You are not logged in.

#1 2015-10-10 16:24:21

Sector11
Mod Squid Tpyo Knig
From: Upstairs
Registered: 2015-08-20
Posts: 8,026

chkrootkit result questions

Can someone translate this for me please ...
sudo chkrootkit

{snip}
Checking `w'...                                             not infected
Checking `write'...                                         not infected
Checking `aliens'...                                        
/dev/shm/firefox-cache/cache2/entries/53A4DD4D567DA5D840BF8435821CF473B9FAF4FA
Searching for sniffer's logs, it may take a while...        nothing found
Searching for rootkit HiDrootkit's default files...         nothing found
{snip}

What's that firefoxt thing?  Which has changed to:

Checking `vdir'...                                          not infected
Checking `w'...                                             not infected
Checking `write'...                                         not infected
Checking `aliens'...                                        
/dev/shm/firefox-cache/cache2/entries/53A4DD4D567DA5D840BF8435821CF473B9FAF4FA /dev/shm/firefox-cache/cache2/doomed/1990036858
Searching for sniffer's logs, it may take a while...        nothing found
Searching for rootkit HiDrootkit's default files...         nothing found
Searching for rootkit t0rn's default files...               nothing found
Searching for t0rn's v8 defaults...                         nothing found
Searching for rootkit Lion's default files...               nothing found
Searching for rootkit RSHA's default files...               nothing found
Searching for rootkit RH-Sharpe's default files...          nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:  
/usr/lib/python3/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/icedove/.autoreg /usr/lib/pymodules/python2.7/.path

Searching for LPD Worm files and dirs...                    nothing found
Searching for Ramen Worm files and dirs...                  nothing found
Searching for Maniac files and dirs...                      nothing found
Searching for RK17 files and dirs...                        nothing found

Did not have that second one a few minutes ago, and I have not used icedove in the meantime. Colour me: ?????

and the ending:

Searching for Linux/Ebury - Operation Windigo ssh...        nothing found
Searching for 64-bit Linux Rootkit ...                      nothing found
Searching for 64-bit Linux Rootkit modules...               nothing found
Searching for suspect PHP files...                          nothing found
Searching for anomalies in shell history files...           nothing found
Checking `asp'...                                           not infected
Checking `bindshell'...                                     not infected
Checking `lkm'...                                           chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'...                                       not found
Checking `sniffer'...                                       lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient[445])
Checking `w55808'...                                        not infected
Checking `wted'...                                          1 deletion(s) between Tue Oct  6 09:07:44 2015 and Tue Oct  6 09:08:48 2015
Checking `scalper'...                                       not infected
Checking `slapper'...                                       not infected
Checking `z2'...                                            user root deleted or never logged from lastlog!
Checking `chkutmp'...                                        The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! root          968 tty7   /usr/bin/X :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
chkutmp: nothing deleted
Checking `OSX_RSPLUG'...                                    not infected

Debian 12 Beardog, SoxDog and still a Conky 1.9er

Offline

#2 2015-10-10 16:45:45

Sector11
Mod Squid Tpyo Knig
From: Upstairs
Registered: 2015-08-20
Posts: 8,026

Re: chkrootkit result questions

rkhunter found these:    mad

[13:37:48] Info: Starting test name 'filesystem'
[13:37:48] Performing filesystem checks
[13:37:48] Info: SCAN_MODE_DEV set to 'THOROUGH'
[13:37:54]   Checking /dev for suspicious file types         [ Warning ]
[13:37:54] Warning: Suspicious file types found in /dev:
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/9D9E6ACB425D760BF1B9DE9BAEEC17F49D0F0851: data
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/9AAAAD38A3186AB7C749ACEE8114B793346A36B1: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/DD4A2E7742FB8391B1D89482C80F93FD9F4E4C0C: PNG image data, 10 x 60, 8-bit/color RGB, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/FCEABA416E7771234BB1B88870C93FFE48B5E207: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/B11F1E253062C968D86F1B4FB4F37CCDC0E73583: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/D8663740E8FF6FE26914BD4F1E8EC2D5A22B35F7: PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/F1AFB0013DC993FFA8CF8F12EEA808D00A5F8E8E: PNG image data, 13 x 9, 1-bit colormap, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/F4E8D4B5E016F4D42C99C128D758D2ABB1888C01: PNG image data, 14 x 1025, 8-bit/color RGBA, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/ED48E767C458686C6E0F0DBEA83CAB92318A2436: PNG image data, 20 x 9919, 8-bit/color RGBA, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/6BA677702E8ABC4DC3A6EDFF84449062E647E83C: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/34607D2063009B019B675CC7A6680040A57289C2: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/52FCCE98B0C360DBE2E65B718BCFEE745991E48B: gzip compressed data, from Unix
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/F1DC29B718D3E2D4B1D8BB1DAC7F9FA09BAD24AE: PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/3BECAF95BA5C22DE8672BA4197D76D27C5E641BE: PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/15B197122F4B3EB4D358DD6F54BEDAD43E623754: data
[13:37:54]          /dev/shm/firefox-cache/cache2/entries/AFBED93E8C0AC98D31B4897FD444D054AB7907A8: PNG image data, 84 x 18, 8-bit/color RGBA, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/0AB6C0F238F5F2B79C46CC57E6943C02F6F3ABCD: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/2187BE6466D8F43381B23DC4024B963DE48A103B: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/E2915636FE5873156A2DD3DDEA654ECC2F92DBB7: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/0C0CE1227FA29E1E64A6F055039FFC9D7B0A98B1: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/53B5A9E046F3976344E27CF6747939D55DF8C38E: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/717A2DF8CE7E0E877B63E75675B2ACE7ABC52741: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/A107322D0EE5642C220DD9425840387F8CBD7A5A: MS Windows icon resource - 1 icon, 16x16
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/B9C0C1B588523E3FAD30635E9D7565B5C9BEC096: PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/8F89DD07083263C59A9EBE4658095945B98C27D5: GIF image data, version 89a, 15 x 15
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/B7AF0CEA5482F2D437DD10ABADC8051B44F4A1BB: JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, progressive, precision 8, 65x65, frames 3
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/7D50CBF9AE004B5C498F0A80BE70C64EAE748FC9: PNG image data, 640 x 480, 8-bit/color RGB, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/70B2302414B9B3DA2B453F4808114BC6A5800F40: PNG image data, 2300 x 864, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/C7C87946BC4E6C7350096836428266D565C19DA8: PNG image data, 20 x 16, 4-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/7A40AE6D4990AD25F47B8173F94B34BCB2835F15: PNG image data, 2300 x 8, 1-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/3D8D6E918E6FEC2D11BAE0ADD6FB491411E56289: PNG image data, 682 x 430, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/EA9E86D44642400F4A6F1B15B1E188F050B16162: PNG image data, 500 x 262, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/14EB1CEB6242533BCB8A8867D79674E80C5D7E45: GIF image data, version 89a, 17 x 17
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/9E878381EDCEB14546BCC540A2FEB47B234E9780: GIF image data, version 89a, 12 x 11
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/10277437F2A407A5216385E7BE876E802E01BD55: PNG image data, 20 x 20, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/B0C45A7C96FABB38BEFB35657D3245891300A81B: PNG image data, 13 x 477, 8-bit/color RGB, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/FCA7DEACB32B80EC06164980B57A6633833AA95D: GIF image data, version 89a, 20 x 20
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/37DC195BF564F4DE9A3E1EE638A75D15E97538F1: GIF image data, version 89a, 16 x 16
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/E38262D24A94821CA563751D33C057C6C29B55AE: GIF image data, version 89a, 20 x 20
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/838DC4172BEDCCF5257FA06EE193C0935549A69F: PNG image data, 20 x 20, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/8C65833B3FD494236F332A033923F841047CB784: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/7F2D59F942412327BA26BD992B3EA657DDBE6CC1: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/950C6CEC1DF4E391DDE609F4AAAFABB0A132A6CB: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/C25F6F2AC3B46C45269699C3D1E30C80A1B4C1D3: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/8158BA6FEAA3019B5F75C36A0CFDD7966B483D74: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/879D0BAAC3BE3AAE003CE25AE9CEA5F0681CFCAD: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/0C9CDF85612BDEDE155C91D0FE9021C9E4AE51D3: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/37AE2689BFF9BF6B0077422F7C715E023AA925BE: MS Windows icon resource - 1 icon, 32x32
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/EF5956C5699E653E0681EC174F75CEB810BF63C9: 8 2013, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/7B0213B9261803BFA23D4309B05004156B7C1E83: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/489F59171014A734B163A6E633606838719A9E68: data
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/52D65A2FDDA23FB809421DB879D6BC9BFE836C40: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/3A449DE8004F60265BEF591F9714E4B9079D3CB4: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 92x92, frames 3
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/34CAF1998E4AB73858DEEAF6899E608D569E3058: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 92x92, frames 3
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/F2AEEA1CF99B1D652471928A0563163AFD14E10B: gzip compressed data, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/DF1F56EBAEA252BE767CB4938E9BEDA2DD528E99: 6 2015, from Unix
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/B02F84778F3DE2A82383CE874AD05BEA6F459E2F: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 92x92, frames 3
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/E565CFC9CCE3E8C2C83EB2202A4B5E16AEB946BA: PNG image data, 92 x 92, 8-bit colormap, non-interlaced
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/76DCEE0261F42F4E937284D767AF494968EEAAA3: Web Open Font Format, flavor 65536, length 6744, version 1.0
[13:37:55]          /dev/shm/firefox-cache/cache2/entries/9BFEFCB6BE9B1A9C153378CE8301D8B95D6443F8: PNG image data, 172 x 268, 8-bit colormap, non-interlaced
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/9CD069E089CD561C5430F4B76C789D0FF8504F61: GIF image data, version 87a, 62 x 20
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/7E7796AEDABD756D8DFE170111275A9998ECE657: 0 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/6BA25E69541A83D7B7A4A652093D695748014A84: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/AFA40D374E6FDEE10E2E02513F16EDE49C0906BA: 8 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/869A08B2FBD62C33D0B8ADAF0B61302F751D6BBE: 2 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/497CCE483F2AFFE1F8B99BC5440F308A25ECFC38: 6 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/8BC9EE7C09995BA473743BE429049D54B3C72D9A: gzip compressed data, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/F1BB3585C41BDCB8553AE5016B3764DA8A1400A9: gzip compressed data, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/F4EBF14CED4230BC3D85F5EF8B4AB31C3ADC4CD9: 1 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CA25B625CA5D854C71264D4D674B4445F40DDE0B: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CF3C8292B0B17A12233E59CD877CA9D202FE383D: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/DCAEAE253CEE924A3A759D33B349DBD200B1B83F: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/245263896CA69D46195E039D2DB8A67EBA8865CA: gzip compressed data, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/45689D20B2F1C9E2B17B0D1C74BB562743065A8D: PNG image data, 85 x 20, 8-bit/color RGBA, non-interlaced
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/2F79A89AC78CB5B5D2A83B520FCE6004840B0ED6: Web Open Font Format, flavor 65536, length 44432, version 1.0
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/FA12B32D29D8B6BBE7ACBCA78AA534C03B0323CE: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/BB65C3FDFA296406FFE86C19666AC15ADD90BC93: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/EBA73D3CAE00877C815F7D9BCADD6B10FE4AB30B: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/F2B3A014EF48932E6F18CF09BB3CF501E23507EE: Web Open Font Format, flavor 65536, length 18572, version 1.1
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/E20D28F91E563C07B2D6BE866CE89F75B8529D7A: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/EFD7870902BF414F544CEF62EC2AE868ECB078E0: 5 2015, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/B19C5676CB14D34E2F97EA392BB62D808D0FA388: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/5A0ACC85B515C2FF09B5F3400E7EC477DA1855CA: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/C38A92D1DD3801E6594426AEE083287515F5A71C: Web Open Font Format, flavor 65536, length 18520, version 1.1
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CFFDDDD4B6AB6CAC84E19F444CC9AC624AC29158: Web Open Font Format, flavor 65536, length 18520, version 1.1
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/C25A555294CB3A622193CE64D6870A2D37F80097: PNG image data, 88 x 31, 8-bit/color RGBA, non-interlaced
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/06B35228FAF75751614DF17AD943286ECBAB7123: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CD9696A4C96513B60272E093E3F27D8A5DACF755: gzip compressed data, from Unix
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/90783AAC244965419E2BAF67DEA64ACA68296BED: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CCA78DFD57FD88BF9CAAC66F6CE92450C7B30DDC: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/A1F022BEC01E9EE7071515CC1B4B2A3072A10EDE: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/73056C0C9C0CF6D698D71D20917BA534AFAEC0E6: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/E31179A79253C45DFE9BD75B111DAD0FA742299D: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/DEF5253B0982A61614BF0FA079B161B51368DE7B: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/E69FD583B69560369EA762FBAB332BE23F3F11BD: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/3A61B19065BB31340F80BFDF48C0378905CEF92C: MS Windows icon resource - 2 icons, 32x32
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/CAFEC808BAC68DD94B75637B15A1343BD3FE1B31: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/0B8235C7BE856A9705E9A21E17728AB7E18827CB: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/90E9CF65EEB17543D05EA3AFCC5AEE9895CC8CDA: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/DDCC00CE35E78E35E3BCFB103AEA6CF9E8CAC247: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/62B14E6B5BB38340D28AF9BFCB9653667E53B0F2: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/62EFE2D8086922BC6F04257347116BBCFC907D9A: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/DC19FD49638CF3438681747958CDF89B6809B0D6: data
[13:37:56]          /dev/shm/firefox-cache/cache2/entries/6D992E37DB763A3B1E9461246F9F22143C726AE7: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/968F3F72BB43307EE244A9CE8903718B832DEEE9: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/B206CBBF24BDD0EF9D4763CB287BD82D71FCE60B: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/6A66EBCD3EA0DF4AB3A7590292EEFB459152C3C0: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/6E78134A7A411A4D25EB6E51494051B9AF4F8AE5: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/38654D40C7074D05CC276AFB66E8CA13B5418768: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/006698474FAF8166866E04C9912420ED53482208: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/240B7635996A39B56BECAC3888EC3ACBD2AA04D3: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/6A6A86D25895C75464E5E76E00245F94D982EE10: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/41826380E868BD93F568FB82A611C63D19687B2F: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/FA518C0EDF17A03128DA2CA827E5A60237BDC913: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/993CFF8980A4726993615998F092958F74B45DBF: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/62F8B51762D40ED2D5699CB602094C71A4E0ABAB: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/9AB4B9E7AC0A6D761E1EBF9C74D6FF2A31F9AA06: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/3CFEF3A43483999E67063481F1FC000C57DD9781: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/8BBE74ABF6073CF212C74AFEDF69025AF580A5AA: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/7573DC552D83168E5CF32B3B99E5F807F06180BA: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/E4FD598C3F5D1D5048F7B5B7712E9DF3BD26A6A7: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/EE45024F9CE46F13360202FBBA170474ADD134BE: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/0BDB1479A05415957B28E59ADDD0D6FFB91AEDC1: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/7E920528CED1AE40AEEF84F463213C6286281CDF: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/44718EDEB05393301E618D16D83B96DDAD68BA6D: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/64CA8E51AAF2C04A5DC7697304532EA49AD9D4B6: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/1350AB13B40992B7A693C2EA05F9AFF1BC1AB799: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/E3B37A0597745C7540135B96535444605CA45EB7: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/2537967E2057BE50887F75BDDE589B6BA5236495: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/2DACB8BF02142A0332FA6461EEF15CE6261C7BF3: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/9588D4CA4916ED535257B5AB6223CD994A4381CB: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/BFD51DD91868A5B0AA7718434982C16A6583458A: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/065AC861F9F4BB52CEB7C8B5504CE88EDB12A5FC: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/D7952E7244F5DE486431810F0179673CBD9DAAB4: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/B7655DD94B84CC1E6DC70A36CC6D9CE1CE0AD473: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/9F4B2AE71440411CDF6D7E0116E6249671284E15: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/9AD6BB3B7D5CE9BC17BE984BD8C5D8D29427E3DC: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/1D90EF3479D52FC9133BCEFD47258DF753C74E93: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/5577FB8F4BC0AC399DC062A0C743D5600C09A8D5: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/65D1ACDF24FBF14A60B67E54F2EDEE3AD39D13C9: data
[13:37:57]          /dev/shm/firefox-cache/cache2/entries/69039A30FDD685608B6332B5861A03345E3EA119: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/133166698: PNG image data, 133 x 45, 8-bit/color RGBA, non-interlaced
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/1479524045: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/467187886: PNG image data, 16 x 16, 8-bit colormap, non-interlaced
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/1811313265: data
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/2079861594: gzip compressed data, from Unix
[13:37:57]          /dev/shm/firefox-cache/cache2/doomed/1676875071: MS Windows icon resource - 3 icons, 16x16
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1567446770: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/141627868: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1106960209: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/602061290: gzip compressed data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1214894046: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/249108882: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/187082985: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1974939033: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/708840958: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/275784288: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1643429078: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/313041559: 5 2015, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/512098380: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1772577200: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/721080402: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/538548566: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/872120556: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1014475752: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/2121391828: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1399230601: 0], baseline, precision 8, 672x371, frames 3
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1127492194: 6 2015, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1099483373: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/759603884: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1519043393: gzip compressed data, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1182462051: PNG image data, 16 x 16, 8-bit colormap, non-interlaced
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1267643317: gzip compressed data, max compression
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1990036858: PNG image data, 672 x 371, 8-bit/color RGB, non-interlaced
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1611342151: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/457451552: PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/712044404: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1754995562: SVG Scalable Vector Graphics image
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/787630356: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/148166074: 6], baseline, precision 8, 672x371, frames 3
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1242938804: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 672x371, frames 3
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/277610177: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/530202033: data
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/388997953: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1190856169: MS Windows icon resource - 3 icons, 16x16
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/625614452: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/590406304: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/547725169: 0 2015, from Unix
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1585763503: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:58]          /dev/shm/firefox-cache/cache2/doomed/1551360950: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 106x59, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1937875686: PNG image data, 172 x 268, 8-bit colormap, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/484166205: Web Open Font Format, flavor 65536, length 44404, version 1.1
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1357225554: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/514358000: SVG Scalable Vector Graphics image
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1837415278: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/421726790: data
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1465069330: gzip compressed data, from Unix
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1116777576: 2 2015, from Unix
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1991829442: 8 2015, from Unix
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1149884523: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1810745237: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 106x59, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/635879165: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 106x59, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1039877079: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/820308900: PNG image data, 300 x 46, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/2137261598: data
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/402893983: gzip compressed data, from Unix
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1045879433: PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/367935955: Web Open Font Format, flavor 65536, length 65660, version 1.1
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1501887842: gzip compressed data
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/763656184: PNG image data, 19 x 16, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/108153033: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1761739862: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 672x371, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/28958727: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/290775950: PNG image data, 16 x 18, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1022333005:<SP>Sendmail<SP>frozen<SP>configuration<SP><SP>-<SP>version<SP>VÊÝ<.?—ÿÿÿÿ: Sendmail frozen configuration  - version VÊÝ<.—ÿÿÿÿ
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/983326108: MS Windows icon resource - 1 icon, 16x16
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/956377441: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=3, software=paint.net 4.0.5], baseline, precision 8, 672x371, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1949031262: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 106x59, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/453559514: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/2081068250: data
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1280177501: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/307493239: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/576298340: GIF image data, version 89a, 5 x 13
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1860055356: PNG image data, 672 x 371, 8-bit/color RGB, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/108261065: [TIFF image data, big-endian, direntries=12, height=815, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1300], progressive, precision 8, 672x371, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/684018054: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 106x59, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/2018627678: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1508701337: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1760394063: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1416419599: [TIFF image data, big-endian, direntries=4, xresolution=62, yresolution=70, resolutionunit=3, software=paint.net 4.0.5], baseline, precision 8, 672x371, frames 3
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/1379599140: GIF image data, version 87a, 62 x 20
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/572835715: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/843700968: gzip compressed data, from Unix
[13:37:59]          /dev/shm/firefox-cache/cache2/doomed/503248129: 6 2015, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1846505754: 1 2015, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1788662854: gzip compressed data, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1436143571: gzip compressed data, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1671951345: data
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/100905901: PNG image data, 92 x 92, 8-bit/color RGB, non-interlaced
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/670867376: data
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1367514625: 5 2015, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/109432348: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/25397191: PNG image data, 92 x 92, 8-bit colormap, non-interlaced
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/302349025: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 672x371, frames 3
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1274093719: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1086475816: data
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1347108840: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1614643132: gzip compressed data, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1392433923: gzip compressed data, from Unix
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/2133479754: gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1019348607: data
[13:38:00]          /dev/shm/firefox-cache/cache2/doomed/1316879671: PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

