Are they false ?

[bitsnpcs]

I have done searching it says chkrootkit Ebury is a known false positive, relate to -G

To test for Ebury older versions using shared memory segments I ran

Code:

sudo find /lib* -type f -name libns2.so

Clean

To test for Ebury newer version using Unix domain sockets I ran

Code:

sudo netstat -nap | grep "@/proc/udevd"

Clean

To prevent false positive due to added -G it uses -e Gg in this command, where I found an explanation of the command on Ubuntu threads.

Code:

ssh -G 2>&1 | grep -e illegal -e unknown -e Gg > /dev/null && echo "System clean" || echo "System infected"

The result was -