[gentoo-user] chkrootkit LKM trojan ?

[Dave S <gentoo@pusspaws.net>]

HI, I have a potential security problem ... 

and err its not on gentoo, its on ubuntu but I am not getting any response 
there & you guys are the most tech bunch I know  - Thought I would lay it on 
the table :)

I just had an email from chkrootkit last night -

---

The following suspicious files and directories were found:

You have     3 process hidden for readdir command
You have     3 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

---

Running chkrootkit now and all is OK

root@dave-comp:~#
root@dave-comp:~# chkrootkit | grep chkproc
Checking `lkm'... chkproc: nothing detected
root@dave-comp:~#   

I have even 'sudo install --reinstall chkrootkit' in case its binarys have 
been modified (paranoid)

Running rkhunter shows no problems

I am at a bit off a loss and would value some advice / opinions. I can see two 
possibilities

(a) I have a trojan, seems unlikely I am behind a netgear router firewall NAT 
with no incoming ports open. Running nothing more than samba, ssh and unison 
on the local network though I have to admit I have not hardened my system.

(b) Its a false alarm - it is called by /etc/cron.daily so a lot of different 
scripts are called at the same time - though I have no idea what could have 
caused it.

Any help / advice greatfully received

Dave
-- 
gentoo-user@gentoo.org mailing list