Macbook pro, rootkithunter

Question

I've never really tried to understand rootkit enough, I'm too much paranoid...

I recently reinstalled mountain lion, but my EFI might be infected.

I have a macbook pro, it was really slow at some point that week, I could not manage to make an Apple Hardware test, it was weird since I have mountain lion.

Are there known false positives for rkhunter ?

Oddly downloading chkrootkit brings a "Unable to connect" error in firefox, I'm a little worried.

Here are some selected lines from the rkhunter log

Performing file properties checks
  Checking for prerequisites                               [ Warning ]
  /usr/bin/fuser                                           [ Warning ]
  /usr/bin/whatis                                          [ Warning ]
  /usr/bin/shasum                                          [ Warning ]

Performing check of known rootkit files and directories
  Dica-Kit Rootkit                                         [ Warning ]

Performing additional rootkit checks
  Checking for possible rootkit strings                    [ Warning ]

Performing system boot checks
  Checking for system startup files                        [ Warning ]

Performing system configuration file checks
  Checking if SSH root access is allowed                   [ Warning ]
  Checking if SSH protocol v1 is allowed                   [ Warning ]

Performing filesystem checks
  Checking for hidden files and directories                [ Warning ]

Here is the full log http://pastebin.com/x0A2XVFi

PS: I would kind if an OS X user could run rkhunter on his machine to check if there also are false positives...

Answer 1

rkhunter is pretty old and you should pay people to perform security analysis on your systems. Try running it against a fresh install, and diff the results with your run. That being said, this is still no guarantee that you are safe. If you suspect you have been rootkit'ed then you should reinstall OSX.