chkrootkit V. 0.47

Running freeBSD 6.1

After changing chkrootkit to the latest version V. 0.47 and compiling it then
running it I get the following:

==================<SNIPPIT>================
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... INFECTED (PORTS: 6667)
Checking `lkm'... You have 131 process hidden for readdir command
chkproc: Warning: Possible LKM Trojan installed
Checking `rexedcs'... not found
Checking `sniffer'... vr0 is not promisc
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
==================</SNIPPIT>================

Looking above, the above shows a few anomalies like the bindshell ... INFECTED
(PORTS: 6667)
--and--
Checking `lkm'... You have 131 process hidden for readdir command
chkproc: Warning: Possible LKM Trojan installed

I do run an IRCd, and also YABB Message board along with APACHE web server -
would the above then be normal output, and what about the lkm? Many thanks to
those with more experience in this area.

JP






_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: chkrootkit strange report
    ... Searching for anomalies in shell history files... ... Warning: `' is linked ... Does anyone have a clue how to find this file?? ...
    (Fedora)
  • Re: gcc-4 ?
    ... trying to beat gcc41 into submission. ... I'm running FreeBSD 6.0 on AMD64. ... warning: structure `c_arg_info' used but not defined ... structure `loop' used but not defined ...
    (freebsd-questions)