[PLASMA 5] Suspicious activity

[linelocker]

Anew install of 24.03 ran chkrootkit and I saw this:

Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:
/usr/lib/modules/6.2.0-26-generic/vdso/.build-id
/usr/lib/modules/6.2.0-20-generic/vdso/.build-id
/usr/lib/debug/.build-id
/usr/lib/libreoffice/share/.registry
​

I don't know what this means. Should I worry?

[Snowhog]

Short answer: No

[GreyGeek]

There is more info here: https://www.chkrootkit.org/
I stopped going on that rabbit chase years ago.
The most likely way to acquire malware is by social engineering, and even that is hard. First, YOU have to download it. Then YOU have to add the execute permission. Then YOU have to run it.

If I download a tar file or deb package from a reliable source it most likely contains a shell script or an executable. I usually open those with Ark and check for executable shell scripts or binaries. I read the scripts and examine the executables with Okteta.

The binaries in the repository have been checked and if you stick to them you won't have any infections.