* [gentoo-user] chkrootkit LKM trojan ?
@ 2006-07-16 18:25 99% Dave S
0 siblings, 0 replies; 1+ results
From: Dave S @ 2006-07-16 18:25 UTC (permalink / raw
To: Gentoo list
HI, I have a potential security problem ...
and err its not on gentoo, its on ubuntu but I am not getting any response
there & you guys are the most tech bunch I know - Thought I would lay it on
the table :)
I just had an email from chkrootkit last night -
---
The following suspicious files and directories were found:
You have 3 process hidden for readdir command
You have 3 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
---
Running chkrootkit now and all is OK
root@dave-comp:~#
root@dave-comp:~# chkrootkit | grep chkproc
Checking `lkm'... chkproc: nothing detected
root@dave-comp:~#
I have even 'sudo install --reinstall chkrootkit' in case its binarys have
been modified (paranoid)
Running rkhunter shows no problems
I am at a bit off a loss and would value some advice / opinions. I can see two
possibilities
(a) I have a trojan, seems unlikely I am behind a netgear router firewall NAT
with no incoming ports open. Running nothing more than samba, ssh and unison
on the local network though I have to admit I have not hardened my system.
(b) Its a false alarm - it is called by /etc/cron.daily so a lot of different
scripts are called at the same time - though I have no idea what could have
caused it.
Any help / advice greatfully received
Dave
--
gentoo-user@gentoo.org mailing list
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2006-07-16 18:25 99% [gentoo-user] chkrootkit LKM trojan ? Dave S
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox