rkhunter Warnings

[MarcoP]

Hi,
I recived these error message:
Please inspect this machine, because it may be infected.
What should I do?

Thanks

 

[IgorG]

Try to run

# /usr/local/psa/admin/bin/modules/watchdog/rkhunter --check

And check output. Maybe you will see something suspicious.

 

[MarcoP]

Hi Igor,
thanks for you reply, can I attach the log files?

 

[IgorG]

I can say only that you should worry only about "INFECTED" messages. "WARNINGS" is just warnings

 

[MarcoP]

This is the output, with most warning

[11:44:14] /bin/mail [ Warning ]
[11:44:14] Warning: Package manager verification has failed:
[11:44:14] File: /bin/mail
[11:44:14] The file group has changed

[11:45:24] Checking '/etc/xinetd.d/ftp_psa' for enabled services [ Warning ]
[11:45:24] Checking '/etc/xinetd.d/poppassd_psa' for enabled services [ Warning ]
[11:45:24] Checking '/etc/xinetd.d/rsync' for enabled services [ None found ]
[11:45:24] Checking '/etc/xinetd.d/smtp_psa' for enabled services [ Warning ]
[11:45:24] Checking '/etc/xinetd.d/smtps_psa' for enabled services [ Warning ]
[11:45:24] Checking '/etc/xinetd.d/submission_psa' for enabled services [ Warning ]