searching for PWNLNX4 lkm rootkit... WARNING 440s 440s WARNING: Possible PWNLNX4 lkm rootkit installed: 440s /var/tmp/.1/ [Not from a Debian package] 440s 440s Searching for PWNLNX6 lkm rootkit... WARNING 440s 440s WARNING: Possible PWNLNX6 lkm rootkit installed: 440s /tmp/suterusu/ [Not from a Debian package] 440s 440s Searching for Umbreon lrk... WARNING 440s 440s WARNING: Possible Malicious UMBREON LRK installed: 440s /usr/share/libc.so.69 [Not from a Debian package] 440s 440s Searching for Kinsing.a backdoor rootkit... WARNING 440s 440s WARNING: Possible Kinsing.a backdoor rootkit installed: 440s /tmp/kdevtmpfsi [Not from a Debian package] 440s 440s Searching for RotaJakiro backdoor rootkit... WARNING 440s 440s WARNING: Possible RotaJakiro backdoor rootkit installed: 440s /bin/systemd-daemon [Not from a Debian package] 440s 440s Searching for Syslogk LKM rootkit... WARNING 440s 440s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 440s 440s Searching for Kovid LKM rootkit... WARNING 440s 440s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 440s 440s Searching for Tsunami DDoS Malware rootkit... WARNING 440s 440s WARNING: Possible Tsunami DDoS Malware rootkit installed: 440s /bin/cls [Not from a Debian package] 440s 440s Searching for Linux BPF Door... WARNING 440s 440s WARNING: Possible Linux BPFDoor Malware installed: 440s /proc/xx/stack 440s 440s Searching for suspect PHP files... WARNING 440s 440s WARNING: The following suspicious PHP files were found: 440s /tmp/name.php 440s /tmp/by-content 440s /tmp/sp ace/aaa' exit 1; " 440s 440s Searching for zero-size shell history files in /root... WARNING 440s 440s WARNING: Zero-size history files: 440s /root/.whatever.history [Not from a Debian package] 440s 440s Searching for hardlinked shell history files in /root... WARNING 440s 440s WARNING: shell history files hardlinked to another file: 440s /root/.whatever.history [Not from a Debian package] 440s 440s Checking `aliens'... finished 440s Checking `asp'... WARNING 440s 440s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 440s 440s Checking `bindshell'... WARNING 440s 440s WARNING: Potential bindshell installed: infected ports: 600 31337 440s 440s Checking `lkm'... started 440s Searching for Adore LKM... not tested 440s Searching for sebek LKM (Adore based)... not tested 440s Searching for knark LKM rootkit... not found 448s Searching for for hidden processes with chkproc... not found 448s Searching for for hidden directories using chkdirs... not found 448s Checking `lkm'... finished 448s Checking `rexedcs'... INFECTED: /usr/bin/in.rexedcs 448s Checking `sniffer'... WARNING 448s 448s WARNING: Output from ifpromisc: 448s lo: not promisc and no packet sniffer sockets 448s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 448s 448s Checking `w55808'... WARNING 448s 448s WARNING: Possible 55808 Worm installed 448s 448s Checking `wted'... not found 448s Checking `scalper'... WARNING 448s 448s WARNING: Possible Scalper Worm installed 448s 448s Checking `slapper'... WARNING 448s 448s WARNING: Possible Slapper Worm installed: 448s /tmp/.bugtraq.c [Not from a Debian package] 448s 448s Checking `z2'... not found 448s Checking `chkutmp'... not found 448s Checking `OSX_RSPLUG'... not tested 448s **** Files in log 448s total 44K 448s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 448s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 448s -rw-r--r-- 1 root root 0 Nov 26 20:47 chkrootkit-daily.log 448s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.expected 448s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 448s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 448s *** Test of content of output follows... 448s **** Test for '^ROOTDIR is `/'$' 448s ROOTDIR is `/' 448s OK 448s **** Test for '^Checking `amd'\.\.\. INFECTED$' 448s Checking `amd'... INFECTED 448s OK 448s **** Test for '^Checking `basename'\.\.\. INFECTED$' 448s Checking `basename'... INFECTED 448s OK 448s **** Test for '^Checking `biff'\.\.\. INFECTED$' 448s Checking `biff'... INFECTED 448s OK 448s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 448s Checking `chfn'... INFECTED 448s OK 448s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 448s Checking `chsh'... INFECTED 448s OK 448s **** Test for '^Checking `cron'\.\.\. INFECTED$' 448s Checking `cron'... INFECTED 448s OK 448s **** Test for '^Checking `crontab'\.\.\. WARNING$' 448s Checking `crontab'... WARNING 448s OK 448s **** Test for '^$' 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s 448s OK 448s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 448s WARNING: crontab for nobody found, possible Lupper.Worm. 448s OK 448s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 448s Checking for Lupper.Worm... INFECTED 448s OK 448s **** Test for '^Checking `date'\.\.\. INFECTED$' 448s Checking `date'... INFECTED 448s OK 448s **** Test for '^Checking `du'\.\.\. INFECTED$' 448s Checking `du'... INFECTED 448s OK 448s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 448s Checking `dirname'... INFECTED 448s OK 448s **** Test for '^Checking `echo'\.\.\. INFECTED$' 448s Checking `echo'... INFECTED 448s OK 448s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 448s Checking `egrep'... INFECTED 448s OK 448s **** Test for '^Checking `env'\.\.\. INFECTED$' 448s Checking `env'... INFECTED 448s OK 448s **** Test for '^Checking `find'\.\.\. INFECTED$' 448s Checking `find'... INFECTED 448s OK 448s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 448s Checking `fingerd'... INFECTED 448s OK 448s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 448s Checking `gpm'... INFECTED 448s OK 448s **** Test for '^Checking `grep'\.\.\. INFECTED$' 448s Checking `grep'... INFECTED 448s OK 448s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 448s Checking `hdparm'... INFECTED 448s OK 448s **** Test for '^Checking `su'\.\.\. INFECTED$' 448s Checking `su'... INFECTED 448s OK 448s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 448s Checking `ifconfig'... INFECTED 448s OK 448s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 448s Checking `inetd'... INFECTED 448s OK 448s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 448s Checking `inetdconf'... INFECTED 448s OK 448s **** Test for '^Checking `identd'\.\.\. INFECTED$' 448s Checking `identd'... INFECTED 448s OK 448s **** Test for '^Checking `init'\.\.\. INFECTED$' 448s Checking `init'... INFECTED 448s OK 448s **** Test for '^Checking `killall'\.\.\. INFECTED$' 448s Checking `killall'... INFECTED 448s OK 448s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 448s Checking `ldsopreload'... not infected 448s OK 448s **** Test for '^Checking `login'\.\.\. INFECTED$' 448s Checking `login'... INFECTED 448s OK 448s **** Test for '^Checking `ls'\.\.\. INFECTED$' 448s Checking `ls'... INFECTED 448s OK 448s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 448s Checking `lsof'... INFECTED 448s OK 448s **** Test for '^Checking `mail'\.\.\. INFECTED$' 448s Checking `mail'... INFECTED 448s OK 448s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 448s Checking `mingetty'... INFECTED 448s OK 448s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 448s Checking `netstat'... INFECTED 448s OK 448s **** Test for '^Checking `named'\.\.\. INFECTED$' 448s Checking `named'... INFECTED 448s OK 448s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 448s Checking `passwd'... INFECTED 448s OK 448s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 448s Checking `pidof'... INFECTED 448s OK 448s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 448s Checking `pop2'... INFECTED 448s OK 448s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 448s Checking `pop3'... INFECTED 448s OK 448s **** Test for '^Checking `ps'\.\.\. INFECTED$' 448s Checking `ps'... INFECTED 448s OK 448s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 448s Checking `pstree'... INFECTED 448s OK 448s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 448s Checking `rpcinfo'... INFECTED 448s OK 448s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 448s Checking `rlogind'... INFECTED 448s OK 448s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 448s Checking `rshd'... INFECTED 448s OK 448s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 448s Checking `slogin'... INFECTED 448s OK 448s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 448s Checking `sendmail'... INFECTED 448s OK 448s **** Test for '^Checking `sshd'\.\.\. INFECTED but disabled$' 448s Checking `sshd'... INFECTED but disabled 448s OK 448s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 448s Checking `syslogd'... INFECTED 448s OK 448s **** Test for '^Checking `tar'\.\.\. INFECTED$' 448s Checking `tar'... INFECTED 448s OK 448s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 448s Checking `tcpd'... INFECTED 448s OK 448s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 448s Checking `tcpdump'... INFECTED 448s OK 448s **** Test for '^Checking `top'\.\.\. INFECTED$' 448s Checking `top'... INFECTED 448s OK 448s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 448s Checking `telnetd'... INFECTED 448s OK 448s **** Test for '^Checking `timed'\.\.\. INFECTED$' 448s Checking `timed'... INFECTED 448s OK 448s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 448s Checking `traceroute'... INFECTED 448s OK 448s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 448s Checking `vdir'... INFECTED 448s OK 448s **** Test for '^Checking `w'\.\.\. INFECTED$' 448s Checking `w'... INFECTED 448s OK 448s **** Test for '^Checking `write'\.\.\. INFECTED$' 448s Checking `write'... INFECTED 448s OK 448s **** Test for '^Checking `aliens'\.\.\. started$' 448s Checking `aliens'... started 448s OK 448s **** Test for '^Searching for suspicious files in /dev\.\.\. WARNING$' 448s Searching for suspicious files in /dev... WARNING 448s OK 448s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 448s WARNING: The following suspicious files were found in /dev: 448s OK 448s **** Test for '^/dev/bad-file$' 448s /dev/bad-file 448s OK 448s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 448s Searching for known suspicious directories... WARNING 448s OK 448s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 448s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 448s OK 448s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 448s /var/run/.tmp/ [Not from a Debian package] 448s OK 448s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 448s /var/run/.tmp/y [Not from a Debian package] 448s OK 448s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 448s Searching for known suspicious files... WARNING 448s OK 448s **** Test for '^WARNING: The following known suspicious files were found:$' 448s WARNING: The following known suspicious files were found: 448s OK 448s **** Test for '^/usr/bin/atm \[Not from a Debian package\]$' 448s /usr/bin/atm [Not from a Debian package] 448s OK 448s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 448s /etc/ld.so.hash [Not from a Debian package] 448s /etc/ld.so.hash [Not from a Debian package] 448s OK 448s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 448s Searching for sniffer's logs... WARNING 448s OK 448s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 448s WARNING: The following potential sniffer's logs were found: 448s OK 448s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 448s /tmp/tcp.log [Not from a Debian package] 448s OK 448s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 448s Searching for HiDrootkit rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 448s WARNING: Possible HiDrootkit rootkit installed: 448s OK 448s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 448s /var/lib/games/.k/ [Not from a Debian package] 448s OK 448s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 448s Searching for t0rn rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 448s WARNING: Possible t0rn rootkit installed: 448s OK 448s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 448s /etc/ttyhash [Not from a Debian package] 448s OK 448s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. WARNING$' 448s Searching for t0rn v8 (or variation)... WARNING 448s OK 448s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 448s WARNING: Possible t0rn v8 (or variation) rootkit installed: 448s OK 448s **** Test for '^/usr/local/lib/libproc\.a \[Not from a Debian package\]$' 448s /usr/local/lib/libproc.a [Not from a Debian package] 448s OK 448s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 448s Searching for Lion rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible Lion rootkit installed:$' 448s WARNING: Possible Lion rootkit installed: 448s OK 448s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 448s /bin/mjy [Not from a Debian package] 448s OK 448s **** Test for '^Searching for RSHA rootkit\.\.\. WARNING$' 448s Searching for RSHA rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 448s WARNING: Possible RSHA rootkit installed: 448s OK 448s **** Test for '^/usr/bin/n3tstat \[Not from a Debian package\]$' 448s /usr/bin/n3tstat [Not from a Debian package] 448s OK 448s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 448s Searching for RH-Sharpe rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 448s WARNING: Possible RH-Sharpe rootkit installed: 448s OK 448s **** Test for '^/bin/lps \[Not from a Debian package\]$' 448s /bin/lps [Not from a Debian package] 448s OK 448s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. WARNING$' 448s Searching for Ambient (ark) rootkit... WARNING 448s OK 448s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 448s WARNING: Possible Ambient's rootkit (ark) installed: 448s OK 448s **** Test for '^/usr/lib/\.ark\? \[Not from a Debian package\]$' 448s /usr/lib/.ark? [Not from a Debian package] 448s /usr/lib/.ark? [Not from a Debian package] 448s OK 448s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 448s Searching for suspicious files and dirs... WARNING 448s OK 448s **** Test for '^WARNING: The following suspicious files and directories were found:$' 448s WARNING: The following suspicious files and directories were found: 448s OK 448s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 448s /usr/lib/.1 [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 448s /usr/lib/.aaa [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 448s /usr/lib/.1DIR [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.ark\? \[Not from a Debian package\]$' 448s /usr/lib/.ark? [Not from a Debian package] 448s /usr/lib/.ark? [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 448s /usr/lib/...DIR [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 448s /usr/lib/.bbb [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 448s /usr/lib/.DIR-aaa [Not from a Debian package] 448s OK 448s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 448s /usr/lib/... [Not from a Debian package] 448s OK 448s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 448s Searching for LPD Worm... WARNING 448s OK 448s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 448s WARNING: Possible LPD worm installed (based on files found) 449s OK 449s **** Test for '^Searching for Ramen Worm rootkit\.\.\. WARNING$' 449s Searching for Ramen Worm rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 449s WARNING: Possible Ramen Worm rootkit installed: 449s OK 449s **** Test for '^/usr/src/\.poop/ \[Not from a Debian package\]$' 449s /usr/src/.poop/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Maniac rootkit\.\.\. WARNING$' 449s Searching for Maniac rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 449s WARNING: Possible Maniac rootkit installed: 449s OK 449s **** Test for '^/usr/bin/mailrc \[Not from a Debian package\]$' 449s /usr/bin/mailrc [Not from a Debian package] 449s OK 449s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 449s Searching for RK17 rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 449s WARNING: Possible RK17 rootkit installed: 449s OK 449s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 449s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 449s OK 449s **** Test for '^/usr/lib/number\.cgi \[Not from a Debian package\]$' 449s /usr/lib/number.cgi [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 449s Searching for Ducoci rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 449s WARNING: Possible Ducoci rootkit installed: 449s OK 449s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 449s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Adore Worm\.\.\. WARNING$' 449s Searching for Adore Worm... WARNING 449s OK 449s **** Test for '^WARNING: Possible Adore Worm installed:$' 449s WARNING: Possible Adore Worm installed: 449s OK 449s **** Test for '^/usr/bin/red\.tar \[Not from a Debian package\]$' 449s /usr/bin/red.tar [Not from a Debian package] 449s OK 449s **** Test for '^Searching for ShitC Worm\.\.\. WARNING$' 449s Searching for ShitC Worm... WARNING 449s OK 449s **** Test for '^WARNING: Possible ShitC Worm installed:$' 449s WARNING: Possible ShitC Worm installed: 449s OK 449s **** Test for '^(/usr)?/bin/dy \[Not from a Debian package\]$' 449s /usr/bin/dy [Not from a Debian package] 449s OK 449s **** Test for '^(/usr)?/bin/frgy \[Not from a Debian package\]$' 449s /usr/bin/frgy [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 449s Searching for Omega Worm... WARNING 449s OK 449s **** Test for '^WARNING: Possible Omega Worm installed:$' 449s WARNING: Possible Omega Worm installed: 449s OK 449s **** Test for '^/dev/chr \[Not from a Debian package\]$' 449s /dev/chr [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 449s Searching for Sadmind/IIS Worm... WARNING 449s OK 449s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 449s WARNING: Possible Sadmin/IIS Worm installed: 449s OK 449s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 449s /dev/cuc [Not from a Debian package] 449s OK 449s **** Test for '^Searching for MonKit\.\.\. WARNING$' 449s Searching for MonKit... WARNING 449s OK 449s **** Test for '^WARNING: Possible MonKit installed:$' 449s WARNING: Possible MonKit installed: 449s OK 449s **** Test for '^/usr/lib/libpikapp\.a \[Not from a Debian package\]$' 449s /usr/lib/libpikapp.a [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Showtee rootkit\.\.\. WARNING$' 449s Searching for Showtee rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 449s WARNING: Possible Showtee rootkit installed: 449s OK 449s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 449s /usr/include/proc.h [Not from a Debian package] 449s /usr/include/proc.h [Not from a Debian package] 449s OK 449s **** Test for '^/usr/include/chk\.h \[Not from a Debian package\]$' 449s /usr/include/chk.h [Not from a Debian package] 449s OK 449s **** Test for '^Searching for OpticKit\.\.\. WARNING$' 449s Searching for OpticKit... WARNING 449s OK 449s **** Test for '^WARNING: Possible OpticKit installed:$' 449s WARNING: Possible OpticKit installed: 449s OK 449s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 449s /usr/bin/xsf [Not from a Debian package] 449s /usr/bin/xsf [Not from a Debian package] 449s OK 449s **** Test for '^Searching for T\.R\.K\.\.\. WARNING$' 449s Searching for T.R.K... WARNING 449s OK 449s **** Test for '^WARNING: Possible T\.R\.K installed:$' 449s WARNING: Possible T.R.K installed: 449s OK 449s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 449s /usr/bin/xsf [Not from a Debian package] 449s /usr/bin/xsf [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Mithra rootkit\.\.\. WARNING$' 449s Searching for Mithra rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Mithra installed:$' 449s WARNING: Possible Mithra installed: 449s OK 449s **** Test for '^/usr/lib/locale/uboot \[Not from a Debian package\]$' 449s /usr/lib/locale/uboot [Not from a Debian package] 449s OK 449s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 449s Searching for OBSD rootkit v1... not tested 449s OK 449s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 449s Searching for LOC rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible LOC rootkit installed:$' 449s WARNING: Possible LOC rootkit installed: 449s OK 449s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 449s /tmp/xp [Not from a Debian package] 449s OK 449s **** Test for '^/usr/sbin/epic \[Not from a Debian package\]$' 449s /usr/sbin/epic [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Romanian rootkit\.\.\. WARNING$' 449s Searching for Romanian rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 449s WARNING: Possible Romanian rootkit installed: 449s OK 449s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 449s /usr/include/proc.h [Not from a Debian package] 449s /usr/include/proc.h [Not from a Debian package] 449s OK 449s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 449s Searching for HKRK rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network \[Not from a Debian package\]$' 449s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 449s Searching for Suckit rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Suckit:$' 449s WARNING: Possible Suckit: 449s OK 449s **** Test for '^/dev/\.golf/$' 449s /dev/.golf/ 449s OK 449s **** Test for '^Searching for Volc rootkit\.\.\. WARNING$' 449s Searching for Volc rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Volc rootkit installed:$' 449s WARNING: Possible Volc rootkit installed: 449s OK 449s **** Test for '^/usr/bin/volc \[Not from a Debian package\]$' 449s /usr/bin/volc [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Gold2 rootkit\.\.\. WARNING$' 449s Searching for Gold2 rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 449s WARNING: Possible Gold2 rootkit installed: 449s OK 449s **** Test for '^/usr/bin/ishit \[Not from a Debian package\]$' 449s /usr/bin/ishit [Not from a Debian package] 449s OK 449s **** Test for '^Searching for TC2 rootkit\.\.\. WARNING$' 449s Searching for TC2 rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 449s WARNING: Possible TC2 rootkit installed: 449s OK 449s **** Test for '^/usr/sbin/initcheck \[Not from a Debian package\]$' 449s /usr/sbin/initcheck [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Anonoying rootkit\.\.\. WARNING$' 449s Searching for Anonoying rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 449s WARNING: Possible Anonoying rootkit installed: 449s OK 449s **** Test for '^/usr/sbin/mech \[Not from a Debian package\]$' 449s /usr/sbin/mech [Not from a Debian package] 449s OK 449s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 449s Searching for ZK rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible ZK rootkit installed:$' 449s WARNING: Possible ZK rootkit installed: 449s OK 449s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 449s /etc/sysconfig/console/load.zk [Not from a Debian package] 449s OK 449s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 449s Searching for ShKit rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 449s WARNING: Possible ShKit rootkit installed: 449s OK 449s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 449s /etc/ld.so.hash [Not from a Debian package] 449s /etc/ld.so.hash [Not from a Debian package] 449s OK 449s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 449s Searching for AjaKit rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 449s WARNING: Possible AjaKit rootkit installed: 449s OK 449s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 449s /dev/tux/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 449s Searching for zaRwT rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 449s WARNING: Possible zaRwT rootkit installed: 449s OK 449s **** Test for '^/bin/imout \[Not from a Debian package\]$' 449s /bin/imout [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Madalin rootkit\.\.\. WARNING$' 449s Searching for Madalin rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 449s WARNING: Possible Madalin rootkit installed: 449s OK 449s **** Test for '^/usr/include/icekey\.h \[Not from a Debian package\]$' 449s /usr/include/icekey.h [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 449s Searching for Fu rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Fu rootkit installed:$' 449s WARNING: Possible Fu rootkit installed: 449s OK 449s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 449s /sbin/xc [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Kenga3 rootkit\.\.\. WARNING$' 449s Searching for Kenga3 rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 449s WARNING: Possible Kenga3 rootkit installed: 449s OK 449s **** Test for '^/usr/include/\. \./ \[Not from a Debian package\]$' 449s /usr/include/. ./ [Not from a Debian package] 449s OK 449s **** Test for '^/usr/include/\. \./foo \[Not from a Debian package\]$' 449s /usr/include/. ./foo [Not from a Debian package] 449s OK 449s **** Test for '^Searching for ESRK rootkit\.\.\. WARNING$' 449s Searching for ESRK rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 449s WARNING: Possible ESRK rootkit installed: 449s OK 449s **** Test for '^/usr/lib/tcl5\.3/ \[Not from a Debian package\]$' 449s /usr/lib/tcl5.3/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 449s Searching for rootedoor... WARNING 449s OK 449s **** Test for '^WARNING: Possible rootedoor installed:$' 449s WARNING: Possible rootedoor installed: 449s OK 449s **** Test for '^/usr/sbin/rootedoor \[Not from a Debian package\]$' 449s /usr/sbin/rootedoor [Not from a Debian package] 449s /usr/sbin/rootedoor [Not from a Debian package] 449s OK 449s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 449s /sbin/rootedoor [Not from a Debian package] 449s /sbin/rootedoor [Not from a Debian package] 449s OK 449s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 449s Searching for ENYELKM rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 449s WARNING: Possible ENYELKM rootkit installed: 449s OK 449s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 449s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 449s Searching for common ssh-scanners... WARNING 449s OK 449s **** Test for '^WARNING: Possible ssh-scanner installed:$' 449s WARNING: Possible ssh-scanner installed: 449s OK 449s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 449s /var/tmp/vuln.txt [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 449s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 449s OK 449s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 449s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 449s OK 449s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 449s Searching for Linux/Ebury 1.6... WARNING 449s OK 449s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 449s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 449s OK 449s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 449s Searching for 64-bit Linux Rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:$' 449s WARNING: Possible 64-bit Linux Rootkit: 449s OK 449s **** Test for '^/usr/local/hide/ \[Not from a Debian package\]$' 449s /usr/local/hide/ [Not from a Debian package] 449s OK 449s **** Test for '^/usr/local/hide/foo \[Not from a Debian package\]$' 449s /usr/local/hide/foo [Not from a Debian package] 449s OK 449s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 449s /etc/rc.local [Not from a Debian package] 449s OK 449s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 449s Searching for 64-bit Linux Rootkit modules... WARNING 449s OK 449s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 449s WARNING: Possible 64-bit rootkit modules installed: 449s OK 449s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 449s /lib/modules/module_init.ko [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 449s Searching for Mumblehard... WARNING 449s OK 449s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 449s WARNING: Possible Mumblehard backdoor installed: 449s OK 449s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 449s /var/spool/cron/crontabs/foo [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 449s Searching for Backdoor.Linux.Mokes.a... WARNING 449s OK 449s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 449s WARNING: Possible Backdoor.Linux.Mokes.a installed: 449s OK 449s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 449s /tmp/ss0-0 [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 449s Searching for Malicious TinyDNS... WARNING 449s OK 449s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 449s WARNING: Possible Malicious TinyDNS installed: 449s OK 449s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 449s /home/ ./ [Not from a Debian package] 449s OK 449s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 449s /home/ ./tinyDNS [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 449s Searching for Linux.Xor.DDoS... WARNING 449s OK 449s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 449s WARNING: Possible Linux.Xor.DDoS installed: 449s OK 449s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 449s /tmp/clean/strings [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 449s /tmp/clean/uname [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 449s /tmp/clean/head [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 449s /tmp/clean/find [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 449s /tmp/clean/echo [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 449s /tmp/clean/netstat [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 449s /tmp/clean/ls [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 449s /tmp/clean/ls.orig [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 449s /tmp/clean/ps [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 449s /tmp/clean/awk [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 449s /tmp/clean/grep [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 449s /tmp/clean/grep.orig [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 449s /tmp/clean/dirname [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 449s /tmp/clean/ss [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 449s /tmp/clean/sed [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 449s /tmp/clean/cut [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 449s /tmp/clean/id [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 449s /tmp/clean/xargs [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 449s /tmp/clean/dpkg-query [Not from a Debian package] 449s OK 449s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 449s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 449s Searching for Linux.Proxy.1.0... WARNING 449s OK 449s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 449s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 449s OK 449s **** Test for '^Searching for CrossRAT\.\.\. WARNING$' 449s Searching for CrossRAT... WARNING 449s OK 449s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 449s WARNING: Possible Malicious CrossRAT installed: 449s OK 449s **** Test for '^/usr/var/mediamgrs\.jar \[Not from a Debian package\]$' 449s /usr/var/mediamgrs.jar [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 449s Searching for Hidden Cobra... WARNING 449s OK 449s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 449s WARNING: Possible Malicious Hidden Cobra installed: 449s OK 449s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 449s /tmp/.ICE-unix/engine.so [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 449s Searching for Rocke Miner rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 449s WARNING: Possible Rocke Miner rootkit installed: 449s OK 449s **** Test for '^/etc/xig \[Not from a Debian package\]$' 449s /etc/xig [Not from a Debian package] 449s OK 449s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 449s Searching for PWNLNX4 lkm rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 449s WARNING: Possible PWNLNX4 lkm rootkit installed: 449s OK 449s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 449s /var/tmp/.1/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 449s Searching for PWNLNX6 lkm rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 449s WARNING: Possible PWNLNX6 lkm rootkit installed: 449s OK 449s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 449s /tmp/suterusu/ [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Umbreon lrk\.\.\. WARNING$' 449s Searching for Umbreon lrk... WARNING 449s OK 449s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 449s WARNING: Possible Malicious UMBREON LRK installed: 449s OK 449s **** Test for '^/usr/share/libc\.so\.69 \[Not from a Debian package\]$' 449s /usr/share/libc.so.69 [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 449s Searching for Kinsing.a backdoor rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 449s WARNING: Possible Kinsing.a backdoor rootkit installed: 449s OK 449s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 449s /tmp/kdevtmpfsi [Not from a Debian package] 449s OK 449s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 449s Searching for RotaJakiro backdoor rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 449s WARNING: Possible RotaJakiro backdoor rootkit installed: 449s OK 449s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 449s /bin/systemd-daemon [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. WARNING$' 449s Searching for Syslogk LKM rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 449s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 449s OK 449s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 449s Searching for Kovid LKM rootkit... WARNING 449s OK 449s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 449s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 449s OK 449s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 449s Searching for Tsunami DDoS Malware rootkit... WARNING 449s OK 449s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 449s WARNING: Possible Tsunami DDoS Malware rootkit installed: 449s OK 449s **** Test for '^/bin/cls \[Not from a Debian package\]$' 449s /bin/cls [Not from a Debian package] 449s OK 449s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 449s Searching for Linux BPF Door... WARNING 449s OK 449s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 449s WARNING: Possible Linux BPFDoor Malware installed: 449s OK 449s **** Test for '^/proc/xx/stack$' 449s /proc/xx/stack 449s OK 449s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 449s Searching for suspect PHP files... WARNING 449s OK 449s **** Test for '^WARNING: The following suspicious PHP files were found:$' 449s WARNING: The following suspicious PHP files were found: 449s OK 449s **** Test for '^/tmp/name\.php$' 449s /tmp/name.php 449s OK 449s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 449s /tmp/sp ace/aaa' exit 1; " 449s OK 449s **** Test for '^/tmp/by-content$' 449s /tmp/by-content 449s OK 449s **** Test for '^Searching for zero-size shell history files in /root\.\.\. WARNING$' 449s Searching for zero-size shell history files in /root... WARNING 449s OK 449s **** Test for '^WARNING: Zero-size history files:$' 449s WARNING: Zero-size history files: 449s OK 449s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 449s /root/.whatever.history [Not from a Debian package] 449s /root/.whatever.history [Not from a Debian package] 449s OK 449s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. WARNING$' 449s Searching for hardlinked shell history files in /root... WARNING 449s OK 449s **** Test for '^WARNING: shell history files hardlinked to another file:$' 449s WARNING: shell history files hardlinked to another file: 449s OK 449s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 449s /root/.whatever.history [Not from a Debian package] 449s /root/.whatever.history [Not from a Debian package] 449s OK 449s **** Test for '^Checking `aliens'\.\.\. finished$' 449s Checking `aliens'... finished 449s OK 449s **** Test for '^Checking `asp'\.\.\. WARNING$' 449s Checking `asp'... WARNING 449s OK 449s **** Test for '^WARNING: Possible Ramen Worm installed in /etc/inetd\.conf$' 449s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 449s OK 449s **** Test for '^Checking `bindshell'\.\.\. WARNING$' 449s Checking `bindshell'... WARNING 449s OK 449s **** Test for '^WARNING: Potential bindshell installed: infected ports: 600 31337$' 449s WARNING: Potential bindshell installed: infected ports: 600 31337 449s OK 449s **** Test for '^Checking `lkm'\.\.\. started$' 449s Checking `lkm'... started 449s OK 449s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 449s Searching for Adore LKM... not tested 449s OK 449s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 449s Searching for sebek LKM (Adore based)... not tested 449s OK 449s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 449s Searching for knark LKM rootkit... not found 449s OK 449s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not found$' 449s Searching for for hidden processes with chkproc... not found 449s OK 449s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 449s Searching for for hidden directories using chkdirs... not found 449s OK 449s **** Test for '^Checking `lkm'\.\.\. finished$' 449s Checking `lkm'... finished 449s OK 449s **** Test for '^Checking `rexedcs'\.\.\. INFECTED: /usr/bin/in\.rexedcs$' 449s Checking `rexedcs'... INFECTED: /usr/bin/in.rexedcs 449s OK 449s **** Test for '^Checking `sniffer'\.\.\. WARNING$' 449s Checking `sniffer'... WARNING 449s OK 449s **** Test for '^WARNING: Output from ifpromisc:$' 449s WARNING: Output from ifpromisc: 449s OK 449s **** Test for '^lo: not promisc and no packet sniffer sockets$' 449s lo: not promisc and no packet sniffer sockets 449s OK 449s **** Test for '^Checking `w55808'\.\.\. WARNING$' 449s Checking `w55808'... WARNING 449s OK 449s **** Test for '^WARNING: Possible 55808 Worm installed$' 449s WARNING: Possible 55808 Worm installed 449s OK 449s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 449s Checking `wted'... not found 449s OK 449s **** Test for '^Checking `scalper'\.\.\. WARNING$' 449s Checking `scalper'... WARNING 449s OK 449s **** Test for '^WARNING: Possible Scalper Worm installed$' 449s WARNING: Possible Scalper Worm installed 449s OK 449s **** Test for '^Checking `slapper'\.\.\. WARNING$' 449s Checking `slapper'... WARNING 449s OK 449s **** Test for '^WARNING: Possible Slapper Worm installed:$' 449s WARNING: Possible Slapper Worm installed: 449s OK 449s **** Test for '^/tmp/\.bugtraq\.c \[Not from a Debian package\]$' 449s /tmp/.bugtraq.c [Not from a Debian package] 449s OK 449s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 449s Checking `z2'... not found 449s OK 449s **** Test for '^Checking `chkutmp'\.\.\.' 449s Checking `chkutmp'... not found 449s OK 449s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 449s Checking `OSX_RSPLUG'... not tested 449s OK 449s ** PASS: Testing: all-tests-can-find-something-01 (chkrootkit -p /tmp/clean) done: PASS 449s *** Unexpected (unmatched) lines follow (for info): 449s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 449s ** Testing: all-tests-can-find-something-02-quiet (chkrootkit -p /tmp/clean -q) ... 449s *** Output 449s Checking `amd'... INFECTED 449s Checking `basename'... INFECTED 449s Checking `biff'... INFECTED 449s Checking `chfn'... INFECTED 449s Checking `chsh'... INFECTED 449s Checking `cron'... INFECTED 449s WARNING: crontab for nobody found, possible Lupper.Worm. 449s Checking for Lupper.Worm... INFECTED 449s Checking `crontab'... INFECTED 449s Checking `date'... INFECTED 449s Checking `du'... INFECTED 449s Checking `dirname'... INFECTED 449s Checking `echo'... INFECTED 449s Checking `egrep'... INFECTED 449s Checking `env'... INFECTED 449s Checking `find'... INFECTED 449s Checking `fingerd'... INFECTED 449s Checking `gpm'... INFECTED 449s Checking `grep'... INFECTED 449s Checking `hdparm'... INFECTED 449s Checking `su'... INFECTED 449s Checking `ifconfig'... INFECTED 449s Checking `inetd'... INFECTED 449s Checking `inetdconf'... INFECTED 449s Checking `identd'... INFECTED 449s Checking `init'... INFECTED 449s Checking `killall'... INFECTED 449s Checking `login'... INFECTED 449s Checking `ls'... INFECTED 449s Checking `lsof'... INFECTED 449s Checking `mail'... INFECTED 449s Checking `mingetty'... INFECTED 449s Checking `netstat'... INFECTED 449s Checking `named'... INFECTED 449s Checking `passwd'... INFECTED 449s Checking `pidof'... INFECTED 449s Checking `pop2'... INFECTED 449s Checking `pop3'... INFECTED 449s Checking `ps'... INFECTED 449s Checking `pstree'... INFECTED 449s Checking `rpcinfo'... INFECTED 449s Checking `rlogind'... INFECTED 449s Checking `rshd'... INFECTED 449s Checking `slogin'... INFECTED 449s Checking `sendmail'... INFECTED 449s Checking `syslogd'... INFECTED 449s Checking `tar'... INFECTED 449s Checking `tcpd'... INFECTED 449s Checking `tcpdump'... INFECTED 449s Checking `top'... INFECTED 449s Checking `telnetd'... INFECTED 449s Checking `timed'... INFECTED 449s Checking `traceroute'... INFECTED 449s Checking `vdir'... INFECTED 449s Checking `w'... INFECTED 449s Checking `write'... INFECTED 449s WARNING: The following suspicious files were found in /dev: 449s /dev/bad-file 449s 449s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 449s /var/run/.tmp/ [Not from a Debian package] 449s /var/run/.tmp/y [Not from a Debian package] 449s 449s WARNING: The following known suspicious files were found: 449s /usr/bin/atm [Not from a Debian package] 449s /etc/ld.so.hash [Not from a Debian package] 449s 449s WARNING: The following potential sniffer's logs were found: 449s /tmp/tcp.log [Not from a Debian package] 449s 449s WARNING: Possible HiDrootkit rootkit installed: 449s /var/lib/games/.k/ [Not from a Debian package] 449s 449s WARNING: Possible t0rn rootkit installed: 449s /etc/ttyhash [Not from a Debian package] 449s 449s WARNING: Possible t0rn v8 (or variation) rootkit installed: 449s /usr/local/lib/libproc.a [Not from a Debian package] 449s 449s WARNING: Possible Lion rootkit installed: 449s /bin/mjy [Not from a Debian package] 449s 449s WARNING: Possible RSHA rootkit installed: 449s /usr/bin/n3tstat [Not from a Debian package] 449s 449s WARNING: Possible RH-Sharpe rootkit installed: 449s /bin/lps [Not from a Debian package] 449s 449s WARNING: Possible Ambient's rootkit (ark) installed: 449s /usr/lib/.ark? [Not from a Debian package] 449s 450s WARNING: The following suspicious files and directories were found: 450s /usr/lib/... [Not from a Debian package] 450s /usr/lib/.aaa [Not from a Debian package] 450s /usr/lib/.1 [Not from a Debian package] 450s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 450s /usr/lib/.bbb [Not from a Debian package] 450s /usr/lib/.1DIR [Not from a Debian package] 450s /usr/lib/.DIR-aaa [Not from a Debian package] 450s /usr/lib/...DIR [Not from a Debian package] 450s /usr/lib/.ark? [Not from a Debian package] 450s 450s WARNING: Possible LPD worm installed (based on files found) 450s 450s WARNING: Possible Ramen Worm rootkit installed: 450s /usr/src/.poop/ [Not from a Debian package] 450s 450s WARNING: Possible Maniac rootkit installed: 450s /usr/bin/mailrc [Not from a Debian package] 450s 450s WARNING: Possible RK17 rootkit installed: 450s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 450s /usr/lib/number.cgi [Not from a Debian package] 450s 450s WARNING: Possible Ducoci rootkit installed: 450s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 450s 450s WARNING: Possible Adore Worm installed: 450s /usr/bin/red.tar [Not from a Debian package] 450s 450s WARNING: Possible ShitC Worm installed: 450s /usr/bin/dy [Not from a Debian package] 450s /usr/bin/frgy [Not from a Debian package] 450s 450s WARNING: Possible Omega Worm installed: 450s /dev/chr [Not from a Debian package] 450s 450s WARNING: Possible Sadmin/IIS Worm installed: 450s /dev/cuc [Not from a Debian package] 450s 450s WARNING: Possible MonKit installed: 450s /usr/lib/libpikapp.a [Not from a Debian package] 450s 450s WARNING: Possible Showtee rootkit installed: 450s /usr/include/proc.h [Not from a Debian package] 450s /usr/include/chk.h [Not from a Debian package] 450s 450s WARNING: Possible OpticKit installed: 450s /usr/bin/xsf [Not from a Debian package] 450s 450s WARNING: Possible T.R.K installed: 450s /usr/bin/xsf [Not from a Debian package] 450s 451s WARNING: Possible Mithra installed: 451s /usr/lib/locale/uboot [Not from a Debian package] 451s 451s WARNING: Possible LOC rootkit installed: 451s /tmp/xp [Not from a Debian package] 451s /usr/sbin/epic [Not from a Debian package] 451s WARNING: Possible Romanian rootkit installed: 451s /usr/include/proc.h [Not from a Debian package] 451s 451s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 451s 451s WARNING: Possible Suckit: 451s /dev/.golf/ 451s 451s WARNING: Possible Volc rootkit installed: 451s /usr/bin/volc [Not from a Debian package] 451s 451s WARNING: Possible Gold2 rootkit installed: 451s /usr/bin/ishit [Not from a Debian package] 451s 451s WARNING: Possible TC2 rootkit installed: 451s /usr/sbin/initcheck [Not from a Debian package] 451s 451s WARNING: Possible Anonoying rootkit installed: 451s /usr/sbin/mech [Not from a Debian package] 451s 451s WARNING: Possible ZK rootkit installed: 451s /etc/sysconfig/console/load.zk [Not from a Debian package] 451s 451s WARNING: Possible ShKit rootkit installed: 451s /etc/ld.so.hash [Not from a Debian package] 451s 451s WARNING: Possible AjaKit rootkit installed: 451s /dev/tux/ [Not from a Debian package] 451s 451s WARNING: Possible zaRwT rootkit installed: 451s /bin/imout [Not from a Debian package] 451s 451s WARNING: Possible Madalin rootkit installed: 451s /usr/include/icekey.h [Not from a Debian package] 451s 451s WARNING: Possible Fu rootkit installed: 451s /sbin/xc [Not from a Debian package] 451s 451s WARNING: Possible Kenga3 rootkit installed: 451s /usr/include/. ./ [Not from a Debian package] 451s /usr/include/. ./foo [Not from a Debian package] 451s 451s WARNING: Possible ESRK rootkit installed: 451s /usr/lib/tcl5.3/ [Not from a Debian package] 451s 451s WARNING: Possible rootedoor installed: 451s /usr/sbin/rootedoor [Not from a Debian package] 451s /sbin/rootedoor [Not from a Debian package] 451s /sbin/rootedoor [Not from a Debian package] 451s /usr/sbin/rootedoor [Not from a Debian package] 451s 451s WARNING: Possible ENYELKM rootkit installed: 451s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 451s 451s WARNING: Possible ssh-scanner installed: 451s /var/tmp/vuln.txt [Not from a Debian package] 451s 451s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 451s 451s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 451s WARNING: Possible 64-bit Linux Rootkit: 451s /usr/local/hide/ [Not from a Debian package] 451s /usr/local/hide/foo [Not from a Debian package] 451s /etc/rc.local [Not from a Debian package] 451s 451s WARNING: Possible 64-bit rootkit modules installed: 451s /lib/modules/module_init.ko [Not from a Debian package] 451s 451s WARNING: Possible Mumblehard backdoor installed: 451s /var/spool/cron/crontabs/foo [Not from a Debian package] 451s 451s WARNING: Possible Backdoor.Linux.Mokes.a installed: 451s /tmp/ss0-0 [Not from a Debian package] 451s 451s WARNING: Possible Malicious TinyDNS installed: 451s /home/ ./ [Not from a Debian package] 451s /home/ ./tinyDNS [Not from a Debian package] 451s 453s WARNING: Possible Linux.Xor.DDoS installed: 453s /tmp/clean/ps [Not from a Debian package] 453s /tmp/clean/head [Not from a Debian package] 453s /tmp/clean/ls.orig [Not from a Debian package] 453s /tmp/clean/cut [Not from a Debian package] 453s /tmp/clean/ls [Not from a Debian package] 453s /tmp/clean/echo [Not from a Debian package] 453s /tmp/clean/awk [Not from a Debian package] 453s /tmp/clean/grep.orig [Not from a Debian package] 453s /tmp/clean/dpkg-query [Not from a Debian package] 453s /tmp/clean/sed [Not from a Debian package] 453s /tmp/clean/strings [Not from a Debian package] 453s /tmp/clean/netstat [Not from a Debian package] 453s /tmp/clean/uname [Not from a Debian package] 453s /tmp/clean/id [Not from a Debian package] 453s /tmp/clean/grep [Not from a Debian package] 453s /tmp/clean/find [Not from a Debian package] 453s /tmp/clean/dirname [Not from a Debian package] 453s /tmp/clean/xargs [Not from a Debian package] 453s /tmp/clean/ss [Not from a Debian package] 453s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 453s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 453s 453s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 453s 453s WARNING: Possible Malicious CrossRAT installed: 453s /usr/var/mediamgrs.jar [Not from a Debian package] 453s 453s WARNING: Possible Malicious Hidden Cobra installed: 453s /tmp/.ICE-unix/engine.so [Not from a Debian package] 453s 453s WARNING: Possible Rocke Miner rootkit installed: 453s /etc/xig [Not from a Debian package] 453s 453s WARNING: Possible PWNLNX4 lkm rootkit installed: 453s /var/tmp/.1/ [Not from a Debian package] 453s 453s WARNING: Possible PWNLNX6 lkm rootkit installed: 453s /tmp/suterusu/ [Not from a Debian package] 453s 453s WARNING: Possible Malicious UMBREON LRK installed: 453s /usr/share/libc.so.69 [Not from a Debian package] 453s 453s WARNING: Possible Kinsing.a backdoor rootkit installed: 453s /tmp/kdevtmpfsi [Not from a Debian package] 453s 453s WARNING: Possible RotaJakiro backdoor rootkit installed: 453s /bin/systemd-daemon [Not from a Debian package] 453s 453s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 453s 453s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 453s 454s WARNING: Possible Tsunami DDoS Malware rootkit installed: 454s /bin/cls [Not from a Debian package] 454s 454s WARNING: Possible Linux BPFDoor Malware installed: 454s /proc/xx/stack 454s 454s WARNING: The following suspicious PHP files were found: 454s /tmp/name.php 454s /tmp/by-content 454s /tmp/sp ace/aaa' exit 1; " 454s 454s WARNING: Zero-size history files: 454s /root/.whatever.history [Not from a Debian package] 454s 454s WARNING: shell history files hardlinked to another file: 454s /root/.whatever.history [Not from a Debian package] 454s 454s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 454s 454s WARNING: Potential bindshell installed: infected ports: 600 31337 454s 462s INFECTED: /usr/bin/in.rexedcs 462s WARNING: Output from ifpromisc: 462s enc1: PACKET SNIFFER(/usr/lib/systemd/systemd-networkd[610]) 462s 462s WARNING: Possible 55808 Worm installed 462s 462s WARNING: Possible Scalper Worm installed 462s 462s WARNING: Possible Slapper Worm installed: 462s /tmp/.bugtraq.c [Not from a Debian package] 462s 462s **** Files in log 462s total 44K 462s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 462s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 462s -rw-r--r-- 1 root root 0 Nov 26 20:47 chkrootkit-daily.log 462s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.expected 462s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 462s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 462s *** Test of content of output follows... 