Проверка Ubuntu на rootkit

[CyberTramp]

    Как их вилечить ?
[

(Нажмите, чтобы показать/скрыть)

13:56:25] /usr/bin/who                                      [ Warning ]
[13:56:25] Warning: The file properties have changed:
[13:56:25]          File: /usr/bin/who
[13:56:25]          Current hash: 36a2fc90aab635fd4a62a10d2da3d96a0946f275
[13:56:25]          Stored hash : 7d228fad000087cc1dd6d7239bcefee30d20b825
[13:56:25]          Current inode: 148424    Stored inode: 132368
[13:56:25]          Current file modification time: 1285093976 (21-Сен-2010 21:32:56)
[13:56:25]          Stored file modification time : 1267760477 (05-Мар-2010 05:41:17)
[13:56:26] /usr/bin/whoami                                   [ Warning ]
[13:56:26] Warning: The file properties have changed:
[13:56:26]          File: /usr/bin/whoami
[13:56:26]          Current hash: 86c9b205111b904ef2d6282ce73102920c0cc78f
[13:56:26]          Stored hash : a5d555c16a295f6e2af02f6a556843f392d8517a
[13:56:26]          Current inode: 148465    Stored inode: 132369
[13:56:26]          Current file modification time: 1285093976 (21-Сен-2010 21:32:56)
[13:56:26]          Stored file modification time : 1267760477 (05-Мар-2010 05:41:17)
[13:56:26] /usr/bin/gawk                                     [ OK ]
[13:56:27] /usr/bin/lwp-request                              [ Warning ]
[13:56:27] Warning: The file properties have changed:
[13:56:27]          File: /usr/bin/lwp-request
[13:56:27]          Current inode: 136234    Stored inode: 131797
[13:56:27]          Current file modification time: 1282937552 (27-Авг-2010 22:32:32)
[13:56:27]          Stored file modification time : 1262883889 (07-Янв-2010 19:04:49)
[13:56:27] Info: Found file '/usr/bin/lwp-request': it is whitelisted for the 'script replacement' check.
[13:56:27] /usr/bin/w.procps                                 [ OK ]
[13:56:28] /sbin/depmod                                      [ OK ]
[13:56:29] /sbin/ifconfig                                    [ OK ]
[13:56:29] /sbin/ifdown                                      [ Warning ]
[13:56:30] Warning: The file properties have changed:
[13:56:30]          File: /sbin/ifdown
[13:56:30]          Current hash: 3958c59e84e0bf41cfab0ccd63d40695ec2ac7ec
[13:56:30]          Stored hash : 43e2cd195e6ab819c3f8d0463eb5ccdbf72e3e13
[13:56:30]          Current inode: 2228243    Stored inode: 2228276
[13:56:30]          Current file modification time: 1282026148 (17-Авг-2010 09:22:28)
[13:56:30]          Stored file modification time : 1266647508 (20-Фев-2010 08:31:48)
[13:56:30] /sbin/ifup                                        [ Warning ]
[13:56:30] Warning: The file properties have changed:
[13:56:30]          File: /sbin/ifup
[13:56:30]          Current hash: 3958c59e84e0bf41cfab0ccd63d40695ec2ac7ec
[13:56:30]          Stored hash : 43e2cd195e6ab819c3f8d0463eb5ccdbf72e3e13
[13:56:31]          Current inode: 2228243    Stored inode: 2228278
[13:56:31]          Current file modification time: 1282026148 (17-Авг-2010 09:22:28)
[13:56:31]          Stored file modification time : 1266647508 (20-Фев-2010 08:31:48)
 /usr/sbin/adduser                                 [ OK ]
[13:56:37] Info: Found file '/usr/sbin/adduser': it is whitelisted for the 'script replacement' check.
[13:56:37] /usr/sbin/chroot                                  [ Warning ]
[13:56:37] Warning: The file properties have changed:
[13:56:38]          File: /usr/sbin/chroot
[13:56:38]          Current hash: 77eddb458ad439eac415230b009a5cc3da8b679f
[13:56:38]          Stored hash : 70c3b3c0f91caee262468582618434fa070d01af
[13:56:38]          Current inode: 148421    Stored inode: 140718
[13:56:38]          Current file modification time: 1285093976 (21-Сен-2010 21:32:56)
[13:56:38]          Stored file modification time : 1267760477 (05-Мар-2010 05:41:17)/usr/sbin/inetd                                   [ Warning ]
[13:56:40] Warning: The file '/usr/sbin/inetd' exists on the system, but it is not present in the rkhunter.dat file.

 Performing system boot checks
[14:00:02] Info: Starting test name 'startup_files'
[14:00:02]   Checking for local host name                    [ Found ]
[14:00:02] Info: Starting test name 'startup_malware'
[14:00:02]   Checking for system startup files               [ Found ]
[14:00:05]   Checking system startup files for malware       [ None found ]
[14:00:05]
[14:00:05] Performing group and account checks
[14:00:05] Info: Starting test name 'group_accounts'
[14:00:06]   Checking for passwd file                        [ Found ]

[CyberTramp]

UPS