Can not initiate rkhunter 1.2.9

[gogalthorp]

I'm confused is it XP or Linux that is slowing down and connecting to the web?

I was speaking about the updater in Suse.

[cousinlucky]

I do not update suse either. Whatever it is it " parks itself " into the bootloader. When I start my computer there should be only two grub entries. If there is another one I know that I need to run the repair program to get rid of it before I go on-line.

[gogalthorp]

Now you have confused me totally

The grub menu selections are defined in a file called

/boot/grub/menu.lst

In order to change or even read this file a process or a user must have root permissions.

The actual boot sector record does not have control of the menu is simply start the grub program which uses menu.lst to make a menu. Each menu item as the information to start the kernel or OS the menu item represents.

When the problem appears could you post the content of the /boot/grub/menu.lst
file. You will need to be root to view it.

[gogalthorp]

After some thought I suppose a Windows process (Virus) could access the Linux partition and modify the menu.lst file bypassing the Linux security. I find this unlikely since in general Windows does not know how to access Linux file systems. But if you are going to do that why that file? It would be just as easy to replace any file that would be less obvious.

What is this new entry?

[Jonathan183]

I do not update suse either. Whatever it is it " parks itself " into the bootloader. When I start my computer there should be only two grub entries. If there is another one I know that I need to run the repair program to get rid of it before I go on-line.

I suggest you post the output of cat /boot/grub/menu.lst before you do the repair - that way we can see what you are talking about and the data added to the menu.lst file. You could re-write grub code to the MBR using Linux (YAST or manually at the terminal) to ensure a bootloader virus is not responsible for problems ... although as gogalthorp said ... it is unlikely. You could always give something like clamav a run and see what is reported.

[cousinlucky]

Gentlemen, I will attempt to gather the file data you request the next time this thing shows up. I have only been able to read the first word ( initializing ) of the thre short lines that flash onto my computer screen with the grib for linux and the grub for windows.

With all of the back doors and phone home programs build into windows; I'm sure microsoft has a way to be alerted whenever any of its software is on anyones computer whether they go on line using windows or not.

Of course I could be mistaken; it could be my ISP or a software program created by a mischief maker. All that I am sure of is something causes my computer to send something somewhere!

My heartfelt thanks for the help and interest!!

[cousinlucky]

I just ran rkhunter and it says that:

GnuPG 1.4.2 is vulnerable
openSSl 0.9.7g is vulnerable

What does that mean?

[gogalthorp]

Did you read the faqs?

SourceForge.net: Rootkit Hunter FAQ

[cousinlucky]

OK , Gogalthorp below is the menu list from my boot/grub file!

# Modified by YaST2. Last modification on Wed Dec 17 15:15:42 EST 2008

color white/blue black/light-gray
default 0
timeout 8
gfxmenu (hd0,6)/boot/message

###Don't change this comment - YaST2 identifier: Original name: linux###
title SUSE LINUX 10.0
root (hd0,6)
kernel /boot/vmlinuz root=/dev/hda7 vga=0x31a selinux=0 resume=/dev/hda6 splash=silent showopts
initrd /boot/initrd

###Don't change this comment - YaST2 identifier: Original name: windows###
title Windows
chainloader (hd0,0)+1

###Don't change this comment - YaST2 identifier: Original name: floppy###
title Floppy
chainloader (fd0)+1

###Don't change this comment - YaST2 identifier: Original name: failsafe###
title Failsafe -- SUSE LINUX 10.0
root (hd0,6)
kernel /boot/vmlinuz root=/dev/hda7 vga=normal showopts ide=nodma apm=off acpi=off noresume selinux=0 nosmp noapic maxcpus=0 edd=off 3
initrd /boot/initrd

[gogalthorp]

the file looks correct. your menu option should be

Suse Linux 10.0
Windows
Floppy
Failsafe -- SUSE LINUX 10.0


default 0
timeout 8
The screen should pause 8 seconds before booting to Suse the 0th menu item
If you hit a key the timeout ought to stop.

A new item is shown on this menu at times correct? Or is this something you get before or after this menu shows?

Is this about the last time you saw the problem
Wed Dec 17 15:15:42 EST 2008