Should I be worried? - Come to think of it iceweasel has been slow to load lately.


Debian 12 Beardog, SoxDog and still a Conky 1.9er

Offline

#3 2015-10-10 16:47:28

Sector11
Mod Squid Tpyo Knig
From: Upstairs
Registered: 2015-08-20
Posts: 8,026

Re: chkrootkit result questions

twoion wrote:

You need to analyse the respective files manually to be sure of their contents.

OK, thank ... I'll have to try and find what I am suppose to be looking for as I have NO CLUE!


Debian 12 Beardog, SoxDog and still a Conky 1.9er

Offline

#4 2015-10-10 16:54:09

Sector11
Mod Squid Tpyo Knig
From: Upstairs
Registered: 2015-08-20
Posts: 8,026

Re: chkrootkit result questions

Just a curious question:

/dev/shm/firefox-cache/cache2/

What would happen if I deleted (renamed and or moved) this directory?


Debian 12 Beardog, SoxDog and still a Conky 1.9er

Offline

#5 2015-10-10 22:20:13

tknomanzr
BL Die Hard
From: Around the Bend
Registered: 2015-09-29
Posts: 1,057

Re: chkrootkit result questions

It is safe to dump it. It's just an internet cache file. Images, cookies, etc. In fact, if you wanted too, you could trim it periodically instead of deleting it. If you trimmed it to say 5 MB or 10MB, it would have some short term memory. It is not necessary to have a cache but it certainly does speed things up on sites you visit a lot. Of course, cookies can always be a concern depending on where you end up on the internet.

Offline

#6 2015-10-10 22:47:08

Sector11
Mod Squid Tpyo Knig
From: Upstairs
Registered: 2015-08-20
Posts: 8,026

Re: chkrootkit result questions

Well cookies are suppose to be deleted when I close Iceweasel.  Is that what all those are ... cookies?


Debian 12 Beardog, SoxDog and still a Conky 1.9er

Offline

#7 2015-10-10 22:52:04

tknomanzr
BL Die Hard
From: Around the Bend
Registered: 2015-09-29
Posts: 1,057

Re: chkrootkit result questions

Cookies, images. Sometimes video streams that don't end up deleted, particularly for short flash animations that litter web pages. Stuff like that. You will see .css sheets, javascripts, etc in there. Just web p age litter. Likely you can set the trim up for none or more from directly within firefox's settings.

Offline

Board footer

Powered by FluxBB