462s **** Test for '^Checking `amd'\.\.\. INFECTED$' 462s Checking `amd'... INFECTED 462s OK 462s **** Test for '^Checking `basename'\.\.\. INFECTED$' 462s Checking `basename'... INFECTED 462s OK 462s **** Test for '^Checking `biff'\.\.\. INFECTED$' 462s Checking `biff'... INFECTED 462s OK 462s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 462s Checking `chfn'... INFECTED 462s OK 462s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 462s Checking `chsh'... INFECTED 462s OK 462s **** Test for '^Checking `cron'\.\.\. INFECTED$' 462s Checking `cron'... INFECTED 462s OK 462s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 462s Checking for Lupper.Worm... INFECTED 462s OK 462s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 462s WARNING: crontab for nobody found, possible Lupper.Worm. 462s OK 462s **** Test for '^Checking `crontab'\.\.\. INFECTED$' 462s Checking `crontab'... INFECTED 462s OK 462s **** Test for '^Checking `date'\.\.\. INFECTED$' 462s Checking `date'... INFECTED 462s OK 462s **** Test for '^Checking `du'\.\.\. INFECTED$' 462s Checking `du'... INFECTED 462s OK 462s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 462s Checking `dirname'... INFECTED 462s OK 462s **** Test for '^Checking `echo'\.\.\. INFECTED$' 462s Checking `echo'... INFECTED 462s OK 462s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 462s Checking `egrep'... INFECTED 462s OK 462s **** Test for '^Checking `env'\.\.\. INFECTED$' 462s Checking `env'... INFECTED 462s OK 462s **** Test for '^Checking `find'\.\.\. INFECTED$' 462s Checking `find'... INFECTED 462s OK 462s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 462s Checking `fingerd'... INFECTED 462s OK 462s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 462s Checking `gpm'... INFECTED 462s OK 462s **** Test for '^Checking `grep'\.\.\. INFECTED$' 462s Checking `grep'... INFECTED 462s OK 462s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 462s Checking `hdparm'... INFECTED 462s OK 462s **** Test for '^Checking `su'\.\.\. INFECTED$' 462s Checking `su'... INFECTED 462s OK 462s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 462s Checking `ifconfig'... INFECTED 462s OK 462s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 462s Checking `inetd'... INFECTED 462s OK 462s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 462s Checking `inetdconf'... INFECTED 462s OK 462s **** Test for '^Checking `identd'\.\.\. INFECTED$' 462s Checking `identd'... INFECTED 462s OK 462s **** Test for '^Checking `init'\.\.\. INFECTED$' 462s Checking `init'... INFECTED 462s OK 462s **** Test for '^Checking `killall'\.\.\. INFECTED$' 462s Checking `killall'... INFECTED 462s OK 462s **** Test for '^Checking `login'\.\.\. INFECTED$' 462s Checking `login'... INFECTED 462s OK 462s **** Test for '^Checking `ls'\.\.\. INFECTED$' 462s Checking `ls'... INFECTED 462s OK 462s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 462s Checking `lsof'... INFECTED 462s OK 462s **** Test for '^Checking `mail'\.\.\. INFECTED$' 462s Checking `mail'... INFECTED 462s OK 462s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 462s Checking `mingetty'... INFECTED 462s OK 462s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 462s Checking `netstat'... INFECTED 462s OK 462s **** Test for '^Checking `named'\.\.\. INFECTED$' 462s Checking `named'... INFECTED 462s OK 462s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 462s Checking `passwd'... INFECTED 462s OK 462s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 462s Checking `pidof'... INFECTED 462s OK 462s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 462s Checking `pop2'... INFECTED 462s OK 462s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 462s Checking `pop3'... INFECTED 462s OK 462s **** Test for '^Checking `ps'\.\.\. INFECTED$' 462s Checking `ps'... INFECTED 462s OK 462s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 462s Checking `pstree'... INFECTED 462s OK 462s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 462s Checking `rpcinfo'... INFECTED 462s OK 462s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 462s Checking `rlogind'... INFECTED 462s OK 462s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 462s Checking `rshd'... INFECTED 462s OK 462s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 462s Checking `slogin'... INFECTED 462s OK 462s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 462s Checking `sendmail'... INFECTED 462s OK 462s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 462s Checking `syslogd'... INFECTED 462s OK 462s **** Test for '^Checking `tar'\.\.\. INFECTED$' 462s Checking `tar'... INFECTED 462s OK 462s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 462s Checking `tcpd'... INFECTED 462s OK 462s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 462s Checking `tcpdump'... INFECTED 462s OK 462s **** Test for '^Checking `top'\.\.\. INFECTED$' 462s Checking `top'... INFECTED 462s OK 462s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 462s Checking `telnetd'... INFECTED 462s OK 462s **** Test for '^Checking `timed'\.\.\. INFECTED$' 462s Checking `timed'... INFECTED 462s OK 462s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 462s Checking `traceroute'... INFECTED 462s OK 462s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 462s Checking `vdir'... INFECTED 462s OK 462s **** Test for '^Checking `w'\.\.\. INFECTED$' 462s Checking `w'... INFECTED 462s OK 462s **** Test for '^Checking `write'\.\.\. INFECTED$' 462s Checking `write'... INFECTED 462s OK 462s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 462s WARNING: The following suspicious files were found in /dev: 462s OK 462s **** Test for '^/dev/bad-file$' 462s /dev/bad-file 462s OK 462s **** Test for '^$' 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s 462s OK 462s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 462s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 462s OK 462s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 462s /var/run/.tmp/ [Not from a Debian package] 462s OK 462s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 462s /var/run/.tmp/y [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: The following known suspicious files were found:$' 462s WARNING: The following known suspicious files were found: 462s OK 462s **** Test for '^/usr/bin/atm \[Not from a Debian package\]$' 462s /usr/bin/atm [Not from a Debian package] 462s OK 462s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 462s /etc/ld.so.hash [Not from a Debian package] 462s /etc/ld.so.hash [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 462s WARNING: The following potential sniffer's logs were found: 462s OK 462s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 462s /tmp/tcp.log [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 462s WARNING: Possible HiDrootkit rootkit installed: 462s OK 462s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 462s /var/lib/games/.k/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 462s WARNING: Possible t0rn rootkit installed: 462s OK 462s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 462s /etc/ttyhash [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 462s WARNING: Possible t0rn v8 (or variation) rootkit installed: 462s OK 462s **** Test for '^/usr/local/lib/libproc\.a \[Not from a Debian package\]$' 462s /usr/local/lib/libproc.a [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Lion rootkit installed:$' 462s WARNING: Possible Lion rootkit installed: 462s OK 462s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 462s /bin/mjy [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 462s WARNING: Possible RSHA rootkit installed: 462s OK 462s **** Test for '^/usr/bin/n3tstat \[Not from a Debian package\]$' 462s /usr/bin/n3tstat [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 462s WARNING: Possible RH-Sharpe rootkit installed: 462s OK 462s **** Test for '^/bin/lps \[Not from a Debian package\]$' 462s /bin/lps [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 462s WARNING: Possible Ambient's rootkit (ark) installed: 462s OK 462s **** Test for '^/usr/lib/\.ark\? \[Not from a Debian package\]$' 462s /usr/lib/.ark? [Not from a Debian package] 462s /usr/lib/.ark? [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: The following suspicious files and directories were found:$' 462s WARNING: The following suspicious files and directories were found: 462s OK 462s **** Test for '^(/usr)?/lib/\.1 \[Not from a Debian package\]$' 462s /usr/lib/.1 [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.aaa \[Not from a Debian package\]$' 462s /usr/lib/.aaa [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.1DIR \[Not from a Debian package\]$' 462s /usr/lib/.1DIR [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.ark\? \[Not from a Debian package\]$' 462s /usr/lib/.ark? [Not from a Debian package] 462s /usr/lib/.ark? [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.\.\.DIR \[Not from a Debian package\]$' 462s /usr/lib/...DIR [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.bbb \[Not from a Debian package\]$' 462s /usr/lib/.bbb [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.DIR-aaa \[Not from a Debian package\]$' 462s /usr/lib/.DIR-aaa [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/lib/\.\.\. \[Not from a Debian package\]$' 462s /usr/lib/... [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 462s WARNING: Possible LPD worm installed (based on files found) 462s OK 462s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 462s WARNING: Possible Ramen Worm rootkit installed: 462s OK 462s **** Test for '^/usr/src/\.poop/ \[Not from a Debian package\]$' 462s /usr/src/.poop/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 462s WARNING: Possible Maniac rootkit installed: 462s OK 462s **** Test for '^/usr/bin/mailrc \[Not from a Debian package\]$' 462s /usr/bin/mailrc [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 462s WARNING: Possible RK17 rootkit installed: 462s OK 462s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 462s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 462s OK 462s **** Test for '^/usr/lib/number\.cgi \[Not from a Debian package\]$' 462s /usr/lib/number.cgi [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 462s WARNING: Possible Ducoci rootkit installed: 462s OK 462s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 462s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Adore Worm installed:$' 462s WARNING: Possible Adore Worm installed: 462s OK 462s **** Test for '^/usr/bin/red\.tar \[Not from a Debian package\]$' 462s /usr/bin/red.tar [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ShitC Worm installed:$' 462s WARNING: Possible ShitC Worm installed: 462s OK 462s **** Test for '^(/usr)?/bin/dy \[Not from a Debian package\]$' 462s /usr/bin/dy [Not from a Debian package] 462s OK 462s **** Test for '^(/usr)?/bin/frgy \[Not from a Debian package\]$' 462s /usr/bin/frgy [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Omega Worm installed:$' 462s WARNING: Possible Omega Worm installed: 462s OK 462s **** Test for '^/dev/chr \[Not from a Debian package\]$' 462s /dev/chr [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 462s WARNING: Possible Sadmin/IIS Worm installed: 462s OK 462s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 462s /dev/cuc [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible MonKit installed:$' 462s WARNING: Possible MonKit installed: 462s OK 462s **** Test for '^/usr/lib/libpikapp\.a \[Not from a Debian package\]$' 462s /usr/lib/libpikapp.a [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 462s WARNING: Possible Showtee rootkit installed: 462s OK 462s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 462s /usr/include/proc.h [Not from a Debian package] 462s /usr/include/proc.h [Not from a Debian package] 462s OK 462s **** Test for '^/usr/include/chk\.h \[Not from a Debian package\]$' 462s /usr/include/chk.h [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible OpticKit installed:$' 462s WARNING: Possible OpticKit installed: 462s OK 462s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 462s /usr/bin/xsf [Not from a Debian package] 462s /usr/bin/xsf [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible T\.R\.K installed:$' 462s WARNING: Possible T.R.K installed: 462s OK 462s **** Test for '^/usr/bin/xsf \[Not from a Debian package\]$' 462s /usr/bin/xsf [Not from a Debian package] 462s /usr/bin/xsf [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Mithra installed:$' 462s WARNING: Possible Mithra installed: 462s OK 462s **** Test for '^/usr/lib/locale/uboot \[Not from a Debian package\]$' 462s /usr/lib/locale/uboot [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible LOC rootkit installed:$' 462s WARNING: Possible LOC rootkit installed: 462s OK 462s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 462s /tmp/xp [Not from a Debian package] 462s OK 462s **** Test for '^/usr/sbin/epic \[Not from a Debian package\]$' 462s /usr/sbin/epic [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 462s WARNING: Possible Romanian rootkit installed: 462s OK 462s **** Test for '^/usr/include/proc\.h \[Not from a Debian package\]$' 462s /usr/include/proc.h [Not from a Debian package] 462s /usr/include/proc.h [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc\.d/init\.d/network \[Not from a Debian package\]$' 462s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Suckit:$' 462s WARNING: Possible Suckit: 462s OK 462s **** Test for '^/dev/\.golf/$' 462s /dev/.golf/ 462s OK 462s **** Test for '^WARNING: Possible Volc rootkit installed:$' 462s WARNING: Possible Volc rootkit installed: 462s OK 462s **** Test for '^/usr/bin/volc \[Not from a Debian package\]$' 462s /usr/bin/volc [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 462s WARNING: Possible Gold2 rootkit installed: 462s OK 462s **** Test for '^/usr/bin/ishit \[Not from a Debian package\]$' 462s /usr/bin/ishit [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 462s WARNING: Possible TC2 rootkit installed: 462s OK 462s **** Test for '^/usr/sbin/initcheck \[Not from a Debian package\]$' 462s /usr/sbin/initcheck [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 462s WARNING: Possible Anonoying rootkit installed: 462s OK 462s **** Test for '^/usr/sbin/mech \[Not from a Debian package\]$' 462s /usr/sbin/mech [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ZK rootkit installed:$' 462s WARNING: Possible ZK rootkit installed: 462s OK 462s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 462s /etc/sysconfig/console/load.zk [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 462s WARNING: Possible ShKit rootkit installed: 462s OK 462s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 462s /etc/ld.so.hash [Not from a Debian package] 462s /etc/ld.so.hash [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 462s WARNING: Possible AjaKit rootkit installed: 462s OK 462s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 462s /dev/tux/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 462s WARNING: Possible zaRwT rootkit installed: 462s OK 462s **** Test for '^/bin/imout \[Not from a Debian package\]$' 462s /bin/imout [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 462s WARNING: Possible Madalin rootkit installed: 462s OK 462s **** Test for '^/usr/include/icekey\.h \[Not from a Debian package\]$' 462s /usr/include/icekey.h [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Fu rootkit installed:$' 462s WARNING: Possible Fu rootkit installed: 462s OK 462s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 462s /sbin/xc [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 462s WARNING: Possible Kenga3 rootkit installed: 462s OK 462s **** Test for '^/usr/include/\. \./ \[Not from a Debian package\]$' 462s /usr/include/. ./ [Not from a Debian package] 462s OK 462s **** Test for '^/usr/include/\. \./foo \[Not from a Debian package\]$' 462s /usr/include/. ./foo [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 462s WARNING: Possible ESRK rootkit installed: 462s OK 462s **** Test for '^/usr/lib/tcl5\.3/ \[Not from a Debian package\]$' 462s /usr/lib/tcl5.3/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible rootedoor installed:$' 462s WARNING: Possible rootedoor installed: 462s OK 462s **** Test for '^/usr/sbin/rootedoor \[Not from a Debian package\]$' 462s /usr/sbin/rootedoor [Not from a Debian package] 462s /usr/sbin/rootedoor [Not from a Debian package] 462s OK 462s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 462s /sbin/rootedoor [Not from a Debian package] 462s /sbin/rootedoor [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 462s WARNING: Possible ENYELKM rootkit installed: 462s OK 462s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 462s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible ssh-scanner installed:$' 462s WARNING: Possible ssh-scanner installed: 462s OK 462s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 462s /var/tmp/vuln.txt [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 462s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 462s OK 462s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 462s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 462s WARNING: Possible 64-bit Linux Rootkit: 462s OK 462s **** Test for '^/usr/local/hide/ \[Not from a Debian package\]$' 462s /usr/local/hide/ [Not from a Debian package] 462s OK 462s **** Test for '^/usr/local/hide/foo \[Not from a Debian package\]$' 462s /usr/local/hide/foo [Not from a Debian package] 462s OK 462s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 462s /etc/rc.local [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 462s WARNING: Possible 64-bit rootkit modules installed: 462s OK 462s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 462s /lib/modules/module_init.ko [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 462s WARNING: Possible Mumblehard backdoor installed: 462s OK 462s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 462s /var/spool/cron/crontabs/foo [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 462s WARNING: Possible Backdoor.Linux.Mokes.a installed: 462s OK 462s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 462s /tmp/ss0-0 [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 462s WARNING: Possible Malicious TinyDNS installed: 462s OK 462s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 462s /home/ ./ [Not from a Debian package] 462s OK 462s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 462s /home/ ./tinyDNS [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 462s WARNING: Possible Linux.Xor.DDoS installed: 462s OK 462s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 462s /tmp/clean/strings [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 462s /tmp/clean/uname [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 462s /tmp/clean/head [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 462s /tmp/clean/find [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 462s /tmp/clean/echo [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 462s /tmp/clean/netstat [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 462s /tmp/clean/ls [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 462s /tmp/clean/ls.orig [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 462s /tmp/clean/ps [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 462s /tmp/clean/awk [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 462s /tmp/clean/grep [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 462s /tmp/clean/grep.orig [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 462s /tmp/clean/dirname [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 462s /tmp/clean/ss [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 462s /tmp/clean/sed [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 462s /tmp/clean/cut [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 462s /tmp/clean/id [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 462s /tmp/clean/xargs [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 462s /tmp/clean/dpkg-query [Not from a Debian package] 462s OK 462s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 462s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 462s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 462s OK 462s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 462s WARNING: Possible Malicious CrossRAT installed: 462s OK 462s **** Test for '^/usr/var/mediamgrs\.jar \[Not from a Debian package\]$' 462s /usr/var/mediamgrs.jar [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 462s WARNING: Possible Malicious Hidden Cobra installed: 462s OK 462s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 462s /tmp/.ICE-unix/engine.so [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 462s WARNING: Possible Rocke Miner rootkit installed: 462s OK 462s **** Test for '^/etc/xig \[Not from a Debian package\]$' 462s /etc/xig [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 462s WARNING: Possible PWNLNX4 lkm rootkit installed: 462s OK 462s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 462s /var/tmp/.1/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 462s WARNING: Possible PWNLNX6 lkm rootkit installed: 462s OK 462s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 462s /tmp/suterusu/ [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 462s WARNING: Possible Malicious UMBREON LRK installed: 462s OK 462s **** Test for '^/usr/share/libc\.so\.69 \[Not from a Debian package\]$' 462s /usr/share/libc.so.69 [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 462s WARNING: Possible Kinsing.a backdoor rootkit installed: 462s OK 462s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 462s /tmp/kdevtmpfsi [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 462s WARNING: Possible RotaJakiro backdoor rootkit installed: 462s OK 462s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 462s /bin/systemd-daemon [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 462s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 462s OK 462s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 462s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 462s OK 462s **** Test for 'WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 462s WARNING: Possible Tsunami DDoS Malware rootkit installed: 462s OK 462s **** Test for '^/bin/cls \[Not from a Debian package\]$' 462s /bin/cls [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 462s WARNING: Possible Linux BPFDoor Malware installed: 462s OK 462s **** Test for '^/proc/xx/stack$' 462s /proc/xx/stack 462s OK 462s **** Test for '^WARNING: The following suspicious PHP files were found:$' 462s WARNING: The following suspicious PHP files were found: 462s OK 462s **** Test for '^/tmp/name\.php$' 462s /tmp/name.php 462s OK 462s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 462s /tmp/sp ace/aaa' exit 1; " 462s OK 462s **** Test for '^/tmp/by-content$' 462s /tmp/by-content 462s OK 462s **** Test for '^WARNING: Zero-size history files:$' 462s WARNING: Zero-size history files: 462s OK 462s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 462s /root/.whatever.history [Not from a Debian package] 462s /root/.whatever.history [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: shell history files hardlinked to another file:$' 462s WARNING: shell history files hardlinked to another file: 462s OK 462s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 462s /root/.whatever.history [Not from a Debian package] 462s /root/.whatever.history [Not from a Debian package] 462s OK 462s **** Test for '^WARNING: Possible Ramen Worm installed in /etc/inetd\.conf$' 462s WARNING: Possible Ramen Worm installed in /etc/inetd.conf 462s OK 462s **** Test for '^WARNING: Potential bindshell installed: infected ports: 600 31337$' 462s WARNING: Potential bindshell installed: infected ports: 600 31337 462s OK 462s **** Test for '^INFECTED: /usr/bin/in\.rexedcs$' 462s INFECTED: /usr/bin/in.rexedcs 462s OK 462s **** Test for '^WARNING: Output from ifpromisc:$' 462s WARNING: Output from ifpromisc: 462s OK 462s **** Test for '^WARNING: Possible 55808 Worm installed$' 462s WARNING: Possible 55808 Worm installed 462s OK 462s **** Test for '^WARNING: Possible Scalper Worm installed$' 462s WARNING: Possible Scalper Worm installed 462s OK 462s **** Test for '^WARNING: Possible Slapper Worm installed:$' 462s WARNING: Possible Slapper Worm installed: 462s OK 462s **** Test for '^/tmp/\.bugtraq\.c \[Not from a Debian package\]$' 462s /tmp/.bugtraq.c [Not from a Debian package] 462s OK 462s ** PASS: Testing: all-tests-can-find-something-02-quiet (chkrootkit -p /tmp/clean -q) done: PASS 462s *** Unexpected (unmatched) lines follow (for info): 462s /usr/lib/modules/6.11.0-8-generic/vdso/.build-id [From Debian package: linux-modules-6.11.0-8-generic] 462s ** Testing: exclude-results-with-minus-e-option (chkrootkit -p /tmp/clean -e /usr/* aliens) ... 462s *** Output 462s ROOTDIR is `/' 462s Checking `aliens'... started 462s Searching for suspicious files in /dev... WARNING 462s 462s WARNING: The following suspicious files were found in /dev: 462s /dev/bad-file 462s 462s Searching for known suspicious directories... WARNING 462s 462s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 462s /var/run/.tmp/ [Not from a Debian package] 462s /var/run/.tmp/y [Not from a Debian package] 462s 462s Searching for known suspicious files... WARNING 462s 462s WARNING: The following known suspicious files were found: 462s /etc/ld.so.hash [Not from a Debian package] 462s 462s Searching for sniffer's logs... WARNING 462s 462s WARNING: The following potential sniffer's logs were found: 462s /tmp/tcp.log [Not from a Debian package] 462s 462s Searching for HiDrootkit rootkit... WARNING 462s 462s WARNING: Possible HiDrootkit rootkit installed: 462s /var/lib/games/.k/ [Not from a Debian package] 462s 462s Searching for t0rn rootkit... WARNING 462s 462s WARNING: Possible t0rn rootkit installed: 462s /etc/ttyhash [Not from a Debian package] 462s 462s Searching for t0rn v8 (or variation)... not found 462s Searching for Lion rootkit... WARNING 462s 462s WARNING: Possible Lion rootkit installed: 462s /bin/mjy [Not from a Debian package] 462s 462s Searching for RSHA rootkit... not found 462s Searching for RH-Sharpe rootkit... WARNING 462s 462s WARNING: Possible RH-Sharpe rootkit installed: 462s /bin/lps [Not from a Debian package] 462s 462s Searching for Ambient (ark) rootkit... not found 462s Searching for suspicious files and dirs... not found 462s Searching for LPD Worm... WARNING 462s 462s WARNING: Possible LPD worm installed (based on files found) 462s 462s Searching for Ramen Worm rootkit... not found 462s Searching for Maniac rootkit... not found 462s Searching for RK17 rootkit... WARNING 462s 462s WARNING: Possible RK17 rootkit installed: 462s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 462s 462s Searching for Ducoci rootkit... WARNING 462s 462s WARNING: Possible Ducoci rootkit installed: 462s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 462s 462s Searching for Adore Worm... not found 462s Searching for ShitC Worm... not found 462s Searching for Omega Worm... WARNING 462s 462s WARNING: Possible Omega Worm installed: 462s /dev/chr [Not from a Debian package] 462s 463s Searching for Sadmind/IIS Worm... WARNING 463s 463s WARNING: Possible Sadmin/IIS Worm installed: 463s /dev/cuc [Not from a Debian package] 463s 463s Searching for MonKit... not found 463s Searching for Showtee rootkit... not found 463s Searching for OpticKit... not found 463s Searching for T.R.K... not found 463s Searching for Mithra rootkit... not found 463s Searching for OBSD rootkit v1... not tested 463s Searching for LOC rootkit... WARNING 463s 463s WARNING: Possible LOC rootkit installed: 463s /tmp/xp [Not from a Debian package] 463s Searching for Romanian rootkit... not found 463s Searching for HKRK rootkit... WARNING 463s 463s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 463s 463s Searching for Suckit rootkit... WARNING 463s 463s WARNING: Possible Suckit: 463s /dev/.golf/ 463s 463s Searching for Volc rootkit... not found 463s Searching for Gold2 rootkit... not found 463s Searching for TC2 rootkit... not found 463s Searching for Anonoying rootkit... not found 463s Searching for ZK rootkit... WARNING 463s 463s WARNING: Possible ZK rootkit installed: 463s /etc/sysconfig/console/load.zk [Not from a Debian package] 463s 463s Searching for ShKit rootkit... WARNING 463s 463s WARNING: Possible ShKit rootkit installed: 463s /etc/ld.so.hash [Not from a Debian package] 463s 463s Searching for AjaKit rootkit... WARNING 463s 463s WARNING: Possible AjaKit rootkit installed: 463s /dev/tux/ [Not from a Debian package] 463s 463s Searching for zaRwT rootkit... WARNING 463s 463s WARNING: Possible zaRwT rootkit installed: 463s /bin/imout [Not from a Debian package] 463s 463s Searching for Madalin rootkit... not found 463s Searching for Fu rootkit... WARNING 463s 463s WARNING: Possible Fu rootkit installed: 463s /sbin/xc [Not from a Debian package] 463s 463s Searching for Kenga3 rootkit... not found 463s Searching for ESRK rootkit... not found 463s Searching for rootedoor... WARNING 463s 463s WARNING: Possible rootedoor installed: 463s /sbin/rootedoor [Not from a Debian package] 463s /sbin/rootedoor [Not from a Debian package] 463s 463s Searching for ENYELKM rootkit... WARNING 463s 463s WARNING: Possible ENYELKM rootkit installed: 463s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 463s 463s Searching for common ssh-scanners... WARNING 463s 463s WARNING: Possible ssh-scanner installed: 463s /var/tmp/vuln.txt [Not from a Debian package] 463s 463s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 463s 463s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 463s 463s Searching for Linux/Ebury 1.6... WARNING 463s 463s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 463s Searching for 64-bit Linux Rootkit... WARNING 463s 463s WARNING: Possible 64-bit Linux Rootkit: 463s /etc/rc.local [Not from a Debian package] 463s 463s Searching for 64-bit Linux Rootkit modules... WARNING 463s 463s WARNING: Possible 64-bit rootkit modules installed: 463s /lib/modules/module_init.ko [Not from a Debian package] 463s 463s Searching for Mumblehard... WARNING 463s 463s WARNING: Possible Mumblehard backdoor installed: 463s /var/spool/cron/crontabs/foo [Not from a Debian package] 463s 463s Searching for Backdoor.Linux.Mokes.a... WARNING 463s 463s WARNING: Possible Backdoor.Linux.Mokes.a installed: 463s /tmp/ss0-0 [Not from a Debian package] 463s 463s Searching for Malicious TinyDNS... WARNING 463s 463s WARNING: Possible Malicious TinyDNS installed: 463s /home/ ./ [Not from a Debian package] 463s /home/ ./tinyDNS [Not from a Debian package] 463s 465s Searching for Linux.Xor.DDoS... WARNING 465s 465s WARNING: Possible Linux.Xor.DDoS installed: 465s /tmp/clean/ps [Not from a Debian package] 465s /tmp/clean/head [Not from a Debian package] 465s /tmp/clean/ls.orig [Not from a Debian package] 465s /tmp/clean/cut [Not from a Debian package] 465s /tmp/clean/ls [Not from a Debian package] 465s /tmp/clean/echo [Not from a Debian package] 465s /tmp/clean/awk [Not from a Debian package] 465s /tmp/clean/grep.orig [Not from a Debian package] 465s /tmp/clean/dpkg-query [Not from a Debian package] 465s /tmp/clean/sed [Not from a Debian package] 465s /tmp/clean/strings [Not from a Debian package] 465s /tmp/clean/netstat [Not from a Debian package] 465s /tmp/clean/uname [Not from a Debian package] 465s /tmp/clean/id [Not from a Debian package] 465s /tmp/clean/grep [Not from a Debian package] 465s /tmp/clean/find [Not from a Debian package] 465s /tmp/clean/dirname [Not from a Debian package] 465s /tmp/clean/xargs [Not from a Debian package] 465s /tmp/clean/ss [Not from a Debian package] 465s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/check_php [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/autopkgtest-reboot [Not from a Debian package] 465s /tmp/autopkgtest.VEUWPF/wrapper.sh [Not from a Debian package] 465s 465s Searching for Linux.Proxy.1.0... WARNING 465s 465s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 465s 465s Searching for CrossRAT... not found 465s Searching for Hidden Cobra... WARNING 465s 465s WARNING: Possible Malicious Hidden Cobra installed: 465s /tmp/.ICE-unix/engine.so [Not from a Debian package] 465s 465s Searching for Rocke Miner rootkit... WARNING 465s 465s WARNING: Possible Rocke Miner rootkit installed: 465s /etc/xig [Not from a Debian package] 465s 465s Searching for PWNLNX4 lkm rootkit... WARNING 465s 465s WARNING: Possible PWNLNX4 lkm rootkit installed: 465s /var/tmp/.1/ [Not from a Debian package] 465s 465s Searching for PWNLNX6 lkm rootkit... WARNING 465s 465s WARNING: Possible PWNLNX6 lkm rootkit installed: 465s /tmp/suterusu/ [Not from a Debian package] 465s 465s Searching for Umbreon lrk... not found 465s Searching for Kinsing.a backdoor rootkit... WARNING 465s 465s WARNING: Possible Kinsing.a backdoor rootkit installed: 465s /tmp/kdevtmpfsi [Not from a Debian package] 465s 465s Searching for RotaJakiro backdoor rootkit... WARNING 465s 465s WARNING: Possible RotaJakiro backdoor rootkit installed: 465s /bin/systemd-daemon [Not from a Debian package] 465s 465s Searching for Syslogk LKM rootkit... WARNING 465s 465s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 465s 465s Searching for Kovid LKM rootkit... WARNING 465s 465s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 465s 465s Searching for Tsunami DDoS Malware rootkit... WARNING 465s 465s WARNING: Possible Tsunami DDoS Malware rootkit installed: 465s /bin/cls [Not from a Debian package] 465s 465s Searching for Linux BPF Door... WARNING 465s 465s WARNING: Possible Linux BPFDoor Malware installed: 465s /proc/xx/stack 465s 465s Searching for suspect PHP files... WARNING 465s 465s WARNING: The following suspicious PHP files were found: 465s /tmp/name.php 465s /tmp/by-content 465s /tmp/sp ace/aaa' exit 1; " 465s 465s Searching for zero-size shell history files in /root... WARNING 465s 465s WARNING: Zero-size history files: 465s /root/.whatever.history [Not from a Debian package] 465s 466s Searching for hardlinked shell history files in /root... WARNING 466s 466s WARNING: shell history files hardlinked to another file: 466s /root/.whatever.history [Not from a Debian package] 466s 466s Checking `aliens'... finished 466s **** Files in log 466s total 44K 466s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 466s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 466s -rw-r--r-- 1 root root 0 Nov 26 20:47 chkrootkit-daily.log 466s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.expected 466s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 466s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 466s *** Test of content of output follows... 466s **** Test for '^ROOTDIR is `/'$' 466s ROOTDIR is `/' 466s OK 466s **** Test for '^Checking `aliens'\.\.\. started$' 466s Checking `aliens'... started 466s OK 466s **** Test for '^Searching for suspicious files in /dev\.\.\. WARNING$' 466s Searching for suspicious files in /dev... WARNING 466s OK 466s **** Test for '^$' 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s 466s OK 466s **** Test for '^WARNING: The following suspicious files were found in /dev:$' 466s WARNING: The following suspicious files were found in /dev: 466s OK 466s **** Test for '^/dev/bad-file$' 466s /dev/bad-file 466s OK 466s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 466s Searching for known suspicious directories... WARNING 466s OK 466s **** Test for '^WARNING: Suspect directory /var/run/\.tmp/ \[Not from a Debian package\] found\. Looking for sniffer logs:$' 466s WARNING: Suspect directory /var/run/.tmp/ [Not from a Debian package] found. Looking for sniffer logs: 466s OK 466s **** Test for '^/var/run/\.tmp/ \[Not from a Debian package\]$' 466s /var/run/.tmp/ [Not from a Debian package] 466s OK 466s **** Test for '^/var/run/\.tmp/y \[Not from a Debian package\]$' 466s /var/run/.tmp/y [Not from a Debian package] 466s OK 466s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 466s Searching for known suspicious files... WARNING 466s OK 466s **** Test for '^WARNING: The following known suspicious files were found:$' 466s WARNING: The following known suspicious files were found: 466s OK 466s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 466s /etc/ld.so.hash [Not from a Debian package] 466s /etc/ld.so.hash [Not from a Debian package] 466s OK 466s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 466s Searching for sniffer's logs... WARNING 466s OK 466s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 466s WARNING: The following potential sniffer's logs were found: 466s OK 466s **** Test for '^/tmp/tcp\.log \[Not from a Debian package\]$' 466s /tmp/tcp.log [Not from a Debian package] 466s OK 466s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 466s Searching for HiDrootkit rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 466s WARNING: Possible HiDrootkit rootkit installed: 466s OK 466s **** Test for '^/var/lib/games/\.k/ \[Not from a Debian package\]$' 466s /var/lib/games/.k/ [Not from a Debian package] 466s OK 466s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 466s Searching for t0rn rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 466s WARNING: Possible t0rn rootkit installed: 466s OK 466s **** Test for '^/etc/ttyhash \[Not from a Debian package\]$' 466s /etc/ttyhash [Not from a Debian package] 466s OK 466s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. not found$' 466s Searching for t0rn v8 (or variation)... not found 466s OK 466s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 466s Searching for Lion rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Lion rootkit installed:$' 466s WARNING: Possible Lion rootkit installed: 466s OK 466s **** Test for '^/bin/mjy \[Not from a Debian package\]$' 466s /bin/mjy [Not from a Debian package] 466s OK 466s **** Test for '^Searching for RSHA rootkit\.\.\. not found$' 466s Searching for RSHA rootkit... not found 466s OK 466s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 466s Searching for RH-Sharpe rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 466s WARNING: Possible RH-Sharpe rootkit installed: 466s OK 466s **** Test for '^/bin/lps \[Not from a Debian package\]$' 466s /bin/lps [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. not found$' 466s Searching for Ambient (ark) rootkit... not found 466s OK 466s **** Test for '^Searching for suspicious files and dirs\.\.\. not found$' 466s Searching for suspicious files and dirs... not found 466s OK 466s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 466s Searching for LPD Worm... WARNING 466s OK 466s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 466s WARNING: Possible LPD worm installed (based on files found) 466s OK 466s **** Test for '^Searching for Ramen Worm rootkit\.\.\. not found$' 466s Searching for Ramen Worm rootkit... not found 466s OK 466s **** Test for '^Searching for Maniac rootkit\.\.\. not found$' 466s Searching for Maniac rootkit... not found 466s OK 466s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 466s Searching for RK17 rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 466s WARNING: Possible RK17 rootkit installed: 466s OK 466s **** Test for '^/www/httpd/cgi-bin/bogus\.cgi \[Not from a Debian package\]$' 466s /www/httpd/cgi-bin/bogus.cgi [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 466s Searching for Ducoci rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 466s WARNING: Possible Ducoci rootkit installed: 466s OK 466s **** Test for '^/www/httpd/cgi-bin/last\.cgi \[Not from a Debian package\]$' 466s /www/httpd/cgi-bin/last.cgi [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Adore Worm\.\.\. not found$' 466s Searching for Adore Worm... not found 466s OK 466s **** Test for '^Searching for ShitC Worm\.\.\. not found$' 466s Searching for ShitC Worm... not found 466s OK 466s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 466s Searching for Omega Worm... WARNING 466s OK 466s **** Test for '^WARNING: Possible Omega Worm installed:$' 466s WARNING: Possible Omega Worm installed: 466s OK 466s **** Test for '^/dev/chr \[Not from a Debian package\]$' 466s /dev/chr [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 466s Searching for Sadmind/IIS Worm... WARNING 466s OK 466s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 466s WARNING: Possible Sadmin/IIS Worm installed: 466s OK 466s **** Test for '^/dev/cuc \[Not from a Debian package\]$' 466s /dev/cuc [Not from a Debian package] 466s OK 466s **** Test for '^Searching for MonKit\.\.\. not found$' 466s Searching for MonKit... not found 466s OK 466s **** Test for '^Searching for Showtee rootkit\.\.\. not found$' 466s Searching for Showtee rootkit... not found 466s OK 466s **** Test for '^Searching for OpticKit\.\.\. not found$' 466s Searching for OpticKit... not found 466s OK 466s **** Test for '^Searching for T\.R\.K\.\.\. not found$' 466s Searching for T.R.K... not found 466s OK 466s **** Test for '^Searching for Mithra rootkit\.\.\. not found$' 466s Searching for Mithra rootkit... not found 466s OK 466s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 466s Searching for OBSD rootkit v1... not tested 466s OK 466s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 466s Searching for LOC rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible LOC rootkit installed:$' 466s WARNING: Possible LOC rootkit installed: 466s OK 466s **** Test for '^/tmp/xp \[Not from a Debian package\]$' 466s /tmp/xp [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Romanian rootkit\.\.\. not found$' 466s Searching for Romanian rootkit... not found 466s OK 466s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 466s Searching for HKRK rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible HKRK rootkit installed in /etc/rc\.d/init\.d/network \[Not from a Debian package\]$' 466s WARNING: Possible HKRK rootkit installed in /etc/rc.d/init.d/network [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 466s Searching for Suckit rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Suckit:$' 466s WARNING: Possible Suckit: 466s OK 466s **** Test for '^/dev/\.golf/$' 466s /dev/.golf/ 466s OK 466s **** Test for '^Searching for Volc rootkit\.\.\. not found$' 466s Searching for Volc rootkit... not found 466s OK 466s **** Test for '^Searching for Gold2 rootkit\.\.\. not found$' 466s Searching for Gold2 rootkit... not found 466s OK 466s **** Test for '^Searching for TC2 rootkit\.\.\. not found$' 466s Searching for TC2 rootkit... not found 466s OK 466s **** Test for '^Searching for Anonoying rootkit\.\.\. not found$' 466s Searching for Anonoying rootkit... not found 466s OK 466s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 466s Searching for ZK rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible ZK rootkit installed:$' 466s WARNING: Possible ZK rootkit installed: 466s OK 466s **** Test for '^/etc/sysconfig/console/load\.zk \[Not from a Debian package\]$' 466s /etc/sysconfig/console/load.zk [Not from a Debian package] 466s OK 466s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 466s Searching for ShKit rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 466s WARNING: Possible ShKit rootkit installed: 466s OK 466s **** Test for '^/etc/ld\.so\.hash \[Not from a Debian package\]$' 466s /etc/ld.so.hash [Not from a Debian package] 466s /etc/ld.so.hash [Not from a Debian package] 466s OK 466s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 466s Searching for AjaKit rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 466s WARNING: Possible AjaKit rootkit installed: 466s OK 466s **** Test for '^/dev/tux/ \[Not from a Debian package\]$' 466s /dev/tux/ [Not from a Debian package] 466s OK 466s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 466s Searching for zaRwT rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 466s WARNING: Possible zaRwT rootkit installed: 466s OK 466s **** Test for '^/bin/imout \[Not from a Debian package\]$' 466s /bin/imout [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Madalin rootkit\.\.\. not found$' 466s Searching for Madalin rootkit... not found 466s OK 466s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 466s Searching for Fu rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Fu rootkit installed:$' 466s WARNING: Possible Fu rootkit installed: 466s OK 466s **** Test for '^/sbin/xc \[Not from a Debian package\]$' 466s /sbin/xc [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Kenga3 rootkit\.\.\. not found$' 466s Searching for Kenga3 rootkit... not found 466s OK 466s **** Test for '^Searching for ESRK rootkit\.\.\. not found$' 466s Searching for ESRK rootkit... not found 466s OK 466s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 466s Searching for rootedoor... WARNING 466s OK 466s **** Test for '^WARNING: Possible rootedoor installed:$' 466s WARNING: Possible rootedoor installed: 466s OK 466s **** Test for '^/sbin/rootedoor \[Not from a Debian package\]$' 466s /sbin/rootedoor [Not from a Debian package] 466s /sbin/rootedoor [Not from a Debian package] 466s OK 466s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 466s Searching for ENYELKM rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 466s WARNING: Possible ENYELKM rootkit installed: 466s OK 466s **** Test for '^/etc/\.enyelkmOCULTAR\.ko/ \[Not from a Debian package\]$' 466s /etc/.enyelkmOCULTAR.ko/ [Not from a Debian package] 466s OK 466s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 466s Searching for common ssh-scanners... WARNING 466s OK 466s **** Test for '^WARNING: Possible ssh-scanner installed:$' 466s WARNING: Possible ssh-scanner installed: 466s OK 466s **** Test for '^/var/tmp/vuln\.txt \[Not from a Debian package\]$' 466s /var/tmp/vuln.txt [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 466s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 466s OK 466s **** Test for '^WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 466s WARNING: /usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 466s OK 466s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 466s Searching for Linux/Ebury 1.6... WARNING 466s OK 466s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils\.so\.1 \[.+\]$' 466s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /lib/x86_64-linux-gnu/libkeyutils.so.1 [Not from a Debian package] 466s OK 466s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 466s Searching for 64-bit Linux Rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 466s WARNING: Possible 64-bit Linux Rootkit: 466s OK 466s **** Test for '^/etc/rc\.local \[Not from a Debian package\]$' 466s /etc/rc.local [Not from a Debian package] 466s OK 466s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 466s Searching for 64-bit Linux Rootkit modules... WARNING 466s OK 466s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 466s WARNING: Possible 64-bit rootkit modules installed: 466s OK 466s **** Test for '^/lib/modules/module_init\.ko \[Not from a Debian package\]$' 466s /lib/modules/module_init.ko [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 466s Searching for Mumblehard... WARNING 466s OK 466s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 466s WARNING: Possible Mumblehard backdoor installed: 466s OK 466s **** Test for '^/var/spool/cron/crontabs/foo \[Not from a Debian package\]$' 466s /var/spool/cron/crontabs/foo [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 466s Searching for Backdoor.Linux.Mokes.a... WARNING 466s OK 466s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 466s WARNING: Possible Backdoor.Linux.Mokes.a installed: 466s OK 466s **** Test for '^/tmp/ss0-0 \[Not from a Debian package\]$' 466s /tmp/ss0-0 [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 466s Searching for Malicious TinyDNS... WARNING 466s OK 466s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 466s WARNING: Possible Malicious TinyDNS installed: 466s OK 466s **** Test for '^/home/ \./ \[Not from a Debian package\]$' 466s /home/ ./ [Not from a Debian package] 466s OK 466s **** Test for '^/home/ \./tinyDNS \[Not from a Debian package\]$' 466s /home/ ./tinyDNS [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 466s Searching for Linux.Xor.DDoS... WARNING 466s OK 466s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 466s WARNING: Possible Linux.Xor.DDoS installed: 466s OK 466s **** Test for '^/tmp/clean/strings \[Not from a Debian package\]$' 466s /tmp/clean/strings [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/uname \[Not from a Debian package\]$' 466s /tmp/clean/uname [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/head \[Not from a Debian package\]$' 466s /tmp/clean/head [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/find \[Not from a Debian package\]$' 466s /tmp/clean/find [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/echo \[Not from a Debian package\]$' 466s /tmp/clean/echo [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/netstat \[Not from a Debian package\]$' 466s /tmp/clean/netstat [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/ls \[Not from a Debian package\]$' 466s /tmp/clean/ls [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/ls\.orig \[Not from a Debian package\]$' 466s /tmp/clean/ls.orig [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/ps \[Not from a Debian package\]$' 466s /tmp/clean/ps [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/awk \[Not from a Debian package\]$' 466s /tmp/clean/awk [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/grep \[Not from a Debian package\]$' 466s /tmp/clean/grep [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/grep\.orig \[Not from a Debian package\]$' 466s /tmp/clean/grep.orig [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/dirname \[Not from a Debian package\]$' 466s /tmp/clean/dirname [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/ss \[Not from a Debian package\]$' 466s /tmp/clean/ss [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/sed \[Not from a Debian package\]$' 466s /tmp/clean/sed [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/cut \[Not from a Debian package\]$' 466s /tmp/clean/cut [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/id \[Not from a Debian package\]$' 466s /tmp/clean/id [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/xargs \[Not from a Debian package\]$' 466s /tmp/clean/xargs [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/clean/dpkg-query \[Not from a Debian package\]$' 466s /tmp/clean/dpkg-query [Not from a Debian package] 466s OK 466s **** Test for '^/tmp/test-chkrootkit-false-positive \[Not from a Debian package\]$' 466s /tmp/test-chkrootkit-false-positive [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 466s Searching for Linux.Proxy.1.0... WARNING 466s OK 466s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 466s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 466s OK 466s **** Test for '^Searching for CrossRAT\.\.\. not found$' 466s Searching for CrossRAT... not found 466s OK 466s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 466s Searching for Hidden Cobra... WARNING 466s OK 466s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 466s WARNING: Possible Malicious Hidden Cobra installed: 466s OK 466s **** Test for '^/tmp/\.ICE-unix/engine\.so \[Not from a Debian package\]$' 466s /tmp/.ICE-unix/engine.so [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 466s Searching for Rocke Miner rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 466s WARNING: Possible Rocke Miner rootkit installed: 466s OK 466s **** Test for '^/etc/xig \[Not from a Debian package\]$' 466s /etc/xig [Not from a Debian package] 466s OK 466s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 466s Searching for PWNLNX4 lkm rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 466s WARNING: Possible PWNLNX4 lkm rootkit installed: 466s OK 466s **** Test for '^/var/tmp/\.1/ \[Not from a Debian package\]$' 466s /var/tmp/.1/ [Not from a Debian package] 466s OK 466s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 466s Searching for PWNLNX6 lkm rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 466s WARNING: Possible PWNLNX6 lkm rootkit installed: 466s OK 466s **** Test for '^/tmp/suterusu/ \[Not from a Debian package\]$' 466s /tmp/suterusu/ [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Umbreon lrk\.\.\. not found$' 466s Searching for Umbreon lrk... not found 466s OK 466s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 466s Searching for Kinsing.a backdoor rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 466s WARNING: Possible Kinsing.a backdoor rootkit installed: 466s OK 466s **** Test for '^/tmp/kdevtmpfsi \[Not from a Debian package\]$' 466s /tmp/kdevtmpfsi [Not from a Debian package] 466s OK 466s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 466s Searching for RotaJakiro backdoor rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 466s WARNING: Possible RotaJakiro backdoor rootkit installed: 466s OK 466s **** Test for '^/bin/systemd-daemon \[Not from a Debian package\]$' 466s /bin/systemd-daemon [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. WARNING$' 466s Searching for Syslogk LKM rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk$' 466s WARNING: Possible Malicious Syslogk LKM rootkit installed: /proc/syslogk 466s OK 466s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 466s Searching for Kovid LKM rootkit... WARNING 466s OK 466s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid$' 466s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /proc/kovid 466s OK 466s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 466s Searching for Tsunami DDoS Malware rootkit... WARNING 466s OK 466s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 466s WARNING: Possible Tsunami DDoS Malware rootkit installed: 466s OK 466s **** Test for '^/bin/cls \[Not from a Debian package\]$' 466s /bin/cls [Not from a Debian package] 466s OK 466s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 466s Searching for Linux BPF Door... WARNING 466s OK 466s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 466s WARNING: Possible Linux BPFDoor Malware installed: 466s OK 466s **** Test for '^/proc/xx/stack$' 466s /proc/xx/stack 466s OK 466s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 466s Searching for suspect PHP files... WARNING 466s OK 466s **** Test for '^WARNING: The following suspicious PHP files were found:$' 466s WARNING: The following suspicious PHP files were found: 466s OK 466s **** Test for '^/tmp/name\.php$' 466s /tmp/name.php 466s OK 466s **** Test for '^/tmp/sp ace/aaa' exit 1; "$' 466s /tmp/sp ace/aaa' exit 1; " 466s OK 466s **** Test for '^/tmp/by-content$' 466s /tmp/by-content 466s OK 466s **** Test for '^Searching for zero-size shell history files in /root\.\.\. WARNING$' 466s Searching for zero-size shell history files in /root... WARNING 466s OK 466s **** Test for '^WARNING: Zero-size history files:$' 466s WARNING: Zero-size history files: 466s OK 466s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 466s /root/.whatever.history [Not from a Debian package] 466s /root/.whatever.history [Not from a Debian package] 466s OK 466s **** Test for '^Searching for hardlinked shell history files in /root\.\.\. WARNING$' 466s Searching for hardlinked shell history files in /root... WARNING 466s OK 466s **** Test for '^WARNING: shell history files hardlinked to another file:$' 466s WARNING: shell history files hardlinked to another file: 466s OK 466s **** Test for '^/root/\.whatever\.history \[Not from a Debian package\]$' 466s /root/.whatever.history [Not from a Debian package] 466s /root/.whatever.history [Not from a Debian package] 466s OK 466s **** Test for '^Checking `aliens'\.\.\. finished$' 466s Checking `aliens'... finished 466s OK 466s ** PASS: Testing: exclude-results-with-minus-e-option (chkrootkit -p /tmp/clean -e /usr/* aliens) done: PASS 466s * Testing the -r option 466s Symlink ROOT_DIR created: /tmp/CHKROOTKIT_ROOT 466s lrwxrwxrwx 1 root root 1 Nov 26 20:47 /tmp/CHKROOTKIT_ROOT -> / 466s ** Testing: setting-rootdir (chkrootkit -p /tmp/clean -r /tmp/CHKROOTKIT_ROOT) ... 466s *** Output 466s ROOTDIR is `/tmp/CHKROOTKIT_ROOT/' 466s Checking `amd'... INFECTED 466s Checking `basename'... INFECTED 466s Checking `biff'... INFECTED 466s Checking `chfn'... INFECTED 466s Checking `chsh'... INFECTED 466s Checking `cron'... INFECTED 466s Checking `crontab'... WARNING 466s WARNING: crontab for nobody found, possible Lupper.Worm. 466s Checking for Lupper.Worm... INFECTED 466s Checking `date'... INFECTED 466s Checking `du'... INFECTED 466s Checking `dirname'... INFECTED 466s Checking `echo'... INFECTED 466s Checking `egrep'... INFECTED 466s Checking `env'... INFECTED 466s Checking `find'... INFECTED 466s Checking `fingerd'... INFECTED 466s Checking `gpm'... INFECTED 466s Checking `grep'... INFECTED 466s Checking `hdparm'... INFECTED 466s Checking `su'... INFECTED 466s Checking `ifconfig'... INFECTED 466s Checking `inetd'... INFECTED 466s Checking `inetdconf'... INFECTED 466s Checking `identd'... INFECTED 466s Checking `init'... INFECTED 466s Checking `killall'... INFECTED 466s Checking `ldsopreload'... not infected 466s Checking `login'... INFECTED 466s Checking `ls'... INFECTED 466s Checking `lsof'... INFECTED 466s Checking `mail'... INFECTED 466s Checking `mingetty'... INFECTED 466s Checking `netstat'... INFECTED 466s Checking `named'... INFECTED 466s Checking `passwd'... INFECTED 466s Checking `pidof'... INFECTED 466s Checking `pop2'... INFECTED 466s Checking `pop3'... INFECTED 466s Checking `ps'... INFECTED 466s Checking `pstree'... INFECTED 466s Checking `rpcinfo'... INFECTED 466s Checking `rlogind'... INFECTED 466s Checking `rshd'... INFECTED 466s Checking `slogin'... INFECTED 466s Checking `sendmail'... INFECTED 466s Checking `sshd'... INFECTED but disabled 466s Checking `syslogd'... INFECTED 466s Checking `tar'... INFECTED 466s Checking `tcpd'... INFECTED 466s Checking `tcpdump'... INFECTED 466s Checking `top'... INFECTED 466s Checking `telnetd'... INFECTED 466s Checking `timed'... INFECTED 466s Checking `traceroute'... INFECTED 466s Checking `vdir'... INFECTED 466s Checking `w'... INFECTED 466s Checking `write'... INFECTED 466s Checking `aliens'... started 466s Searching for suspicious files in /tmp/CHKROOTKIT_ROOT/dev... WARNING 466s 466s WARNING: The following suspicious files were found in /tmp/CHKROOTKIT_ROOT/dev: 466s /tmp/CHKROOTKIT_ROOT/dev/bad-file 466s 466s Searching for known suspicious directories... WARNING 466s 466s WARNING: Suspect directory /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ found. Looking for sniffer logs: 466s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ 466s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/y 466s 466s Searching for known suspicious files... WARNING 466s 466s WARNING: The following known suspicious files were found: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/atm 466s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 466s 466s Searching for sniffer's logs... WARNING 466s 466s WARNING: The following potential sniffer's logs were found: 466s /tmp/CHKROOTKIT_ROOT/tmp/tcp.log 466s 466s Searching for HiDrootkit rootkit... WARNING 466s 466s WARNING: Possible HiDrootkit rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/var/lib/games/.k/ 466s 466s Searching for t0rn rootkit... WARNING 466s 466s WARNING: Possible t0rn rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/etc/ttyhash 466s 466s Searching for t0rn v8 (or variation)... WARNING 466s 466s WARNING: Possible t0rn v8 (or variation) rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/local/lib/libproc.a 466s 466s Searching for Lion rootkit... WARNING 466s 466s WARNING: Possible Lion rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/bin/mjy 466s 466s Searching for RSHA rootkit... WARNING 466s 466s WARNING: Possible RSHA rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/n3tstat 466s 466s Searching for RH-Sharpe rootkit... WARNING 466s 466s WARNING: Possible RH-Sharpe rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/bin/lps 466s 466s Searching for Ambient (ark) rootkit... WARNING 466s 466s WARNING: Possible Ambient's rootkit (ark) installed: 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 466s 466s Searching for suspicious files and dirs... WARNING 466s 466s WARNING: The following suspicious files and directories were found: 466s /tmp/CHKROOTKIT_ROOT/usr/lib/... 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.aaa 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.1 466s /tmp/CHKROOTKIT_ROOT/usr/lib/modules/6.11.0-8-generic/vdso/.build-id 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.bbb 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.1DIR 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.DIR-aaa 466s /tmp/CHKROOTKIT_ROOT/usr/lib/...DIR 466s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 466s 466s Searching for LPD Worm... WARNING 466s 466s WARNING: Possible LPD worm installed (based on files found) 466s 466s Searching for Ramen Worm rootkit... WARNING 466s 466s WARNING: Possible Ramen Worm rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/src/.poop/ 466s 466s Searching for Maniac rootkit... WARNING 466s 466s WARNING: Possible Maniac rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/mailrc 466s 466s Searching for RK17 rootkit... WARNING 466s 466s WARNING: Possible RK17 rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus.cgi 466s /tmp/CHKROOTKIT_ROOT/usr/lib/number.cgi 466s 466s Searching for Ducoci rootkit... WARNING 466s 466s WARNING: Possible Ducoci rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last.cgi 466s 466s Searching for Adore Worm... WARNING 466s 466s WARNING: Possible Adore Worm installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/red.tar 466s 466s Searching for ShitC Worm... WARNING 466s 466s WARNING: Possible ShitC Worm installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/dy 466s /tmp/CHKROOTKIT_ROOT/usr/bin/frgy 466s 466s Searching for Omega Worm... WARNING 466s 466s WARNING: Possible Omega Worm installed: 466s /tmp/CHKROOTKIT_ROOT/dev/chr 466s 466s Searching for Sadmind/IIS Worm... WARNING 466s 466s WARNING: Possible Sadmin/IIS Worm installed: 466s /tmp/CHKROOTKIT_ROOT/dev/cuc 466s 466s Searching for MonKit... WARNING 466s 466s WARNING: Possible MonKit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/lib/libpikapp.a 466s 466s Searching for Showtee rootkit... WARNING 466s 466s WARNING: Possible Showtee rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 466s /tmp/CHKROOTKIT_ROOT/usr/include/chk.h 466s 466s Searching for OpticKit... WARNING 466s 466s WARNING: Possible OpticKit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 466s 466s Searching for T.R.K... WARNING 466s 466s WARNING: Possible T.R.K installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 466s 466s Searching for Mithra rootkit... WARNING 466s 466s WARNING: Possible Mithra installed: 466s /tmp/CHKROOTKIT_ROOT/usr/lib/locale/uboot 466s 466s Searching for OBSD rootkit v1... not tested 466s Searching for LOC rootkit... WARNING 466s 466s WARNING: Possible LOC rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/xp 466s /tmp/CHKROOTKIT_ROOT/usr/sbin/epic 466s Searching for Romanian rootkit... WARNING 466s 466s WARNING: Possible Romanian rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 466s 466s Searching for HKRK rootkit... WARNING 466s 466s WARNING: Possible HKRK rootkit installed in /tmp/CHKROOTKIT_ROOT/etc/rc.d/init.d/network 466s 466s Searching for Suckit rootkit... WARNING 466s 466s WARNING: Possible Suckit: 466s /tmp/CHKROOTKIT_ROOT/dev/.golf/ 466s 466s Searching for Volc rootkit... WARNING 466s 466s WARNING: Possible Volc rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/volc 466s 466s Searching for Gold2 rootkit... WARNING 466s 466s WARNING: Possible Gold2 rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/bin/ishit 466s 466s Searching for TC2 rootkit... WARNING 466s 466s WARNING: Possible TC2 rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/sbin/initcheck 466s 466s Searching for Anonoying rootkit... WARNING 466s 466s WARNING: Possible Anonoying rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/sbin/mech 466s 466s Searching for ZK rootkit... WARNING 466s 466s WARNING: Possible ZK rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/etc/sysconfig/console/load.zk 466s 466s Searching for ShKit rootkit... WARNING 466s 466s WARNING: Possible ShKit rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 466s 466s Searching for AjaKit rootkit... WARNING 466s 466s WARNING: Possible AjaKit rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/dev/tux/ 466s 466s Searching for zaRwT rootkit... WARNING 466s 466s WARNING: Possible zaRwT rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/bin/imout 466s 466s Searching for Madalin rootkit... WARNING 466s 466s WARNING: Possible Madalin rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/include/icekey.h 466s 466s Searching for Fu rootkit... WARNING 466s 466s WARNING: Possible Fu rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/sbin/xc 466s 466s Searching for Kenga3 rootkit... WARNING 466s 466s WARNING: Possible Kenga3 rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/include/. ./ 466s /tmp/CHKROOTKIT_ROOT/usr/include/. ./foo 466s 466s Searching for ESRK rootkit... WARNING 466s 466s WARNING: Possible ESRK rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/usr/lib/tcl5.3/ 466s 466s Searching for rootedoor... WARNING 466s 466s WARNING: Possible rootedoor installed: 466s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 466s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 466s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 466s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 466s 466s Searching for ENYELKM rootkit... WARNING 466s 466s WARNING: Possible ENYELKM rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/etc/.enyelkmOCULTAR.ko/ 466s 466s Searching for common ssh-scanners... WARNING 466s 466s WARNING: Possible ssh-scanner installed: 466s /tmp/CHKROOTKIT_ROOT/var/tmp/vuln.txt 466s 466s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 466s 466s WARNING: /tmp/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 466s 466s Searching for Linux/Ebury 1.6... WARNING 466s 466s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /tmp/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils.so.1 466s Searching for 64-bit Linux Rootkit... WARNING 466s 466s WARNING: Possible 64-bit Linux Rootkit: 466s /tmp/CHKROOTKIT_ROOT/usr/local/hide/ 466s /tmp/CHKROOTKIT_ROOT/usr/local/hide/foo 466s /tmp/CHKROOTKIT_ROOT/etc/rc.local 466s 466s Searching for 64-bit Linux Rootkit modules... WARNING 466s 466s WARNING: Possible 64-bit rootkit modules installed: 466s /tmp/CHKROOTKIT_ROOT/lib/modules/module_init.ko 466s 466s Searching for Mumblehard... WARNING 466s 466s WARNING: Possible Mumblehard backdoor installed: 466s /tmp/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo 466s 466s Searching for Backdoor.Linux.Mokes.a... WARNING 466s 466s WARNING: Possible Backdoor.Linux.Mokes.a installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/ss0-0 466s 466s Searching for Malicious TinyDNS... WARNING 466s 466s WARNING: Possible Malicious TinyDNS installed: 466s /tmp/CHKROOTKIT_ROOT/home/ ./ 466s /tmp/CHKROOTKIT_ROOT/home/ ./tinyDNS 466s 466s Searching for Linux.Xor.DDoS... WARNING 466s 466s WARNING: Possible Linux.Xor.DDoS installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/ps 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/head 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls.orig 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/cut 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/echo 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/awk 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep.orig 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/dpkg-query 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/sed 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/strings 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/netstat 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/uname 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/id 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/find 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/dirname 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/xargs 466s /tmp/CHKROOTKIT_ROOT/tmp/clean/ss 466s /tmp/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/debian/rules 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/debian/chkrootkit-daily 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/test-chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/debian/tests/find-debs-that-are-enhanced 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/84_chkrootkit-simplify-chk_inetdconf.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-minor-fixup.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/75_chkrootkit-More-instances-where-x-should-be-x.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-BPFDoor-work-with-r.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-test-for-.history-files-work-with-r.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-wted-and-chkutmp-skip-if-no-utmp-wtmp-files.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/60_chkrootkit-Improve-output-of-sniffer-and-make-rexedcs-give-some-output-if-infected.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Use-e-on-more-tests.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Make-e-apply-to-tests-using-find.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/85_chkrootkit-Also-redirect-stderr-from-grep-to-dev-null.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-skip-test-for-syslogk-when-r-given.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/58_chkrootkit-improve-output.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/87b_chkrootkit-Do-not-issue-a-WARNING-if-sniffer-ifpromisc-fi.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/61_chkrootkit-Prevent-hanging-in-an-lxc-container.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/63_chkrootkit-Make-the-T.R.K-test-capable-of-finding-anything.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Better-error-messages.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Skip-chkutmp-if-utmp-does-not-exist.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-more-better-error-messages.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/62_chkrootkit-Prevent-warnings-when-running-in-an-lxc-container.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/06_quiet.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/74_chkrootkit-Make-chkutmp-should-support-p.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/65_chkrootkit-comment-out-use-of-kill-SIGCONT-31337.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/17_Suckitfalse.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/77_chkrootkit-fix-syntax-error-in-test-for-64-bit-modules.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-rootedir-check-when-r-set.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/83_chkrotkit-Clarify-output-from-other-TOOLS.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-allow-chkdirs-to-be-used-with-r.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/66_chkrootkit-Make-output-consistent.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-improve-chkutmp-output-when-r-given.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/56_chkrootkit-Fix-logic-so-that-sshd-test-runs.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/03_linedup_reports.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/70_chkrootkit-fix-chk_date.