Re: Hacked or not ?
Date: Sat, 12 Jun 2004 13:01:38 +0100 (BST) To: email@example.com
I have seen this as well, it is most likely a false positive.
Additionally, slower or more heavily loaded machines seem more likely to
generate false positive for LKM.
As a side note, there really ought to be a way for admins to double check
the output from chkrootkit Google helps little. Any offers..?
> Hi all,
> please advice me - I was on holidays for one week. After return I found
in security mails from router (chkrootkit) following message:
> Checking `lkm'... You have 1 process hidden for readdir command You
have 1 process hidden for ps command
> Warning: Possible LKM Trojan installed
> It apeared only onece. From previous and next days reports, the message
is not present.
> How could I be sure, the machine is not hacked ?
> Many thanks for any response.
> Peter Rosa
> firstname.lastname@example.org mailing list
> To unsubscribe, send any mail to
email@example.com mailing list
To unsubscribe, send any mail to "firstname.lastname@example.org"