最近，我非常怀疑有人破坏了我的系统。我感觉标签有时会发生变化。例如，我在 Chrome 上执行某些操作时，它突然显示 Opera 屏幕（尽管它们都在运行，但我从未点击过 Opera 屏幕）之类的。
所以我下载了 rkhunter，通过运行进行了测试sudo rkhunter -c --enable all --disable none。我的输出如下。这些都是假警告吗？还是我实际上应该担心什么？
Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script, ASCII text executable
Warning: The following processes are using deleted files:
Process: /sbin/upstart PID: 1394 File: /home/qwerty/.cache/upstart/window-stack-bridge.log.1
Process: /usr/bin/nautilus PID: 1806 File: /home/qwerty/.local/share/gvfs-metadata/home
Process: /opt/google/chrome/chrome PID: 2001 File: /dev/shm/.com.google.Chrome.bsY3ZP
Process: /bin/cat PID: 2007 File: /dev/pts/7
Process: /bin/cat PID: 2008 File: /dev/pts/7
Process: /opt/google/chrome/chrome PID: 2147 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 2220 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 2222 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 2682 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 2992 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 3491 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /usr/lib/firefox/firefox PID: 3626 File: /dev/pts/7
Process: /opt/google/chrome/chrome PID: 3760 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /usr/lib/firefox/firefox PID: 3824 File: /dev/pts/7
Process: /opt/google/chrome/chrome PID: 4057 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /usr/bin/unity-scope-loader PID: 4331 File: /tmp/tmpfHAIWlu
Process: /usr/share/discord/Discord PID: 5634 File: /dev/shm/.org.chromium.Chromium.k92K46
Process: /usr/share/discord/Discord PID: 5687 File: /dev/shm/.org.chromium.Chromium.k92K46
Process: /usr/share/discord/Discord PID: 5712 File: /dev/shm/.org.chromium.Chromium.5ZDa2W
Process: /opt/google/chrome/chrome PID: 6182 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 7917 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 24709 File: /dev/shm/.com.google.Chrome.rKGMNn
Process: /opt/google/chrome/chrome PID: 28812 File: /dev/shm/.com.google.Chrome.rKGMNn
Warning: File '/tmp/.org.chromium.Chromium.mEHtjR' (score: 274) contains some suspicious content and should be checked.
Warning: Checking for files with suspicious contents [ Warning ]
Warning: Process '/sbin/dhclient' (PID 1036) is listening on the network.
Warning: Suspicious file types found in /dev:
/dev/shm/pulse-shm-1350328584: data
/dev/shm/pulse-shm-731875246: data
/dev/shm/pulse-shm-2797972517: data
/dev/shm/pulse-shm-2509473639: data
/dev/shm/pulse-shm-477054089: data
/dev/shm/pulse-shm-934396546: data
/dev/shm/pulse-shm-2102280203: data
/dev/shm/pulse-shm-3302084726: data
/dev/shm/pulse-shm-528687106: data
/dev/shm/pulse-shm-3145487857: data
/dev/shm/pulse-shm-1815311782: data
/dev/shm/pulse-shm-2150163244: data
/dev/shm/pulse-shm-3711979297: data
/dev/shm/pulse-shm-194223215: data
/dev/shm/pulse-shm-2010166027: data
答案1
在快速检查了您的输出以及rkhunter 操作指南您的输出中唯一让我担心的是“文件‘/tmp/.org.chromium.Chromium.mEHtjR’（得分：274）包含一些可疑内容，应进行检查。”由于这是在您的 /tmp 文件夹中，因此很可能在重新启动后它就会消失，但再次检查也不会有什么坏处。据我了解，您应该首先sudo rkhunter --propupd更新文件属性数据库（每次安装新软件时都必须这样做）请参阅如何了解详情。
sudo rkhunter --versioncheck会告诉您是否有比您正在使用的版本更新的版本。
/dev/shm 中的可疑文件类型看起来像是正常的 pulseaudio 文件，但外表可能具有欺骗性，因此我不能保证。
您可能希望订阅Rootkit Hunters 邮件列表这是有关误报的良好信息来源。
资料来源：
https://help.ubuntu.com/community/RKhunter
man rkhunter