Chkrootkit found a lot of suspicious files and directories, and /sbin/init INFECTED

Question

I was just running chkrootkit on my Fedora 20 x86_64. Here are some dubious results. Anyone know if these are false positives? Do I have a compromised system?

Here are the suspect files and directories:

Searching for suspicious files and dirs, it may take a while... 

/usr/lib/.libgcrypt.so.11.hmac /usr/lib/python2.7/site-packages/martian
/testswithbogusmodules/.bogussubpackage /usr/lib/python2.7/site-packages/fail2ban
/tests/files/config/apache-auth/digest_time/.htaccess /usr/lib/python2.7/site-
packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd /usr/lib
/python2.7/site-packages/fail2ban/tests/files/config/apache-auth/noentry
/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache-
auth/basic/file/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files
/config/apache-auth/basic/file/.htpasswd /usr/lib/python2.7/site-packages/fail2ban
/tests/files/config/apache-auth/basic/authz_owner/.htaccess /usr/lib/python2.7
/site-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner
/.htpasswd /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache-
auth/digest_anon/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files
/config/apache-auth/digest_anon/.htpasswd /usr/lib/python2.7/site-packages
/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess /usr/lib
/python2.7/site-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm
/.htpasswd /usr/lib/python2.7/site-packages/fail2ban/tests/files/config/apache-
auth/digest/.htaccess /usr/lib/python2.7/site-packages/fail2ban/tests/files/config
/apache-auth/digest/.htpasswd /usr/lib/python2.7/site-packages/pylons/docs/en
/.gitignore /usr/lib/python2.7/site-packages/pylons/templates/default_project
/+package+/templates/.distutils_placeholder /usr/lib/python2.7/site-packages
/pylons/templates/minimal_project/+package+/templates/.distutils_placeholder
 /usr/lib/.libssl.so.1.0.1e.hmac /usr/lib/.libcrypto.so.1.0.1e.hmac /usr/lib
/.libssl.so.10.hmac /usr/lib/debug/.build-id /usr/lib/debug/usr/.dwz /usr/lib
/debug/.dwz /usr/lib/mono/xbuild-frameworks/.NETFramework /usr/lib
/.libcrypto.so.10.hmac

    /usr/lib/python2.7/site-packages/martian/tests/withbogusmodules
/.bogussubpackage /usr/lib/debug/.build-id /usr/lib/debug/.dwz /usr/lib
/mono/xbuild-frameworks/.NETFramework

---

And then there was this:

Searching for Suckit rootkit... Warning: /sbin/init INFECTED

---

Finally:

Checking `chkutmp'...  The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! root         1631 tty1   /usr/bin/X :0 vt1 -background none -nolisten tcp -seat seat0 -auth /var/run/kdm/A:0-EiPPra
chkutmp: nothing deleted
Checking `OSX_RSPLUG'... not infected

Answer 1

There are reported false positives where chkrootkit thinks it's found Suckit on a clean system. The Fedora bug report indicates that chkrootkit is still broken as of Fedora 20.

Having no utmp entry for an X server is normal if nobody is logged in (if it's showing the GUI login prompt).

So these results don't indicate that your system is infected. It doesn't mean that your system is clean, of course: a well-designed rootkit is by definition undetectable.