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-check-reported-files-using-dpkg-query.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/67_chkrootkit-ensure-only-one-argument-passed-to-expertmode_.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-most-shellcheck-issues.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/82_chkrootkit-clarify-output-from-lkm-test.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/86_chkrootkit-usrmerge-fix.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-for-syslogk-test.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/64_chkrootkit-Define-egrep-later-to-support-p.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/02_workingdir.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/80_chkrootkit-make-output-consistent-aliens.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/09_excludes.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/21_fix_loc_function.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/08_unidentified.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-relative-dirs-in-PATH.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/19_openssh.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/71_chkrootkit-use-grep-not-grep-in-tests.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/25_chkrootkit-Add-s-option-to-filter-ifpromisc-output.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/24_ser2net_exception_in_scalper.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/04_backslashes.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/16_php.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/78_chkrootkit-fix-test-for-ebury-1.6.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/73_chkrootkit-fix-netstat-and-ss-tests.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/68_checkrootkit-use-ROOTDIR-consistently.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Allow-running-as-non-root.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-incomplete-fix-for-ldsopreload.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-Fix-output-from-HKRK-if-r-set.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/72_chkrootkit-ensure-ssh-is-set-before-testing-for-windigo-e.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/26_improve-info-help-display.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/59_chkrootkit-Remove-duplicate-entries-from-check-of-suspicious-files.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/chkrootkit-fix-bug-if-chkdirs-has-nothing-to-check.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/13_exitcode.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/53_chkrootkit-remove-trailing-whitespace.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/81_chkrootkit-add-missing-braces-in-bindshell-test.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/69_chkrootkit-fix-syntax-errors-in-chk_login.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/.pc/54_chkrootkit-Remove-trailing-space-in-windigo-not-found-message.patch/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/check_if_debian 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/check_php 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/build.ezA/src/chkrootkit 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/autopkgtest-reboot-prepare 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/autopkgtest-reboot 466s /tmp/CHKROOTKIT_ROOT/tmp/autopkgtest.VEUWPF/wrapper.sh 466s 466s Searching for Linux.Proxy.1.0... WARNING 466s 466s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 466s 466s Searching for CrossRAT... WARNING 466s 466s WARNING: Possible Malicious CrossRAT installed: 466s /tmp/CHKROOTKIT_ROOT/usr/var/mediamgrs.jar 466s 466s Searching for Hidden Cobra... WARNING 466s 466s WARNING: Possible Malicious Hidden Cobra installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/.ICE-unix/engine.so 466s 466s Searching for Rocke Miner rootkit... WARNING 466s 466s WARNING: Possible Rocke Miner rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/etc/xig 466s 466s Searching for PWNLNX4 lkm rootkit... WARNING 466s 466s WARNING: Possible PWNLNX4 lkm rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/var/tmp/.1/ 466s 466s Searching for PWNLNX6 lkm rootkit... WARNING 466s 466s WARNING: Possible PWNLNX6 lkm rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/suterusu/ 466s 466s Searching for Umbreon lrk... WARNING 466s 466s WARNING: Possible Malicious UMBREON LRK installed: 466s /tmp/CHKROOTKIT_ROOT/usr/share/libc.so.69 466s 466s Searching for Kinsing.a backdoor rootkit... WARNING 466s 466s WARNING: Possible Kinsing.a backdoor rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/tmp/kdevtmpfsi 466s 466s Searching for RotaJakiro backdoor rootkit... WARNING 466s 466s WARNING: Possible RotaJakiro backdoor rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/bin/systemd-daemon 466s 466s Searching for Syslogk LKM rootkit... not tested 466s Searching for Kovid LKM rootkit... WARNING 466s 466s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /tmp/CHKROOTKIT_ROOT/proc/kovid 466s 466s Searching for Tsunami DDoS Malware rootkit... WARNING 466s 466s WARNING: Possible Tsunami DDoS Malware rootkit installed: 466s /tmp/CHKROOTKIT_ROOT/bin/cls 466s 466s Searching for Linux BPF Door... WARNING 466s 466s WARNING: Possible Linux BPFDoor Malware installed: 466s /proc/xx/stack 466s 467s Searching for suspect PHP files... WARNING 467s 467s WARNING: The following suspicious PHP files were found: 467s /tmp/CHKROOTKIT_ROOT/tmp/name.php 467s /tmp/CHKROOTKIT_ROOT/tmp/by-content 467s /tmp/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; " 467s 467s Searching for zero-size shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 467s 467s WARNING: Zero-size history files: 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s 467s Searching for hardlinked shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 467s 467s WARNING: shell history files hardlinked to another file: 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s 467s Checking `aliens'... finished 467s Checking `asp'... WARNING 467s 467s WARNING: Possible Ramen Worm installed in /tmp/CHKROOTKIT_ROOT/etc/inetd.conf 467s 467s Checking `bindshell'... not tested 467s Checking `lkm'... started 467s Searching for Adore LKM... not tested 467s Searching for sebek LKM (Adore based)... not tested 467s Searching for knark LKM rootkit... not found 467s Searching for for hidden processes with chkproc... not tested 467s Searching for for hidden directories using chkdirs... not found 467s Checking `lkm'... finished 467s Checking `rexedcs'... INFECTED: /tmp/CHKROOTKIT_ROOT/usr/bin/in.rexedcs 467s Checking `sniffer'... not tested 467s Checking `w55808'... WARNING 467s 467s WARNING: Possible 55808 Worm installed 467s 467s Checking `wted'... not found 467s Checking `scalper'... WARNING 467s 467s WARNING: Possible Scalper Worm installed 467s 467s Checking `slapper'... WARNING 467s 467s WARNING: Possible Slapper Worm installed: 467s /tmp/CHKROOTKIT_ROOT/tmp/.bugtraq.c 467s 467s Checking `z2'... not found 467s Checking `chkutmp'... not tested 467s Checking `OSX_RSPLUG'... not tested 467s **** Files in log 467s total 44K 467s drwxr-xr-x 2 root root 4.0K Nov 26 20:47 . 467s drwxrwxr-x 8 root syslog 4.0K Nov 26 20:43 .. 467s -rw-r--r-- 1 root root 0 Nov 26 20:47 chkrootkit-daily.log 467s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.expected 467s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today 467s -rw-r--r-- 1 root root 11K Nov 26 20:47 log.today.raw 467s *** Test of content of output follows... 467s **** Test for '^ROOTDIR is `/[^ ]+/CHKROOTKIT_ROOT/'$' 467s ROOTDIR is `/tmp/CHKROOTKIT_ROOT/' 467s OK 467s **** Test for '^Checking `amd'\.\.\. INFECTED$' 467s Checking `amd'... INFECTED 467s OK 467s **** Test for '^Checking `basename'\.\.\. INFECTED$' 467s Checking `basename'... INFECTED 467s OK 467s **** Test for '^Checking `biff'\.\.\. INFECTED$' 467s Checking `biff'... INFECTED 467s OK 467s **** Test for '^Checking `chfn'\.\.\. INFECTED$' 467s Checking `chfn'... INFECTED 467s OK 467s **** Test for '^Checking `chsh'\.\.\. INFECTED$' 467s Checking `chsh'... INFECTED 467s OK 467s **** Test for '^Checking `cron'\.\.\. INFECTED$' 467s Checking `cron'... INFECTED 467s OK 467s **** Test for '^Checking `crontab'\.\.\. WARNING$' 467s Checking `crontab'... WARNING 467s OK 467s **** Test for '^$' 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s 467s OK 467s **** Test for '^WARNING: crontab for nobody found, possible Lupper\.Worm\.$' 467s WARNING: crontab for nobody found, possible Lupper.Worm. 467s OK 467s **** Test for '^Checking for Lupper\.Worm\.\.\. INFECTED$' 467s Checking for Lupper.Worm... INFECTED 467s OK 467s **** Test for '^Checking `date'\.\.\. INFECTED$' 467s Checking `date'... INFECTED 467s OK 467s **** Test for '^Checking `du'\.\.\. INFECTED$' 467s Checking `du'... INFECTED 467s OK 467s **** Test for '^Checking `dirname'\.\.\. INFECTED$' 467s Checking `dirname'... INFECTED 467s OK 467s **** Test for '^Checking `echo'\.\.\. INFECTED$' 467s Checking `echo'... INFECTED 467s OK 467s **** Test for '^Checking `egrep'\.\.\. INFECTED$' 467s Checking `egrep'... INFECTED 467s OK 467s **** Test for '^Checking `env'\.\.\. INFECTED$' 467s Checking `env'... INFECTED 467s OK 467s **** Test for '^Checking `find'\.\.\. INFECTED$' 467s Checking `find'... INFECTED 467s OK 467s **** Test for '^Checking `fingerd'\.\.\. INFECTED$' 467s Checking `fingerd'... INFECTED 467s OK 467s **** Test for '^Checking `gpm'\.\.\. INFECTED$' 467s Checking `gpm'... INFECTED 467s OK 467s **** Test for '^Checking `grep'\.\.\. INFECTED$' 467s Checking `grep'... INFECTED 467s OK 467s **** Test for '^Checking `hdparm'\.\.\. INFECTED$' 467s Checking `hdparm'... INFECTED 467s OK 467s **** Test for '^Checking `su'\.\.\. INFECTED$' 467s Checking `su'... INFECTED 467s OK 467s **** Test for '^Checking `ifconfig'\.\.\. INFECTED$' 467s Checking `ifconfig'... INFECTED 467s OK 467s **** Test for '^Checking `inetd'\.\.\. INFECTED$' 467s Checking `inetd'... INFECTED 467s OK 467s **** Test for '^Checking `inetdconf'\.\.\. INFECTED$' 467s Checking `inetdconf'... INFECTED 467s OK 467s **** Test for '^Checking `identd'\.\.\. INFECTED$' 467s Checking `identd'... INFECTED 467s OK 467s **** Test for '^Checking `init'\.\.\. INFECTED$' 467s Checking `init'... INFECTED 467s OK 467s **** Test for '^Checking `killall'\.\.\. INFECTED$' 467s Checking `killall'... INFECTED 467s OK 467s **** Test for '^Checking `ldsopreload'\.\.\. not infected$' 467s Checking `ldsopreload'... not infected 467s OK 467s **** Test for '^Checking `login'\.\.\. INFECTED$' 467s Checking `login'... INFECTED 467s OK 467s **** Test for '^Checking `ls'\.\.\. INFECTED$' 467s Checking `ls'... INFECTED 467s OK 467s **** Test for '^Checking `lsof'\.\.\. INFECTED$' 467s Checking `lsof'... INFECTED 467s OK 467s **** Test for '^Checking `mail'\.\.\. INFECTED$' 467s Checking `mail'... INFECTED 467s OK 467s **** Test for '^Checking `mingetty'\.\.\. INFECTED$' 467s Checking `mingetty'... INFECTED 467s OK 467s **** Test for '^Checking `netstat'\.\.\. INFECTED$' 467s Checking `netstat'... INFECTED 467s OK 467s **** Test for '^Checking `named'\.\.\. INFECTED$' 467s Checking `named'... INFECTED 467s OK 467s **** Test for '^Checking `passwd'\.\.\. INFECTED$' 467s Checking `passwd'... INFECTED 467s OK 467s **** Test for '^Checking `pidof'\.\.\. INFECTED$' 467s Checking `pidof'... INFECTED 467s OK 467s **** Test for '^Checking `pop2'\.\.\. INFECTED$' 467s Checking `pop2'... INFECTED 467s OK 467s **** Test for '^Checking `pop3'\.\.\. INFECTED$' 467s Checking `pop3'... INFECTED 467s OK 467s **** Test for '^Checking `ps'\.\.\. INFECTED$' 467s Checking `ps'... INFECTED 467s OK 467s **** Test for '^Checking `pstree'\.\.\. INFECTED$' 467s Checking `pstree'... INFECTED 467s OK 467s **** Test for '^Checking `rpcinfo'\.\.\. INFECTED$' 467s Checking `rpcinfo'... INFECTED 467s OK 467s **** Test for '^Checking `rlogind'\.\.\. INFECTED$' 467s Checking `rlogind'... INFECTED 467s OK 467s **** Test for '^Checking `rshd'\.\.\. INFECTED$' 467s Checking `rshd'... INFECTED 467s OK 467s **** Test for '^Checking `slogin'\.\.\. INFECTED$' 467s Checking `slogin'... INFECTED 467s OK 467s **** Test for '^Checking `sendmail'\.\.\. INFECTED$' 467s Checking `sendmail'... INFECTED 467s OK 467s **** Test for '^Checking `sshd'\.\.\. INFECTED but disabled$' 467s Checking `sshd'... INFECTED but disabled 467s OK 467s **** Test for '^Checking `syslogd'\.\.\. INFECTED$' 467s Checking `syslogd'... INFECTED 467s OK 467s **** Test for '^Checking `tar'\.\.\. INFECTED$' 467s Checking `tar'... INFECTED 467s OK 467s **** Test for '^Checking `tcpd'\.\.\. INFECTED$' 467s Checking `tcpd'... INFECTED 467s OK 467s **** Test for '^Checking `tcpdump'\.\.\. INFECTED$' 467s Checking `tcpdump'... INFECTED 467s OK 467s **** Test for '^Checking `top'\.\.\. INFECTED$' 467s Checking `top'... INFECTED 467s OK 467s **** Test for '^Checking `telnetd'\.\.\. INFECTED$' 467s Checking `telnetd'... INFECTED 467s OK 467s **** Test for '^Checking `timed'\.\.\. INFECTED$' 467s Checking `timed'... INFECTED 467s OK 467s **** Test for '^Checking `traceroute'\.\.\. INFECTED$' 467s Checking `traceroute'... INFECTED 467s OK 467s **** Test for '^Checking `vdir'\.\.\. INFECTED$' 467s Checking `vdir'... INFECTED 467s OK 467s **** Test for '^Checking `w'\.\.\. INFECTED$' 467s Checking `w'... INFECTED 467s OK 467s **** Test for '^Checking `write'\.\.\. INFECTED$' 467s Checking `write'... INFECTED 467s OK 467s **** Test for '^Checking `aliens'\.\.\. started$' 467s Checking `aliens'... started 467s OK 467s **** Test for '^Searching for suspicious files in /[^ ]+/CHKROOTKIT_ROOT/dev\.\.\. +WARNING$' 467s Searching for suspicious files in /tmp/CHKROOTKIT_ROOT/dev... WARNING 467s OK 467s **** Test for '^WARNING: The following suspicious files were found in /[^ ]+/CHKROOTKIT_ROOT/dev:$' 467s WARNING: The following suspicious files were found in /tmp/CHKROOTKIT_ROOT/dev: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/bad-file$' 467s /tmp/CHKROOTKIT_ROOT/dev/bad-file 467s OK 467s **** Test for '^Searching for known suspicious directories\.\.\. WARNING$' 467s Searching for known suspicious directories... WARNING 467s OK 467s **** Test for '^WARNING: Suspect directory /[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/ found\. Looking for sniffer logs:$' 467s WARNING: Suspect directory /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ found. Looking for sniffer logs: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/$' 467s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/ 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/run/\.tmp/y$' 467s /tmp/CHKROOTKIT_ROOT/var/run/.tmp/y 467s OK 467s **** Test for '^Searching for known suspicious files\.\.\. WARNING$' 467s Searching for known suspicious files... WARNING 467s OK 467s **** Test for '^WARNING: The following known suspicious files were found:$' 467s WARNING: The following known suspicious files were found: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/atm$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/atm 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$' 467s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 467s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 467s OK 467s **** Test for '^Searching for sniffer's logs\.\.\. WARNING$' 467s Searching for sniffer's logs... WARNING 467s OK 467s **** Test for '^WARNING: The following potential sniffer's logs were found:$' 467s WARNING: The following potential sniffer's logs were found: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/tcp\.log$' 467s /tmp/CHKROOTKIT_ROOT/tmp/tcp.log 467s OK 467s **** Test for '^Searching for HiDrootkit rootkit\.\.\. WARNING$' 467s Searching for HiDrootkit rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible HiDrootkit rootkit installed:$' 467s WARNING: Possible HiDrootkit rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/lib/games/\.k/$' 467s /tmp/CHKROOTKIT_ROOT/var/lib/games/.k/ 467s OK 467s **** Test for '^Searching for t0rn rootkit\.\.\. WARNING$' 467s Searching for t0rn rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible t0rn rootkit installed:$' 467s WARNING: Possible t0rn rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ttyhash$' 467s /tmp/CHKROOTKIT_ROOT/etc/ttyhash 467s OK 467s **** Test for '^Searching for t0rn v8 \(or variation\)\.\.\. WARNING$' 467s Searching for t0rn v8 (or variation)... WARNING 467s OK 467s **** Test for '^WARNING: Possible t0rn v8 \(or variation\) rootkit installed:$' 467s WARNING: Possible t0rn v8 (or variation) rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/lib/libproc\.a$' 467s /tmp/CHKROOTKIT_ROOT/usr/local/lib/libproc.a 467s OK 467s **** Test for '^Searching for Lion rootkit\.\.\. WARNING$' 467s Searching for Lion rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Lion rootkit installed:$' 467s WARNING: Possible Lion rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/mjy$' 467s /tmp/CHKROOTKIT_ROOT/bin/mjy 467s OK 467s **** Test for '^Searching for RSHA rootkit\.\.\. WARNING$' 467s Searching for RSHA rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible RSHA rootkit installed:$' 467s WARNING: Possible RSHA rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/n3tstat$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/n3tstat 467s OK 467s **** Test for '^Searching for RH-Sharpe rootkit\.\.\. WARNING$' 467s Searching for RH-Sharpe rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible RH-Sharpe rootkit installed:$' 467s WARNING: Possible RH-Sharpe rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/lps$' 467s /tmp/CHKROOTKIT_ROOT/bin/lps 467s OK 467s **** Test for '^Searching for Ambient \(ark\) rootkit\.\.\. WARNING$' 467s Searching for Ambient (ark) rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Ambient's rootkit \(ark\) installed:$' 467s WARNING: Possible Ambient's rootkit (ark) installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/\.ark\?$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 467s OK 467s **** Test for '^Searching for suspicious files and dirs\.\.\. WARNING$' 467s Searching for suspicious files and dirs... WARNING 467s OK 467s **** Test for '^WARNING: The following suspicious files and directories were found:$' 467s WARNING: The following suspicious files and directories were found: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.1 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.aaa$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.aaa 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.1DIR$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.1DIR 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.ark\?$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.ark? 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.DIR$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/...DIR 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.bbb$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.bbb 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.DIR-aaa$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/.DIR-aaa 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?lib/\.\.\.$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/... 467s OK 467s **** Test for '^Searching for LPD Worm\.\.\. WARNING$' 467s Searching for LPD Worm... WARNING 467s OK 467s **** Test for '^WARNING: Possible LPD worm installed \(based on files found\)$' 467s WARNING: Possible LPD worm installed (based on files found) 467s OK 467s **** Test for '^Searching for Ramen Worm rootkit\.\.\. WARNING$' 467s Searching for Ramen Worm rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Ramen Worm rootkit installed:$' 467s WARNING: Possible Ramen Worm rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/src/\.poop/$' 467s /tmp/CHKROOTKIT_ROOT/usr/src/.poop/ 467s OK 467s **** Test for '^Searching for Maniac rootkit\.\.\. WARNING$' 467s Searching for Maniac rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Maniac rootkit installed:$' 467s WARNING: Possible Maniac rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/mailrc$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/mailrc 467s OK 467s **** Test for '^Searching for RK17 rootkit\.\.\. WARNING$' 467s Searching for RK17 rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible RK17 rootkit installed:$' 467s WARNING: Possible RK17 rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus\.cgi$' 467s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/bogus.cgi 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/number\.cgi$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/number.cgi 467s OK 467s **** Test for '^Searching for Ducoci rootkit\.\.\. WARNING$' 467s Searching for Ducoci rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Ducoci rootkit installed:$' 467s WARNING: Possible Ducoci rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last\.cgi$' 467s /tmp/CHKROOTKIT_ROOT/www/httpd/cgi-bin/last.cgi 467s OK 467s **** Test for '^Searching for Adore Worm\.\.\. WARNING$' 467s Searching for Adore Worm... WARNING 467s OK 467s **** Test for '^WARNING: Possible Adore Worm installed:$' 467s WARNING: Possible Adore Worm installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/red\.tar$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/red.tar 467s OK 467s **** Test for '^Searching for ShitC Worm\.\.\. WARNING$' 467s Searching for ShitC Worm... WARNING 467s OK 467s **** Test for '^WARNING: Possible ShitC Worm installed:$' 467s WARNING: Possible ShitC Worm installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/dy$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/dy 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/(usr/)?bin/frgy$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/frgy 467s OK 467s **** Test for '^Searching for Omega Worm\.\.\. WARNING$' 467s Searching for Omega Worm... WARNING 467s OK 467s **** Test for '^WARNING: Possible Omega Worm installed:$' 467s WARNING: Possible Omega Worm installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/chr$' 467s /tmp/CHKROOTKIT_ROOT/dev/chr 467s OK 467s **** Test for '^Searching for Sadmind/IIS Worm\.\.\. WARNING$' 467s Searching for Sadmind/IIS Worm... WARNING 467s OK 467s **** Test for '^WARNING: Possible Sadmin/IIS Worm installed:$' 467s WARNING: Possible Sadmin/IIS Worm installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/cuc$' 467s /tmp/CHKROOTKIT_ROOT/dev/cuc 467s OK 467s **** Test for '^Searching for MonKit\.\.\. WARNING$' 467s Searching for MonKit... WARNING 467s OK 467s **** Test for '^WARNING: Possible MonKit installed:$' 467s WARNING: Possible MonKit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/libpikapp\.a$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/libpikapp.a 467s OK 467s **** Test for '^Searching for Showtee rootkit\.\.\. WARNING$' 467s Searching for Showtee rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Showtee rootkit installed:$' 467s WARNING: Possible Showtee rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 467s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/chk\.h$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/chk.h 467s OK 467s **** Test for '^Searching for OpticKit\.\.\. WARNING$' 467s Searching for OpticKit... WARNING 467s OK 467s **** Test for '^WARNING: Possible OpticKit installed:$' 467s WARNING: Possible OpticKit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 467s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 467s OK 467s **** Test for '^Searching for T\.R\.K\.\.\. WARNING$' 467s Searching for T.R.K... WARNING 467s OK 467s **** Test for '^WARNING: Possible T\.R\.K installed:$' 467s WARNING: Possible T.R.K installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/xsf$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 467s /tmp/CHKROOTKIT_ROOT/usr/bin/xsf 467s OK 467s **** Test for '^Searching for Mithra rootkit\.\.\. WARNING$' 467s Searching for Mithra rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Mithra installed:$' 467s WARNING: Possible Mithra installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/locale/uboot$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/locale/uboot 467s OK 467s **** Test for '^Searching for OBSD rootkit v1\.\.\. not tested$' 467s Searching for OBSD rootkit v1... not tested 467s OK 467s **** Test for '^Searching for LOC rootkit\.\.