Re: chkrootkit and LKM?

From: Adam Sampson (azz@us-lot.org)
Date: Tue Jun 17 2003 - 00:27:09 PDT

  • Next message: Anders Reed Mohn: "Re: Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log file...)"

    "Janus N." Tøndering <janusat_private> writes:
    
    > Checking `lkm'... You have    38 process hidden for readdir command
    > Warning: Possible LKM Trojan installed
    
    Since you're using Red Hat 9, perhaps chkrootkit is getting confused
    by the new NPTL threading support in the kernel and glibc? procps
    certainly needed modifications to read the process listing correctly,
    as groups of threads can now show up as single processes.
    
    -- 
    Adam Sampson <azz@us-lot.org>                   <http://azz.us-lot.org/>
    
    ----------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
    world's premier technical IT security event! 10 tracks, 15 training sessions, 
    1,800 delegates from 30 nations including all of the top experts, from CSO's to 
    "underground" security specialists.  See for yourself what the buzz is about!  
    Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Tue Jun 17 2003 - 17:55:54 PDT