chkrootkit says "grep --color=auto INFECTED," what should I do?

Question

I just installed and ran chkrootkit for the first time and when I ran sudo chkrootkit | grep INFECTED, it returned ![user] 21342 pts/0 grep --color=auto INFECTED

I'm a complete novice at this and have no idea what that means or what I should do. Any explanation or help would be very welcome!

My OS is Ubuntu 22.04.1 (Jammy) and as far as I know everything's up to date. I have dual boot with Windows 10 but never use windows, and I have an external monitor that occasionally sends my laptop into a weird ^@^@ errorscreen until I disconnect it, in case that's related somehow??

Thank you for any help!

chrootkit prints some processes' details, but those processes may or may not be problematic. In this case you're seeing the process details of the grep command in sudo chkrootkit | grep INFECTED itself (if you run type grep, you'll see it's an alias to grep --color=auto). — muru, Nov 24 '22 at 09:52
please use sudo chkrootkit | grep "[I]NFECTED" to search. The [ ] make it a regex and makes it not show up in the results. Or use pgrep instead of grep — Rinzwind, Nov 24 '22 at 09:59
Related: Why does ps output show a process even if it is not running? — steeldriver, Nov 24 '22 at 13:06

score 2 · Answer 1 · answered Nov 24 '22 at 11:29

The tool grep simply looks for a specific string in its input. In this case, its input is the output of sudo chkrootkit which apparently prints out information about running processes. One of these running processes is the grep command you launched. Now, on Ubuntu, grep is actually aliased to grep --color=auto which means that when you run grep INFECTED, you are actually running:

grep --color=auto INFECTED

So what is happening here is that the output of chkrootkit includes the running grep command and since the grep command includes the string INFECTED that is being shown in your results. This doesn't mean you have a rootkit or that grep is infected or anything else.

chkrootkit says "grep --color=auto INFECTED," what should I do?

1 Answers1