\. WARNING$' 467s Searching for LOC rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible LOC rootkit installed:$' 467s WARNING: Possible LOC rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/xp$' 467s /tmp/CHKROOTKIT_ROOT/tmp/xp 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/epic$' 467s /tmp/CHKROOTKIT_ROOT/usr/sbin/epic 467s OK 467s **** Test for '^Searching for Romanian rootkit\.\.\. WARNING$' 467s Searching for Romanian rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Romanian rootkit installed:$' 467s WARNING: Possible Romanian rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/proc\.h$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 467s /tmp/CHKROOTKIT_ROOT/usr/include/proc.h 467s OK 467s **** Test for '^Searching for HKRK rootkit\.\.\. WARNING$' 467s Searching for HKRK rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible HKRK rootkit installed in /[^ ]+/CHKROOTKIT_ROOT/etc/rc\.d/init\.d/network$' 467s WARNING: Possible HKRK rootkit installed in /tmp/CHKROOTKIT_ROOT/etc/rc.d/init.d/network 467s OK 467s **** Test for '^Searching for Suckit rootkit\.\.\. WARNING$' 467s Searching for Suckit rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Suckit:$' 467s WARNING: Possible Suckit: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/\.golf/$' 467s /tmp/CHKROOTKIT_ROOT/dev/.golf/ 467s OK 467s **** Test for '^Searching for Volc rootkit\.\.\. WARNING$' 467s Searching for Volc rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Volc rootkit installed:$' 467s WARNING: Possible Volc rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/volc$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/volc 467s OK 467s **** Test for '^Searching for Gold2 rootkit\.\.\. WARNING$' 467s Searching for Gold2 rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Gold2 rootkit installed:$' 467s WARNING: Possible Gold2 rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/bin/ishit$' 467s /tmp/CHKROOTKIT_ROOT/usr/bin/ishit 467s OK 467s **** Test for '^Searching for TC2 rootkit\.\.\. WARNING$' 467s Searching for TC2 rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible TC2 rootkit installed:$' 467s WARNING: Possible TC2 rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/initcheck$' 467s /tmp/CHKROOTKIT_ROOT/usr/sbin/initcheck 467s OK 467s **** Test for '^Searching for Anonoying rootkit\.\.\. WARNING$' 467s Searching for Anonoying rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Anonoying rootkit installed:$' 467s WARNING: Possible Anonoying rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/mech$' 467s /tmp/CHKROOTKIT_ROOT/usr/sbin/mech 467s OK 467s **** Test for '^Searching for ZK rootkit\.\.\. WARNING$' 467s Searching for ZK rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible ZK rootkit installed:$' 467s WARNING: Possible ZK rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/sysconfig/console/load\.zk$' 467s /tmp/CHKROOTKIT_ROOT/etc/sysconfig/console/load.zk 467s OK 467s **** Test for '^Searching for ShKit rootkit\.\.\. WARNING$' 467s Searching for ShKit rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible ShKit rootkit installed:$' 467s WARNING: Possible ShKit rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/ld\.so\.hash$' 467s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 467s /tmp/CHKROOTKIT_ROOT/etc/ld.so.hash 467s OK 467s **** Test for '^Searching for AjaKit rootkit\.\.\. WARNING$' 467s Searching for AjaKit rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible AjaKit rootkit installed:$' 467s WARNING: Possible AjaKit rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/dev/tux/$' 467s /tmp/CHKROOTKIT_ROOT/dev/tux/ 467s OK 467s **** Test for '^Searching for zaRwT rootkit\.\.\. WARNING$' 467s Searching for zaRwT rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible zaRwT rootkit installed:$' 467s WARNING: Possible zaRwT rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/imout$' 467s /tmp/CHKROOTKIT_ROOT/bin/imout 467s OK 467s **** Test for '^Searching for Madalin rootkit\.\.\. WARNING$' 467s Searching for Madalin rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Madalin rootkit installed:$' 467s WARNING: Possible Madalin rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/icekey\.h$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/icekey.h 467s OK 467s **** Test for '^Searching for Fu rootkit\.\.\. WARNING$' 467s Searching for Fu rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Fu rootkit installed:$' 467s WARNING: Possible Fu rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/sbin/xc$' 467s /tmp/CHKROOTKIT_ROOT/sbin/xc 467s OK 467s **** Test for '^Searching for Kenga3 rootkit\.\.\. WARNING$' 467s Searching for Kenga3 rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Kenga3 rootkit installed:$' 467s WARNING: Possible Kenga3 rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/. ./ 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/include/\. \./foo$' 467s /tmp/CHKROOTKIT_ROOT/usr/include/. ./foo 467s OK 467s **** Test for '^Searching for ESRK rootkit\.\.\. WARNING$' 467s Searching for ESRK rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible ESRK rootkit installed:$' 467s WARNING: Possible ESRK rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/lib/tcl5\.3/$' 467s /tmp/CHKROOTKIT_ROOT/usr/lib/tcl5.3/ 467s OK 467s **** Test for '^Searching for rootedoor\.\.\. WARNING$' 467s Searching for rootedoor... WARNING 467s OK 467s **** Test for '^WARNING: Possible rootedoor installed:$' 467s WARNING: Possible rootedoor installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/sbin/rootedoor$' 467s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 467s /tmp/CHKROOTKIT_ROOT/usr/sbin/rootedoor 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/sbin/rootedoor$' 467s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 467s /tmp/CHKROOTKIT_ROOT/sbin/rootedoor 467s OK 467s **** Test for '^Searching for ENYELKM rootkit\.\.\. WARNING$' 467s Searching for ENYELKM rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible ENYELKM rootkit installed:$' 467s WARNING: Possible ENYELKM rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/\.enyelkmOCULTAR\.ko/$' 467s /tmp/CHKROOTKIT_ROOT/etc/.enyelkmOCULTAR.ko/ 467s OK 467s **** Test for '^Searching for common ssh-scanners\.\.\. WARNING$' 467s Searching for common ssh-scanners... WARNING 467s OK 467s **** Test for '^WARNING: Possible ssh-scanner installed:$' 467s WARNING: Possible ssh-scanner installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/vuln\.txt$' 467s /tmp/CHKROOTKIT_ROOT/var/tmp/vuln.txt 467s OK 467s **** Test for '^Searching for Linux/Ebury 1\.4 - Operation Windigo\.\.\. WARNING$' 467s Searching for Linux/Ebury 1.4 - Operation Windigo... WARNING 467s OK 467s **** Test for '^WARNING: /[^ ]+/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1\.4$' 467s WARNING: /tmp/CHKROOTKIT_ROOT/usr/sbin/ssh may be INFECTED by Linux/Ebury 1.4 467s OK 467s **** Test for '^Searching for Linux/Ebury 1\.6\.\.\. WARNING$' 467s Searching for Linux/Ebury 1.6... WARNING 467s OK 467s **** Test for '^WARNING: Possible Linux/Ebury 1\.6 - Operation Windigo installed in /[^ ]+/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils\.so\.1$' 467s WARNING: Possible Linux/Ebury 1.6 - Operation Windigo installed in /tmp/CHKROOTKIT_ROOT/lib/x86_64-linux-gnu/libkeyutils.so.1 467s OK 467s **** Test for '^Searching for 64-bit Linux Rootkit\.\.\. WARNING$' 467s Searching for 64-bit Linux Rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible 64-bit Linux Rootkit:' 467s WARNING: Possible 64-bit Linux Rootkit: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/$' 467s /tmp/CHKROOTKIT_ROOT/usr/local/hide/ 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/local/hide/foo$' 467s /tmp/CHKROOTKIT_ROOT/usr/local/hide/foo 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/rc\.local$' 467s /tmp/CHKROOTKIT_ROOT/etc/rc.local 467s OK 467s **** Test for '^Searching for 64-bit Linux Rootkit modules\.\.\. WARNING$' 467s Searching for 64-bit Linux Rootkit modules... WARNING 467s OK 467s **** Test for '^WARNING: Possible 64-bit rootkit modules installed:$' 467s WARNING: Possible 64-bit rootkit modules installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/lib/modules/module_init\.ko$' 467s /tmp/CHKROOTKIT_ROOT/lib/modules/module_init.ko 467s OK 467s **** Test for '^Searching for Mumblehard\.\.\. WARNING$' 467s Searching for Mumblehard... WARNING 467s OK 467s **** Test for '^WARNING: Possible Mumblehard backdoor installed:$' 467s WARNING: Possible Mumblehard backdoor installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo$' 467s /tmp/CHKROOTKIT_ROOT/var/spool/cron/crontabs/foo 467s OK 467s **** Test for '^Searching for Backdoor\.Linux\.Mokes\.a\.\.\. WARNING$' 467s Searching for Backdoor.Linux.Mokes.a... WARNING 467s OK 467s **** Test for '^WARNING: Possible Backdoor\.Linux\.Mokes\.a installed:$' 467s WARNING: Possible Backdoor.Linux.Mokes.a installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/ss0-0$' 467s /tmp/CHKROOTKIT_ROOT/tmp/ss0-0 467s OK 467s **** Test for '^Searching for Malicious TinyDNS\.\.\. WARNING$' 467s Searching for Malicious TinyDNS... WARNING 467s OK 467s **** Test for '^WARNING: Possible Malicious TinyDNS installed:$' 467s WARNING: Possible Malicious TinyDNS installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/home/ \./$' 467s /tmp/CHKROOTKIT_ROOT/home/ ./ 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/home/ \./tinyDNS$' 467s /tmp/CHKROOTKIT_ROOT/home/ ./tinyDNS 467s OK 467s **** Test for '^Searching for Linux\.Xor\.DDoS\.\.\. WARNING$' 467s Searching for Linux.Xor.DDoS... WARNING 467s OK 467s **** Test for '^WARNING: Possible Linux\.Xor\.DDoS installed:$' 467s WARNING: Possible Linux.Xor.DDoS installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/strings$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/strings 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/uname$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/uname 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/head$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/head 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/find$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/find 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/echo$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/echo 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/netstat$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/netstat 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ls\.orig$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/ls.orig 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ps$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/ps 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/awk$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/awk 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/grep\.orig$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/grep.orig 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dirname$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/dirname 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/ss$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/ss 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/sed$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/sed 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/cut$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/cut 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/id$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/id 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/xargs$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/xargs 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/clean/dpkg-query$' 467s /tmp/CHKROOTKIT_ROOT/tmp/clean/dpkg-query 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive$' 467s /tmp/CHKROOTKIT_ROOT/tmp/test-chkrootkit-false-positive 467s OK 467s **** Test for '^Searching for Linux\.Proxy\.1\.0\.\.\. WARNING$' 467s Searching for Linux.Proxy.1.0... WARNING 467s OK 467s **** Test for '^WARNING: INFECTED: Possible Malicious Linux\.Proxy\.10 installed in /etc/passwd$' 467s WARNING: INFECTED: Possible Malicious Linux.Proxy.10 installed in /etc/passwd 467s OK 467s **** Test for '^Searching for CrossRAT\.\.\. WARNING$' 467s Searching for CrossRAT... WARNING 467s OK 467s **** Test for '^WARNING: Possible Malicious CrossRAT installed:$' 467s WARNING: Possible Malicious CrossRAT installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/var/mediamgrs\.jar$' 467s /tmp/CHKROOTKIT_ROOT/usr/var/mediamgrs.jar 467s OK 467s **** Test for '^Searching for Hidden Cobra\.\.\. WARNING$' 467s Searching for Hidden Cobra... WARNING 467s OK 467s **** Test for '^WARNING: Possible Malicious Hidden Cobra installed:$' 467s WARNING: Possible Malicious Hidden Cobra installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.ICE-unix/engine\.so$' 467s /tmp/CHKROOTKIT_ROOT/tmp/.ICE-unix/engine.so 467s OK 467s **** Test for '^Searching for Rocke Miner rootkit\.\.\. WARNING$' 467s Searching for Rocke Miner rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Rocke Miner rootkit installed:$' 467s WARNING: Possible Rocke Miner rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/etc/xig$' 467s /tmp/CHKROOTKIT_ROOT/etc/xig 467s OK 467s **** Test for '^Searching for PWNLNX4 lkm rootkit\.\.\. WARNING$' 467s Searching for PWNLNX4 lkm rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible PWNLNX4 lkm rootkit installed:$' 467s WARNING: Possible PWNLNX4 lkm rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/var/tmp/\.1/$' 467s /tmp/CHKROOTKIT_ROOT/var/tmp/.1/ 467s OK 467s **** Test for '^Searching for PWNLNX6 lkm rootkit\.\.\. WARNING$' 467s Searching for PWNLNX6 lkm rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible PWNLNX6 lkm rootkit installed:$' 467s WARNING: Possible PWNLNX6 lkm rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/suterusu/$' 467s /tmp/CHKROOTKIT_ROOT/tmp/suterusu/ 467s OK 467s **** Test for '^Searching for Umbreon lrk\.\.\. WARNING$' 467s Searching for Umbreon lrk... WARNING 467s OK 467s **** Test for '^WARNING: Possible Malicious UMBREON LRK installed:$' 467s WARNING: Possible Malicious UMBREON LRK installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/usr/share/libc\.so\.69$' 467s /tmp/CHKROOTKIT_ROOT/usr/share/libc.so.69 467s OK 467s **** Test for '^Searching for Kinsing\.a backdoor rootkit\.\.\. WARNING$' 467s Searching for Kinsing.a backdoor rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Kinsing\.a backdoor rootkit installed:$' 467s WARNING: Possible Kinsing.a backdoor rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/kdevtmpfsi$' 467s /tmp/CHKROOTKIT_ROOT/tmp/kdevtmpfsi 467s OK 467s **** Test for '^Searching for RotaJakiro backdoor rootkit\.\.\. WARNING$' 467s Searching for RotaJakiro backdoor rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible RotaJakiro backdoor rootkit installed:$' 467s WARNING: Possible RotaJakiro backdoor rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/systemd-daemon$' 467s /tmp/CHKROOTKIT_ROOT/bin/systemd-daemon 467s OK 467s **** Test for '^Searching for Syslogk LKM rootkit\.\.\. not tested$' 467s Searching for Syslogk LKM rootkit... not tested 467s OK 467s **** Test for '^Searching for Kovid LKM rootkit\.\.\. WARNING$' 467s Searching for Kovid LKM rootkit... WARNING 467s OK 467s **** Test for '^WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /[^ ]+/CHKROOTKIT_ROOT/proc/kovid$' 467s WARNING: INFECTED: Possible Malicious Kovid LKM rootkit installed: /tmp/CHKROOTKIT_ROOT/proc/kovid 467s OK 467s **** Test for '^Searching for Tsunami DDoS Malware rootkit\.\.\. WARNING$' 467s Searching for Tsunami DDoS Malware rootkit... WARNING 467s OK 467s **** Test for '^WARNING: Possible Tsunami DDoS Malware rootkit installed:$' 467s WARNING: Possible Tsunami DDoS Malware rootkit installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/bin/cls$' 467s /tmp/CHKROOTKIT_ROOT/bin/cls 467s OK 467s **** Test for '^Searching for Linux BPF Door\.\.\. WARNING$' 467s Searching for Linux BPF Door... WARNING 467s OK 467s **** Test for '^WARNING: Possible Linux BPFDoor Malware installed:$' 467s WARNING: Possible Linux BPFDoor Malware installed: 467s OK 467s **** Test for '^/proc/xx/stack$' 467s /proc/xx/stack 467s OK 467s **** Test for '^Searching for suspect PHP files\.\.\. WARNING$' 467s Searching for suspect PHP files... WARNING 467s OK 467s **** Test for '^WARNING: The following suspicious PHP files were found:$' 467s WARNING: The following suspicious PHP files were found: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/name\.php$' 467s /tmp/CHKROOTKIT_ROOT/tmp/name.php 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; "' 467s /tmp/CHKROOTKIT_ROOT/tmp/sp ace/aaa' exit 1; " 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/by-content$' 467s /tmp/CHKROOTKIT_ROOT/tmp/by-content 467s OK 467s **** Test for '^Searching for zero-size shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$' 467s Searching for zero-size shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 467s OK 467s **** Test for '^WARNING: Zero-size history files:$' 467s WARNING: Zero-size history files: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$' 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s OK 467s **** Test for '^Searching for hardlinked shell history files in /[^ ]+/CHKROOTKIT_ROOT/root\.\.\. WARNING$' 467s Searching for hardlinked shell history files in /tmp/CHKROOTKIT_ROOT/root... WARNING 467s OK 467s **** Test for '^WARNING: shell history files hardlinked to another file:$' 467s WARNING: shell history files hardlinked to another file: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/root/\.whatever\.history$' 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s /tmp/CHKROOTKIT_ROOT/root/.whatever.history 467s OK 467s **** Test for '^Checking `aliens'\.\.\. finished$' 467s Checking `aliens'... finished 467s OK 467s **** Test for '^Checking `asp'\.\.\. WARNING$' 467s Checking `asp'... WARNING 467s OK 467s **** Test for '^WARNING: Possible Ramen Worm installed in /[^ ]+/CHKROOTKIT_ROOT/etc/inetd\.conf$' 467s WARNING: Possible Ramen Worm installed in /tmp/CHKROOTKIT_ROOT/etc/inetd.conf 467s OK 467s **** Test for '^Checking `bindshell'\.\.\. not tested$' 467s Checking `bindshell'... not tested 467s OK 467s **** Test for '^Checking `lkm'\.\.\. started$' 467s Checking `lkm'... started 467s OK 467s **** Test for '^Searching for Adore LKM\.\.\. not tested$' 467s Searching for Adore LKM... not tested 467s OK 467s **** Test for '^Searching for sebek LKM \(Adore based\)\.\.\. not tested$' 467s Searching for sebek LKM (Adore based)... not tested 467s OK 467s **** Test for '^Searching for knark LKM rootkit\.\.\. not found$' 467s Searching for knark LKM rootkit... not found 467s OK 467s **** Test for '^Searching for for hidden processes with chkproc\.\.\. not tested$' 467s Searching for for hidden processes with chkproc... not tested 467s OK 467s **** Test for '^Searching for for hidden directories using chkdirs\.\.\.' 467s Searching for for hidden directories using chkdirs... not found 467s OK 467s **** Test for '^Checking `lkm'\.\.\. finished$' 467s Checking `lkm'... finished 467s OK 467s **** Test for '^Checking `rexedcs'\.\.\. INFECTED: /[^ ]+/CHKROOTKIT_ROOT/usr/bin/in\.rexedcs$' 467s Checking `rexedcs'... INFECTED: /tmp/CHKROOTKIT_ROOT/usr/bin/in.rexedcs 467s OK 467s **** Test for '^Checking `sniffer'\.\.\. not tested$' 467s Checking `sniffer'... not tested 467s OK 467s **** Test for '^Checking `w55808'\.\.\. WARNING$' 467s Checking `w55808'... WARNING 467s OK 467s **** Test for '^WARNING: Possible 55808 Worm installed$' 467s WARNING: Possible 55808 Worm installed 467s OK 467s **** Test for '^Checking `wted'\.\.\. not (tested|found)$' 467s Checking `wted'... not found 467s OK 467s **** Test for '^Checking `scalper'\.\.\. WARNING$' 467s Checking `scalper'... WARNING 467s OK 467s **** Test for '^WARNING: Possible Scalper Worm installed$' 467s WARNING: Possible Scalper Worm installed 467s OK 467s **** Test for '^Checking `slapper'\.\.\. WARNING$' 467s Checking `slapper'... WARNING 467s OK 467s **** Test for '^WARNING: Possible Slapper Worm installed:$' 467s WARNING: Possible Slapper Worm installed: 467s OK 467s **** Test for '^/[^ ]+/CHKROOTKIT_ROOT/tmp/\.bugtraq\.c$' 467s /tmp/CHKROOTKIT_ROOT/tmp/.bugtraq.c 467s OK 467s **** Test for '^Checking `z2'\.\.\. not (tested|found)$' 467s Checking `z2'... not found 467s OK 467s **** Test for '^Checking `chkutmp'\.\.\. not tested$' 467s Checking `chkutmp'... not tested 467s OK 467s **** Test for '^Checking `OSX_RSPLUG'\.\.\. not tested$' 467s Checking `OSX_RSPLUG'... not tested 467s OK 467s ** PASS: Testing: setting-rootdir (chkrootkit -p /tmp/clean -r /tmp/CHKROOTKIT_ROOT) done: PASS 467s *** Unexpected (unmatched) lines follow (for info): 467s /tmp/CHKROOTKIT_ROOT/usr/lib/modules/6.11.0-8-generic/vdso/.build-id 467s * Resetting 467s Removing symlink: /tmp/CHKROOTKIT_ROOT 467s replace /etc/rc.local with /etc/rc.local.pre-rootkit 467s /etc/rc.local 467s replace /etc/passwd with /etc/passwd.pre-rootkit 467s /etc/passwd 467s /etc/passwd- 467s replace /etc/inetd.conf with /etc/inetd.conf.pre-rootkit 467s /etc/inetd.conf 467s kill: /usr/bin/atm 467s /tmp/clean/ls.orig: cannot access '/usr/bin/atm*': No such file or directory 467s kill: /tmp/tcp.log 467s /tmp/clean/ls.orig: cannot access '/tmp/tcp.log*': No such file or directory 467s kill: /var/lib/games/.k/foo 467s /tmp/clean/ls.orig: cannot access '/var/lib/games/.k/foo*': No such file or directory 467s kill: /usr/src/.poop/foo 467s /tmp/clean/ls.orig: cannot access '/usr/src/.poop/foo*': No such file or directory 467s kill: /dev/.golf/foo 467s /tmp/clean/ls.orig: cannot access '/dev/.golf/foo*': No such file or directory 467s kill: /dev/tux/foo 467s /tmp/clean/ls.orig: cannot access '/dev/tux/foo*': No such file or directory 467s kill: /usr/include/. ./foo 467s /tmp/clean/ls.orig: cannot access '/usr/include/. ./foo*': No such file or directory 467s kill: /usr/lib/tcl5.3/foo 467s /tmp/clean/ls.orig: cannot access '/usr/lib/tcl5.3/foo*': No such file or directory 467s kill: /etc/ttyhash 467s /tmp/clean/ls.orig: cannot access '/etc/ttyhash*': No such file or directory 467s kill: /usr/local/lib/libproc.a 467s /usr/local/lib/libproc.a* 467s kill: /bin/mjy 467s /tmp/clean/ls.orig: cannot access '/bin/mjy*': No such file or directory 467s kill: /usr/bin/n3tstat 467s /tmp/clean/ls.orig: cannot access '/usr/bin/n3tstat*': No such file or directory 467s kill: /bin/lps 467s /tmp/clean/ls.orig: cannot access '/bin/lps*': No such file or directory 467s kill: /usr/lib/.ark? 467s /tmp/clean/ls.orig: cannot access '/usr/lib/.ark?