LKM Trojan installed

From: Rivanor P. Soares (rivanor@bol.com.br)
Date: 02/07/03

  • Next message: Seth Arnold: "Re: SSL and Kerberos" 
    Date: Fri, 07 Feb 2003 10:41:34 -0200
From: "Rivanor P. Soares" <rivanor@bol.com.br>
To: focus-linux@securityfocus.com

    While running 'chkrootkit' at my box (RH 7.3) I saw the following:

    Checking `lkm'... You have 69 process hidden for ps command
    Warning: Possible LKM Trojan installed

    Could this be *true* ? How can I discover it?

    Cheers...

    Rivanor.

    Relevant Pages

    • Re: LKM Trojan installed
      ... On Fri, 07 Feb 2003, Rivanor P. Soares wrote: ... You have 69 process hidden for ps command ... Warning: Possible LKM Trojan installed ...
      (Focus-Linux)
    • Re: LKM Trojan installed
      ... Rivanor P. Soares wrote: ... Make sure you are running chkrootkit 0.39, ... I didn't get the 'xx process hidden for ps command', and the warning. ...
      (Focus-Linux)
    • Re: chkrootkit...lkm trojan?... only from gnome [from debian-user]
      ... > You have 16 process hidden for ps command ... > Warning: Possible LKM Trojan installed ... > But when I run chkrootkit from KDE it comes up clean. ...
      (Debian-User)
    • Re: chkrootkit-0.34 report
      ... >> Warning: Possible LKM Trojan installed ... One thing to know about chkrootkit though is that it will falsly report ...
      (Focus-Linux)
    • Re: "file locked by another user" mystery
      ... cannot have a previous ON WARNING command and expect it to work. ... ON WARNING THEN CONTINUE or an ON ERROR THEN GOTO EXIT. ... $ SH SYM $SEVERITY ...
      (comp.os.vms)