Re: [gentoo-user] chkrootkit LKM trojan ?

["Hemmann, Volker Armin" <volker.armin.hemmann@tu-clausthal.de>]

On Sunday 16 July 2006 20:25, Dave S wrote:
> HI, I have a potential security problem ...
>
> and err its not on gentoo, its on ubuntu but I am not getting any response
> there & you guys are the most tech bunch I know  - Thought I would lay it
> on the table :)
>
> I just had an email from chkrootkit last night -
>
> ---
>
> The following suspicious files and directories were found:
>
> You have     3 process hidden for readdir command
> You have     3 process hidden for ps command
> chkproc: Warning: Possible LKM Trojan installed
>
> ---
>
> Running chkrootkit now and all is OK
>
> root@dave-comp:~#
> root@dave-comp:~# chkrootkit | grep chkproc
> Checking `lkm'... chkproc: nothing detected
> root@dave-comp:~#
>
> I have even 'sudo install --reinstall chkrootkit' in case its binarys have
> been modified (paranoid)

if you installed using the tools of the system, it could be worthless, because 
compromised. Boot from a cd and check from the cd.
-- 
gentoo-user@gentoo.org mailing list