*': No such file or directory 467s kill: /usr/lib/number.cgi 467s /tmp/clean/ls.orig: cannot access '/usr/lib/number.cgi*': No such file or directory 467s kill: /www/httpd/cgi-bin/last.cgi 467s /tmp/clean/ls.orig: cannot access '/www/httpd/cgi-bin/last.cgi*': No such file or directory 467s kill: /usr/bin/red.tar 467s /tmp/clean/ls.orig: cannot access '/usr/bin/red.tar*': No such file or directory 467s kill: /bin/dy 467s /tmp/clean/ls.orig: cannot access '/bin/dy*': No such file or directory 467s kill: /dev/chr 467s /tmp/clean/ls.orig: cannot access '/dev/chr*': No such file or directory 467s kill: /dev/cucl 467s /tmp/clean/ls.orig: cannot access '/dev/cucl*': No such file or directory 467s kill: /usr/include/chk.h 467s /tmp/clean/ls.orig: cannot access '/usr/include/chk.h*': No such file or directory 467s kill: /usr/bin/xsf 467s /tmp/clean/ls.orig: cannot access '/usr/bin/xsf*': No such file or directory 467s kill: /usr/lib/locale/uboot 467s /tmp/clean/ls.orig: cannot access '/usr/lib/locale/uboot*': No such file or directory 467s kill: /tmp/xp 467s /tmp/clean/ls.orig: cannot access '/tmp/xp*': No such file or directory 467s kill: /usr/bin/volc 467s /tmp/clean/ls.orig: cannot access '/usr/bin/volc*': No such file or directory 467s kill: /usr/include/proc.h 467s /usr/include/proc.h* 467s kill: /etc/rc.d/init.d/network 467s /tmp/clean/ls.orig: cannot access '/etc/rc.d/init.d/network*': No such file or directory 467s kill: /usr/bin/ishit 467s /tmp/clean/ls.orig: cannot access '/usr/bin/ishit*': No such file or directory 467s kill: /usr/sbin/initcheck 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/initcheck*': No such file or directory 467s kill: /usr/sbin/mech 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/mech*': No such file or directory 467s kill: /etc/sysconfig/console/load.zk 467s /tmp/clean/ls.orig: cannot access '/etc/sysconfig/console/load.zk*': No such file or directory 467s kill: /etc/ld.so.hash 467s /tmp/clean/ls.orig: cannot access '/etc/ld.so.hash*': No such file or directory 467s kill: /bin/imout 467s /tmp/clean/ls.orig: cannot access '/bin/imout*': No such file or directory 467s kill: /usr/include/icekey.h 467s /tmp/clean/ls.orig: cannot access '/usr/include/icekey.h*': No such file or directory 467s kill: /sbin/xc 467s /sbin/xcec-bridge 467s kill: /sbin/rootedoor 467s /tmp/clean/ls.orig: cannot access '/sbin/rootedoor*': No such file or directory 467s kill: /etc/.enyelkmOCULTAR.ko/foo 467s /tmp/clean/ls.orig: cannot access '/etc/.enyelkmOCULTAR.ko/foo*': No such file or directory 467s kill: /var/tmp/vuln.txt 467s /tmp/clean/ls.orig: cannot access '/var/tmp/vuln.txt*': No such file or directory 467s kill: /usr/local/hide/foo 467s /tmp/clean/ls.orig: cannot access '/usr/local/hide/foo*': No such file or directory 467s kill: /lib/modules/module_init.ko 467s /tmp/clean/ls.orig: cannot access '/lib/modules/module_init.ko*': No such file or directory 467s kill: /tmp/ss0-0 467s /tmp/clean/ls.orig: cannot access '/tmp/ss0-0*': No such file or directory 467s kill: /usr/var/mediamgrs.jar 467s /tmp/clean/ls.orig: cannot access '/usr/var/mediamgrs.jar*': No such file or directory 467s kill: /tmp/.ICE-unix/engine.so 467s /tmp/clean/ls.orig: cannot access '/tmp/.ICE-unix/engine.so*': No such file or directory 467s kill: /etc/xig 467s /tmp/clean/ls.orig: cannot access '/etc/xig*': No such file or directory 467s kill: /var/tmp/.1/x 467s /tmp/clean/ls.orig: cannot access '/var/tmp/.1/x*': No such file or directory 467s kill: /var/run/.tmp/y 467s /tmp/clean/ls.orig: cannot access '/var/run/.tmp/y*': No such file or directory 467s kill: /tmp/suterusu/pwnlnx6 467s /tmp/clean/ls.orig: cannot access '/tmp/suterusu/pwnlnx6*': No such file or directory 467s kill: /usr/share/libc.so.69 467s /tmp/clean/ls.orig: cannot access '/usr/share/libc.so.69*': No such file or directory 467s kill: /tmp/kdevtmpfsi 467s /tmp/clean/ls.orig: cannot access '/tmp/kdevtmpfsi*': No such file or directory 467s kill: /bin/systemd-daemon 467s /tmp/clean/ls.orig: cannot access '/bin/systemd-daemon*': No such file or directory 467s kill: /syslogk 467s /tmp/clean/ls.orig: cannot access '/syslogk*': No such file or directory 467s kill: /root/.whatever.history 467s /root/.whatever.history.hardlink 467s kill: /root/.whatever.history.hardlink 467s /tmp/clean/ls.orig: cannot access '/root/.whatever.history.hardlink*': No such file or directory 467s kill: /tmp/name.php 467s /tmp/clean/ls.orig: cannot access '/tmp/name.php*': No such file or directory 467s kill: /bin/.ps 467s /tmp/clean/ls.orig: cannot access '/bin/.ps*': No such file or directory 467s kill: /usr/bin/mailrc 467s /tmp/clean/ls.orig: cannot access '/usr/bin/mailrc*': No such file or directory 467s kill: /www/httpd/cgi-bin/bogus.cgi 467s /tmp/clean/ls.orig: cannot access '/www/httpd/cgi-bin/bogus.cgi*': No such file or directory 467s kill: /bin/frgy 467s /tmp/clean/ls.orig: cannot access '/bin/frgy*': No such file or directory 467s kill: /dev/cuc 467s /tmp/clean/ls.orig: cannot access '/dev/cuc*': No such file or directory 467s kill: /usr/lib/libpikapp.a 467s /tmp/clean/ls.orig: cannot access '/usr/lib/libpikapp.a*': No such file or directory 467s kill: /var/spool/cron/crontabs/foo 467s /tmp/clean/ls.orig: cannot access '/var/spool/cron/crontabs/foo*': No such file or directory 467s kill: /sbin/ssh 467s /sbin/sshd 467s /sbin/sshd.orig 467s /sbin/sshd.to_replace 467s kill: /dev/bad-file 467s /tmp/clean/ls.orig: cannot access '/dev/bad-file*': No such file or directory 467s kill: /lib/x86_64-linux-gnu/libkeyutils.so.1 467s /tmp/clean/ls.orig: cannot access '/lib/x86_64-linux-gnu/libkeyutils.so.1*': No such file or directory 467s kill: /home/ ./tinyDNS 467s /tmp/clean/ls.orig: cannot access '/home/ ./tinyDNS*': No such file or directory 467s kill: /tmp/by-content 467s /tmp/clean/ls.orig: cannot access '/tmp/by-content*': No such file or directory 467s kill: /bin/in.rexedcs 467s /tmp/clean/ls.orig: cannot access '/bin/in.rexedcs*': No such file or directory 467s kill: /tmp/.uua 467s /tmp/clean/ls.orig: cannot access '/tmp/.uua*': No such file or directory 467s kill: /tmp/.bugtraq.c 467s /tmp/clean/ls.orig: cannot access '/tmp/.bugtraq.c*': No such file or directory 467s kill: /tmp/.../r 467s /tmp/clean/ls.orig: cannot access '/tmp/.../r*': No such file or directory 467s kill: /bin/cls 467s /tmp/clean/ls.orig: cannot access '/bin/cls*': No such file or directory 467s kill: /tmp/sp ace/aaa' exit 1; " 467s /tmp/clean/ls.orig: cannot access '/tmp/sp ace/aaa'\'' exit 1; "*': No such file or directory 467s TO_REPLACE: restoring /usr/sbin/amd with /usr/sbin/amd.to_replace 467s /usr/sbin/amd 467s TO_REPLACE: restoring /usr/bin/basename with /usr/bin/basename.to_replace 467s /usr/bin/basename 467s TO_REPLACE: restoring /usr/sbin/biff with /usr/sbin/biff.to_replace 467s /usr/sbin/biff 467s TO_REPLACE: restoring /usr/bin/chfn with /usr/bin/chfn.to_replace 467s /usr/bin/chfn 467s TO_REPLACE: restoring /usr/bin/chsh with /usr/bin/chsh.to_replace 467s /usr/bin/chsh 467s TO_REPLACE: restoring /usr/sbin/cron with /usr/sbin/cron.to_replace 467s /usr/sbin/cron 467s /usr/sbin/cron.orig 467s TO_REPLACE: restoring /usr/bin/date with /usr/bin/date.to_replace 467s /usr/bin/date 467s TO_REPLACE: restoring /usr/bin/du with /usr/bin/du.to_replace 467s /usr/bin/du 467s /usr/bin/dump2tar 467s /usr/bin/dumpkeys 467s TO_REPLACE: restoring /usr/bin/dirname with /usr/bin/dirname.to_replace 467s /usr/bin/dirname 467s TO_REPLACE: restoring /usr/bin/echo with /usr/bin/echo.to_replace 467s /usr/bin/echo 467s TO_REPLACE: restoring /usr/bin/egrep with /usr/bin/egrep.to_replace 467s /usr/bin/egrep 467s TO_REPLACE: restoring /usr/bin/env with /usr/bin/env.to_replace 467s /usr/bin/env 467s /usr/bin/envsubst 467s TO_REPLACE: restoring /usr/bin/find with /usr/bin/find.to_replace 467s /usr/bin/find 467s /usr/bin/findmnt 467s TO_REPLACE: restoring /usr/sbin/fingerd with /usr/sbin/fingerd.to_replace 467s /usr/sbin/fingerd 467s TO_REPLACE: restoring /usr/sbin/gpm with /usr/sbin/gpm.to_replace 467s /usr/sbin/gpm 467s TO_REPLACE: restoring /usr/bin/grep with /usr/bin/grep.to_replace 467s /usr/bin/grep 467s TO_REPLACE: restoring /usr/sbin/hdparm with /usr/sbin/hdparm.to_replace 467s /usr/sbin/hdparm 467s /usr/sbin/hdparm.orig 467s TO_REPLACE: restoring /usr/bin/su with /usr/bin/su.to_replace 467s /usr/bin/su 467s /usr/bin/sudo 467s /usr/bin/sudoedit 467s /usr/bin/sudoreplay 467s /usr/bin/sum 467s TO_REPLACE: restoring /usr/sbin/ifconfig with /usr/sbin/ifconfig.to_replace 467s /usr/sbin/ifconfig 467s TO_REPLACE: restoring /usr/sbin/inetd with /usr/sbin/inetd.to_replace 467s /usr/sbin/inetd 467s /usr/sbin/inetdconf 467s TO_REPLACE: restoring /usr/sbin/in.identd with /usr/sbin/in.identd.to_replace 467s /usr/sbin/in.identd 467s TO_REPLACE: restoring /usr/lib/systemd/systemd with /usr/lib/systemd/systemd.to_replace 467s /usr/lib/systemd/systemd 467s /usr/lib/systemd/systemd-backlight 467s /usr/lib/systemd/systemd-battery-check 467s /usr/lib/systemd/systemd-binfmt 467s /usr/lib/systemd/systemd-boot-check-no-failures 467s /usr/lib/systemd/systemd-bsod 467s /usr/lib/systemd/systemd-cgroups-agent 467s /usr/lib/systemd/systemd-cryptsetup 467s /usr/lib/systemd/systemd-executor 467s /usr/lib/systemd/systemd-fsck 467s /usr/lib/systemd/systemd-fsckd 467s /usr/lib/systemd/systemd-growfs 467s /usr/lib/systemd/systemd-hibernate-resume 467s /usr/lib/systemd/systemd-hostnamed 467s /usr/lib/systemd/systemd-initctl 467s /usr/lib/systemd/systemd-integritysetup 467s /usr/lib/systemd/systemd-journald 467s /usr/lib/systemd/systemd-localed 467s /usr/lib/systemd/systemd-logind 467s /usr/lib/systemd/systemd-makefs 467s /usr/lib/systemd/systemd-measure 467s /usr/lib/systemd/systemd-modules-load 467s /usr/lib/systemd/systemd-network-generator 467s /usr/lib/systemd/systemd-networkd 467s /usr/lib/systemd/systemd-networkd-wait-online 467s /usr/lib/systemd/systemd-pcrlock 467s /usr/lib/systemd/systemd-pstore 467s /usr/lib/systemd/systemd-quotacheck 467s /usr/lib/systemd/systemd-random-seed 467s /usr/lib/systemd/systemd-remount-fs 467s /usr/lib/systemd/systemd-reply-password 467s /usr/lib/systemd/systemd-resolved 467s /usr/lib/systemd/systemd-rfkill 467s /usr/lib/systemd/systemd-shutdown 467s /usr/lib/systemd/systemd-sleep 467s /usr/lib/systemd/systemd-socket-proxyd 467s /usr/lib/systemd/systemd-ssh-proxy 467s /usr/lib/systemd/systemd-storagetm 467s /usr/lib/systemd/systemd-sulogin-shell 467s /usr/lib/systemd/systemd-sysctl 467s /usr/lib/systemd/systemd-sysroot-fstab-check 467s /usr/lib/systemd/systemd-sysv-install 467s /usr/lib/systemd/systemd-time-wait-sync 467s /usr/lib/systemd/systemd-timedated 467s /usr/lib/systemd/systemd-timesyncd 467s /usr/lib/systemd/systemd-udevd 467s /usr/lib/systemd/systemd-update-done 467s /usr/lib/systemd/systemd-update-utmp 467s /usr/lib/systemd/systemd-user-runtime-dir 467s /usr/lib/systemd/systemd-user-sessions 467s /usr/lib/systemd/systemd-veritysetup 467s /usr/lib/systemd/systemd-volatile-root 467s /usr/lib/systemd/systemd-xdg-autostart-condition 467s /usr/lib/systemd/systemd.orig 467s TO_REPLACE: restoring /usr/bin/killall with /usr/bin/killall.to_replace 467s /usr/bin/killall 467s /usr/bin/killall.orig 467s TO_REPLACE: restoring /usr/bin/login with /usr/bin/login.to_replace 467s /usr/bin/login 467s /usr/bin/loginctl 467s TO_REPLACE: restoring /usr/bin/ls with /usr/bin/ls.to_replace 467s /usr/bin/ls 467s /usr/bin/lsattr 467s /usr/bin/lsb_release 467s /usr/bin/lsblk 467s /usr/bin/lscpu 467s /usr/bin/lshw 467s /usr/bin/lsinitramfs 467s /usr/bin/lsipc 467s /usr/bin/lslocks 467s /usr/bin/lslogins 467s /usr/bin/lsmem 467s /usr/bin/lsmod 467s /usr/bin/lsns 467s /usr/bin/lsof 467s /usr/bin/lsof.orig 467s /usr/bin/lsof.to_replace 467s /usr/bin/lspci 467s /usr/bin/lspgpot 467s /usr/bin/lspower 467s /usr/bin/lsusb 467s TO_REPLACE: restoring /usr/bin/lsof with /usr/bin/lsof.to_replace 467s /usr/bin/lsof 467s /usr/bin/lsof.orig 467s TO_REPLACE: restoring /usr/sbin/mail with /usr/sbin/mail.to_replace 467s /usr/sbin/mail 467s TO_REPLACE: restoring /usr/sbin/mingetty with /usr/sbin/mingetty.to_replace 467s /usr/sbin/mingetty 467s TO_REPLACE: restoring /usr/bin/netstat with /usr/bin/netstat.to_replace 467s /usr/bin/netstat 467s TO_REPLACE: restoring /usr/sbin/named with /usr/sbin/named.to_replace 467s /usr/sbin/named 467s TO_REPLACE: restoring /usr/bin/passwd with /usr/bin/passwd.to_replace 467s /usr/bin/passwd 467s TO_REPLACE: restoring /usr/sbin/killall5 with /usr/sbin/killall5.to_replace 467s /usr/sbin/killall5 467s TO_REPLACE: restoring /usr/sbin/in.pop2d with /usr/sbin/in.pop2d.to_replace 467s /usr/sbin/in.pop2d 467s TO_REPLACE: restoring /usr/sbin/in.pop3d with /usr/sbin/in.pop3d.to_replace 467s /usr/sbin/in.pop3d 467s TO_REPLACE: restoring /usr/bin/ps with /usr/bin/ps.to_replace 467s /usr/bin/ps 467s /usr/bin/psfaddtable 467s /usr/bin/psfgettable 467s /usr/bin/psfstriptable 467s /usr/bin/psfxtable 467s /usr/bin/pslog 467s /usr/bin/pstree 467s /usr/bin/pstree.orig 467s /usr/bin/pstree.to_replace 467s /usr/bin/pstree.x11 467s TO_REPLACE: restoring /usr/bin/pstree with /usr/bin/pstree.to_replace 467s /usr/bin/pstree 467s /usr/bin/pstree.orig 467s /usr/bin/pstree.x11 467s TO_REPLACE: restoring /usr/sbin/rpcinfo with /usr/sbin/rpcinfo.to_replace 467s /usr/sbin/rpcinfo 467s TO_REPLACE: restoring /usr/bin/ssh with /usr/bin/ssh.to_replace 467s /usr/bin/ssh 467s /usr/bin/ssh-add 467s /usr/bin/ssh-agent 467s /usr/bin/ssh-argv0 467s /usr/bin/ssh-copy-id 467s /usr/bin/ssh-import-id 467s /usr/bin/ssh-import-id-gh 467s /usr/bin/ssh-import-id-lp 467s /usr/bin/ssh-keygen 467s /usr/bin/ssh-keyscan 467s /usr/bin/ssh.orig 467s TO_REPLACE: restoring /usr/sbin/sendmail with /usr/sbin/sendmail.to_replace 467s /usr/sbin/sendmail 467s TO_REPLACE: restoring /usr/sbin/sshd with /usr/sbin/sshd.to_replace 467s /usr/sbin/sshd 467s /usr/sbin/sshd.orig 467s TO_REPLACE: restoring /usr/sbin/syslogd with /usr/sbin/syslogd.to_replace 467s /usr/sbin/syslogd 467s TO_REPLACE: restoring /usr/bin/tar with /usr/bin/tar.to_replace 467s /usr/bin/tar 467s TO_REPLACE: restoring /usr/sbin/tcpd with /usr/sbin/tcpd.to_replace 467s /usr/sbin/tcpd 467s /usr/sbin/tcpdrop-bpfcc 467s /usr/sbin/tcpdrop.bt 467s TO_REPLACE: restoring /usr/bin/top with /usr/bin/top.to_replace 467s /usr/bin/top 467s TO_REPLACE: restoring /usr/sbin/telnetd with /usr/sbin/telnetd.to_replace 467s /usr/sbin/telnetd 467s TO_REPLACE: restoring /usr/sbin/timed with /usr/sbin/timed.to_replace 467s /usr/sbin/timed 467s TO_REPLACE: restoring /usr/sbin/traceroute with /usr/sbin/traceroute.to_replace 467s /usr/sbin/traceroute 467s TO_REPLACE: restoring /usr/bin/vdir with /usr/bin/vdir.to_replace 467s /usr/bin/vdir 467s TO_REPLACE: restoring /usr/bin/w with /usr/bin/w.to_replace 467s /usr/bin/w 467s /usr/bin/wall 467s /usr/bin/watch 467s /usr/bin/watchgnupg 467s /usr/bin/wc 467s /usr/bin/wcurl 467s /usr/bin/wdctl 467s /usr/bin/wget 467s /usr/bin/whatis 467s /usr/bin/whereis 467s /usr/bin/which 467s /usr/bin/which.debianutils 467s /usr/bin/whiptail 467s /usr/bin/who 467s /usr/bin/whoami 467s /usr/bin/wifi-status 467s /usr/bin/write 467s /usr/bin/write.orig 467s /usr/bin/write.to_replace 467s TO_REPLACE: restoring /usr/bin/write with /usr/bin/write.to_replace 467s /usr/bin/write 467s /usr/bin/write.orig 467s TO_REPLACE: restoring /usr/bin/crontab with /usr/bin/crontab.to_replace 467s /usr/bin/crontab 467s /usr/bin/crontab.orig 467s TO_DELETE: rm /usr/sbin/in.rlogind 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.rlogind*': No such file or directory 467s TO_DELETE: rm /usr/sbin/asp 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/asp*': No such file or directory 467s TO_DELETE: rm /usr/sbin/epic 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/epic*': No such file or directory 467s MOVED: replace /usr/sbin/cron with /usr/sbin/cron.orig 467s /usr/sbin/cron 467s MOVED: replace /usr/bin/crontab with /usr/bin/crontab.orig 467s /usr/bin/crontab 467s MOVED: replace /usr/sbin/hdparm with /usr/sbin/hdparm.orig 467s /usr/sbin/hdparm 467s MOVED: replace /etc/hdparm.conf with /etc/hdparm.conf.orig 467s /etc/hdparm.conf 467s MOVED: replace /usr/lib/systemd/systemd with /usr/lib/systemd/systemd.orig 467s /usr/lib/systemd/systemd 467s /usr/lib/systemd/systemd-backlight 467s /usr/lib/systemd/systemd-battery-check 467s /usr/lib/systemd/systemd-binfmt 467s /usr/lib/systemd/systemd-boot-check-no-failures 467s /usr/lib/systemd/systemd-bsod 467s /usr/lib/systemd/systemd-cgroups-agent 467s /usr/lib/systemd/systemd-cryptsetup 467s /usr/lib/systemd/systemd-executor 467s /usr/lib/systemd/systemd-fsck 467s /usr/lib/systemd/systemd-fsckd 467s /usr/lib/systemd/systemd-growfs 467s /usr/lib/systemd/systemd-hibernate-resume 467s /usr/lib/systemd/systemd-hostnamed 467s /usr/lib/systemd/systemd-initctl 467s /usr/lib/systemd/systemd-integritysetup 467s /usr/lib/systemd/systemd-journald 467s /usr/lib/systemd/systemd-localed 467s /usr/lib/systemd/systemd-logind 467s /usr/lib/systemd/systemd-makefs 467s /usr/lib/systemd/systemd-measure 467s /usr/lib/systemd/systemd-modules-load 467s /usr/lib/systemd/systemd-network-generator 467s /usr/lib/systemd/systemd-networkd 467s /usr/lib/systemd/systemd-networkd-wait-online 467s /usr/lib/systemd/systemd-pcrlock 467s /usr/lib/systemd/systemd-pstore 467s /usr/lib/systemd/systemd-quotacheck 467s /usr/lib/systemd/systemd-random-seed 467s /usr/lib/systemd/systemd-remount-fs 467s /usr/lib/systemd/systemd-reply-password 467s /usr/lib/systemd/systemd-resolved 467s /usr/lib/systemd/systemd-rfkill 467s /usr/lib/systemd/systemd-shutdown 467s /usr/lib/systemd/systemd-sleep 467s /usr/lib/systemd/systemd-socket-proxyd 467s /usr/lib/systemd/systemd-ssh-proxy 467s /usr/lib/systemd/systemd-storagetm 467s /usr/lib/systemd/systemd-sulogin-shell 467s /usr/lib/systemd/systemd-sysctl 467s /usr/lib/systemd/systemd-sysroot-fstab-check 467s /usr/lib/systemd/systemd-sysv-install 467s /usr/lib/systemd/systemd-time-wait-sync 467s /usr/lib/systemd/systemd-timedated 467s /usr/lib/systemd/systemd-timesyncd 467s /usr/lib/systemd/systemd-udevd 467s /usr/lib/systemd/systemd-update-done 467s /usr/lib/systemd/systemd-update-utmp 467s /usr/lib/systemd/systemd-user-runtime-dir 467s /usr/lib/systemd/systemd-user-sessions 467s /usr/lib/systemd/systemd-veritysetup 467s /usr/lib/systemd/systemd-volatile-root 467s /usr/lib/systemd/systemd-xdg-autostart-condition 467s MOVED: replace /usr/bin/killall with /usr/bin/killall.orig 467s /usr/bin/killall 467s MOVED: replace /usr/bin/lsof with /usr/bin/lsof.orig 467s /usr/bin/lsof 467s MOVED: replace /usr/bin/write with /usr/bin/write.orig 467s /usr/bin/write 467s MOVED: replace /usr/bin/pstree with /usr/bin/pstree.orig 467s /usr/bin/pstree 467s /usr/bin/pstree.x11 467s MOVED: replace /usr/bin/ssh with /usr/bin/ssh.orig 467s /usr/bin/ssh 467s /usr/bin/ssh-add 467s /usr/bin/ssh-agent 467s /usr/bin/ssh-argv0 467s /usr/bin/ssh-copy-id 467s /usr/bin/ssh-import-id 467s /usr/bin/ssh-import-id-gh 467s /usr/bin/ssh-import-id-lp 467s /usr/bin/ssh-keygen 467s /usr/bin/ssh-keyscan 467s MOVED: replace /usr/sbin/sshd with /usr/sbin/sshd.orig 467s /usr/sbin/sshd 467s MOVED: replace /usr/bin/tcpdump with /usr/bin/tcpdump.orig 467s /usr/bin/tcpdump 467s MADE: rm /usr/sbin/amd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/amd*': No such file or directory 467s MADE: rm /etc/amd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/amd.conf*': No such file or directory 467s MADE: rm /usr/sbin/biff 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/biff*': No such file or directory 467s MADE: rm /etc/biff.conf 467s /tmp/clean/ls.orig: cannot access '/etc/biff.conf*': No such file or directory 467s MADE: rm /etc/cron.conf 467s /tmp/clean/ls.orig: cannot access '/etc/cron.conf*': No such file or directory 467s MADE: rm /etc/crontab.conf 467s /tmp/clean/ls.orig: cannot access '/etc/crontab.conf*': No such file or directory 467s MADE: rm /usr/sbin/fingerd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/fingerd*': No such file or directory 467s MADE: rm /etc/fingerd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/fingerd.conf*': No such file or directory 467s MADE: rm /usr/sbin/in.fingerd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.fingerd*': No such file or directory 467s MADE: rm /etc/in.fingerd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/in.fingerd.conf*': No such file or directory 467s MADE: rm /usr/sbin/gpm 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/gpm*': No such file or directory 467s MADE: rm /etc/gpm.conf 467s /tmp/clean/ls.orig: cannot access '/etc/gpm.conf*': No such file or directory 467s MADE: rm /usr/sbin/inetd 467s /usr/sbin/inetdconf 467s MADE: rm /etc/inetd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/inetd.conf*': No such file or directory 467s MADE: rm /usr/sbin/in.identd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.identd*': No such file or directory 467s MADE: rm /etc/in.identd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/in.identd.conf*': No such file or directory 467s MADE: rm /usr/sbin/inetdconf 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/inetdconf*': No such file or directory 467s MADE: rm /etc/inetdconf.conf 467s /tmp/clean/ls.orig: cannot access '/etc/inetdconf.conf*': No such file or directory 467s MADE: rm /etc/init.conf 467s /tmp/clean/ls.orig: cannot access '/etc/init.conf*': No such file or directory 467s MADE: rm /etc/killall.conf 467s /tmp/clean/ls.orig: cannot access '/etc/killall.conf*': No such file or directory 467s MADE: rm /etc/lsof.conf 467s /tmp/clean/ls.orig: cannot access '/etc/lsof.conf*': No such file or directory 467s MADE: rm /usr/sbin/mail 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/mail*': No such file or directory 467s MADE: rm /etc/mail.conf 467s /tmp/clean/ls.orig: cannot access '/etc/mail.conf*': No such file or directory 467s MADE: rm /usr/sbin/mingetty 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/mingetty*': No such file or directory 467s MADE: rm /etc/mingetty.conf 467s /tmp/clean/ls.orig: cannot access '/etc/mingetty.conf*': No such file or directory 467s MADE: rm /usr/sbin/named 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/named*': No such file or directory 467s MADE: rm /etc/named.conf 467s /tmp/clean/ls.orig: cannot access '/etc/named.conf*': No such file or directory 467s MADE: rm /usr/sbin/in.pop2d 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.pop2d*': No such file or directory 467s MADE: rm /etc/in.pop2d.conf 467s /tmp/clean/ls.orig: cannot access '/etc/in.pop2d.conf*': No such file or directory 467s MADE: rm /usr/sbin/in.pop3d 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.pop3d*': No such file or directory 467s MADE: rm /etc/in.pop3d.conf 467s /tmp/clean/ls.orig: cannot access '/etc/in.pop3d.conf*': No such file or directory 467s MADE: rm /etc/write.conf 467s /tmp/clean/ls.orig: cannot access '/etc/write.conf*': No such file or directory 467s MADE: rm /etc/pstree.conf 467s /tmp/clean/ls.orig: cannot access '/etc/pstree.conf*': No such file or directory 467s MADE: rm /usr/sbin/rpcinfo 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/rpcinfo*': No such file or directory 467s MADE: rm /etc/rpcinfo.conf 467s /tmp/clean/ls.orig: cannot access '/etc/rpcinfo.conf*': No such file or directory 467s MADE: rm /usr/sbin/rlogind 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/rlogind*': No such file or directory 467s MADE: rm /etc/rlogind.conf 467s /tmp/clean/ls.orig: cannot access '/etc/rlogind.conf*': No such file or directory 467s MADE: rm /usr/sbin/in.rshd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/in.rshd*': No such file or directory 467s MADE: rm /etc/in.rshd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/in.rshd.conf*': No such file or directory 467s MADE: rm /etc/slogin.conf 467s /tmp/clean/ls.orig: cannot access '/etc/slogin.conf*': No such file or directory 467s MADE: rm /usr/sbin/sendmail 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/sendmail*': No such file or directory 467s MADE: rm /etc/sendmail.conf 467s /tmp/clean/ls.orig: cannot access '/etc/sendmail.conf*': No such file or directory 467s MADE: rm /etc/sshd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/sshd.conf*': No such file or directory 467s MADE: rm /usr/sbin/syslogd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/syslogd*': No such file or directory 467s MADE: rm /etc/syslogd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/syslogd.conf*': No such file or directory 467s MADE: rm /usr/sbin/tcpd 467s /usr/sbin/tcpdrop-bpfcc 467s /usr/sbin/tcpdrop.bt 467s MADE: rm /etc/tcpd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/tcpd.conf*': No such file or directory 467s MADE: rm /etc/tcpdump.conf 467s /tmp/clean/ls.orig: cannot access '/etc/tcpdump.conf*': No such file or directory 467s MADE: rm /usr/sbin/telnetd 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/telnetd*': No such file or directory 467s MADE: rm /etc/telnetd.conf 467s /tmp/clean/ls.orig: cannot access '/etc/telnetd.conf*': No such file or directory 467s MADE: rm /usr/sbin/timed 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/timed*': No such file or directory 467s MADE: rm /etc/timed.conf 467s /tmp/clean/ls.orig: cannot access '/etc/timed.conf*': No such file or directory 467s MADE: rm /usr/sbin/traceroute 467s /tmp/clean/ls.orig: cannot access '/usr/sbin/traceroute*': No such file or directory 467s MADE: rm /etc/traceroute.conf 467s /tmp/clean/ls.orig: cannot access '/etc/traceroute.conf*': No such file or directory 467s done 467s * Closing down the testsuite 467s Restoring /etc/chkrootkit/chkrootkit.conf from /etc/chkrootkit/chkrootkit.conf.orig 467s Restoring /etc/chkrootkit/chkrootkit.ignore from /etc/chkrootkit/chkrootkit.ignore.orig 467s DONE 467s * test-chkrootkit: FAIL 468s autopkgtest [20:47:44]: test test-chkrootkit: -----------------------] 468s test-chkrootkit FAIL non-zero exit status 1 468s autopkgtest [20:47:44]: test test-chkrootkit: - - - - - - - - - - results - - - - - - - - - - 468s autopkgtest [20:47:44]: test test-chkrootkit: - - - - - - - - - - stderr - - - - - - - - - - 468s cat: /etc/chkrootkit/chkrootkit.conf: No such file or directory 469s autopkgtest [20:47:45]: @@@@@@@@@@@@@@@@@@@@ summary 469s test-chkrootkit FAIL non-zero exit status 1 473s nova [W] Using flock in prodstack6-s390x 473s flock: timeout while waiting to get lock 473s Creating nova instance adt-plucky-s390x-chkrootkit-20241126-203956-juju-7f2275-prod-proposed-migration-environment-20-c624da37-0333-4ae6-b9ef-9ed83db64919 from image adt/ubuntu-plucky-s390x-server-20241119.img (UUID 0efe7a44-24e0-44d8-af6e-8997f14b87bd)...