I've never really tried to understand rootkit enough, I'm too much paranoid...

I recently reinstalled mountain lion, but my EFI might be infected.

I have a macbook pro, it was really slow at some point that week, I could not manage to make an Apple Hardware test, it was weird since I have mountain lion.

Are there known false positives for rkhunter ?

Oddly downloading chkrootkit brings a "Unable to connect" error in firefox, I'm a little worried.

Here are some selected lines from the rkhunter log

Performing file properties checks
  Checking for prerequisites                               [ Warning ]
  /usr/bin/fuser                                           [ Warning ]
  /usr/bin/whatis                                          [ Warning ]
  /usr/bin/shasum                                          [ Warning ]

Performing check of known rootkit files and directories
  Dica-Kit Rootkit                                         [ Warning ]

Performing additional rootkit checks
  Checking for possible rootkit strings                    [ Warning ]

Performing system boot checks
  Checking for system startup files                        [ Warning ]

Performing system configuration file checks
  Checking if SSH root access is allowed                   [ Warning ]
  Checking if SSH protocol v1 is allowed                   [ Warning ]

Performing filesystem checks
  Checking for hidden files and directories                [ Warning ]

Here is the full log http://pastebin.com/x0A2XVFi

PS: I would kind if an OS X user could run rkhunter on his machine to check if there also are false positives...

2 Answers 2


rkhunter is pretty old and you should pay people to perform security analysis on your systems. Try running it against a fresh install, and diff the results with your run. That being said, this is still no guarantee that you are safe. If you suspect you have been rootkit'ed then you should reinstall OSX.

  • 1
    I agree, if you have any doubt about your system, start it over, why taking any risk?
    – happy
    Dec 30, 2012 at 7:36
  • I already did reinstall OSX. What do you mean by running it against a fresh install ?
    – jokoon
    Jan 4, 2013 at 19:36
  • Format the drive and start with a fresh installation of OSX.
    – g3k
    Jan 4, 2013 at 21:26

I get the same. Sounds like a false positive.

Now since I knew that the RKhunter program is just a script, it seemed reasonable NOT to panic, since such scripts generally lack the sophisticated heuristics needed to correctly filter false-positives.

A quick check of the RKhunter rootkit “/var/log/rkhunter.log” log-file revealed the following:

[21:48:24] Warning: Dica-Kit Rootkit                         [ Warning ]
[21:48:24]          File '/etc/sshd_config' found
[21:48:24]          File '/etc/ssh_host_key' found

(from http://hardcoreforensics.com/blog/2011/02/15/mac-os-x-and-the-dica-kit-root-kit/)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .