public inbox for gentoo-user@lists.gentoo.org
 help / color / mirror / Atom feed
Search results ordered by [date|relevance]  view[summary|nested|Atom feed]
thread overview below | download: 
* [gentoo-user] chkrootkit LKM trojan ?
@ 2006-07-16 18:25 99% Dave S
  0 siblings, 0 replies; 1+ results
From: Dave S @ 2006-07-16 18:25 UTC (permalink / raw
  To: Gentoo list

HI, I have a potential security problem ... 

and err its not on gentoo, its on ubuntu but I am not getting any response 
there & you guys are the most tech bunch I know  - Thought I would lay it on 
the table :)

I just had an email from chkrootkit last night -

---

The following suspicious files and directories were found:

You have     3 process hidden for readdir command
You have     3 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

---

Running chkrootkit now and all is OK

root@dave-comp:~#
root@dave-comp:~# chkrootkit | grep chkproc
Checking `lkm'... chkproc: nothing detected
root@dave-comp:~#   

I have even 'sudo install --reinstall chkrootkit' in case its binarys have 
been modified (paranoid)

Running rkhunter shows no problems

I am at a bit off a loss and would value some advice / opinions. I can see two 
possibilities

(a) I have a trojan, seems unlikely I am behind a netgear router firewall NAT 
with no incoming ports open. Running nothing more than samba, ssh and unison 
on the local network though I have to admit I have not hardened my system.

(b) Its a false alarm - it is called by /etc/cron.daily so a lot of different 
scripts are called at the same time - though I have no idea what could have 
caused it.

Any help / advice greatfully received

Dave
-- 
gentoo-user@gentoo.org mailing list



^ permalink raw reply	[relevance 99%]

Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2006-07-16 18:25 99% [gentoo-user] chkrootkit LKM trojan ? Dave S

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox