Re: LKM Trojan installed

From: Robert Jaroszuk (zim@tx.pl)
Date: 02/07/03

  • Next message: Zow: "Re: LKM Trojan installed"
    Date: Fri, 7 Feb 2003 23:06:54 +0100
    From: Robert Jaroszuk <zim@tx.pl>
    To: "Rivanor P. Soares" <rivanor@bol.com.br>
    
    

    On Fri, 07 Feb 2003, Rivanor P. Soares wrote:

    ; While running 'chkrootkit' at my box (RH 7.3) I saw the following:
    ;
    ; Checking `lkm'... You have 69 process hidden for ps command
    ; Warning: Possible LKM Trojan installed
    ;
    ; Could this be *true* ? How can I discover it?

    First of all - disconnect from network.
    Second - copy your logs and all system files to another device (CD, or
    hard disk, whatever).

    Then - when you've made copy of whole system, try to verify packages: rpm -Va
    Look at /proc and compare existing processes to this, what shows you ps.
    Check if there are any backdoors in your system - new open ports, new
    suid files, modified daemons, libraries, files with chattr +i, or
    everything suspicious.
    And remember - write everything you're doing (see script(1))!

    -- 
    ............. Robert Jaroszuk - zim<at>tx<dot>pl .............
    GCS/IT/O d? s: a-- C++ ULB++++$ P+ L++++$ E--- W- N+ w-- O- M-
    V- PS+ PE Y(+) PGP-(+++) t-- 5? X- R* tv-- DI++ b++>+++ DI- D-
    ... The superior warrior wins without fighting -- Sun Tzu. ...
    


    Relevant Pages

    • Re: LKM Trojan installed
      ... Rivanor P. Soares wrote: ... Make sure you are running chkrootkit 0.39, ... I didn't get the 'xx process hidden for ps command', and the warning. ...
      (Focus-Linux)
    • LKM Trojan installed
      ... While running 'chkrootkit' at my box I saw the following: ... You have 69 process hidden for ps command ... Warning: Possible LKM Trojan installed ... Rivanor. ...
      (Focus-Linux)
    • Re: "file locked by another user" mystery
      ... cannot have a previous ON WARNING command and expect it to work. ... ON WARNING THEN CONTINUE or an ON ERROR THEN GOTO EXIT. ... $ SH SYM $SEVERITY ...
      (comp.os.vms)
    • Re: "file locked by another user" mystery
      ... in the DCL Help that if you have an ON SEVERE command that you ... cannot have a previous ON WARNING command and expect it to work. ... Specifies either the severity level of an error or a Ctrl/Y ...
      (comp.os.vms)
    • Re: "file locked by another user" mystery
      ... cannot have a previous ON WARNING command and expect it to work. ... and ON ERROR command, execution would simply continue. ... When a severe error occurs, ...
      (comp.os.vms)