chkrootkit output

[Alan Cox]

On Tue, 08 May 2012 10:46:13 -0600
JD <jd1008 at gmail.com> wrote:

> Searching for Suckit rootkit... Warning: /sbin/init INFECTED
> 
> lrwxrwxrwx 1 root root 14 May  8 10:19 /sbin/init -> ../bin/systemd
> rwxr-x-r-x    1 root root 917320 Apr 17 01:50 /bin/systemd
> $ sha256sum /bin/systemd
> 73054e573603f8894c6df2078b7714f7533d5b95653b536e7f07d2c8f3f09bc1  
> /bin/systemd
> 
> Is chkrootkit confused?

Yes and no. It correctly detects that your /sbin/init is something hideous
and nasty, but fails to realise that it's something hideous and nasty that
Fedora ships 8)

In all seriousness its a bug in chkrootkit, which has been reported
repeatedly and ignored repeatedly. It treats the linked /sbin/init as
suspicious because some rootkits did exactly that.

Alan