Re: chkrootkit and LKM?

From: Tim Greer (chatmaster_at_charter.net)
Date: 06/17/03

  • Next message: Nathan Dornquast: "Re: chkrootkit and LKM?" 
    To: Janus N. Tøndering <janus@bananus.dk>, <incidents@securityfocus.com>
Date: Mon, 16 Jun 2003 19:34:20 -0700

    Get a clean install/binary of top, ps, netstat, etc. and check and see if
    there's any processes in netstat that aren't listed in ps. Look in your init
    files, etc. 

    --
Regards,
Tim Greer  chatmaster@charter.net
Server administration, security, programming, consulting.
----- Original Message -----
From: "Janus N. Tøndering" <janus@bananus.dk>
To: <incidents@securityfocus.com>
Sent: Monday, June 16, 2003 7:59 AM
Subject: chkrootkit and LKM?
Hi
I using a RHL9 as my workstation. A few days ago I downloaded chkrootkit
and it consistently gives the same output (>20 hidden processes) when
checking for LKM rootkit:
Checking `lkm'... You have    38 process hidden for readdir command
Warning: Possible LKM Trojan installed
This is even after reboots. How can I check if this is actually the work
of the LKM? Or any other rootkit for that matter?
Regards,
Janus N. Tøndering
--
Janus N. Tøndering <janus@bananus.dk>
----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the
world's premier technical IT security event! 10 tracks, 15 training
sessions,
1,800 delegates from 30 nations including all of the top experts, from CSO's
to
"underground" security specialists.  See for yourself what the buzz is
about!
Early-bird registration ends July 3.  This event will sell out.
www.blackhat.com
----------------------------------------------------------------------------
----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
world's premier technical IT security event! 10 tracks, 15 training sessions, 
1,800 delegates from 30 nations including all of the top experts, from CSO's to 
"underground" security specialists.  See for yourself what the buzz is about!  
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
----------------------------------------------------------------------------
  • Next message: Nathan Dornquast: "Re: chkrootkit and LKM?"

    Relevant Pages

    • Re: chkrootkit and LKM?
      ... Server administration, security, programming, consulting. ... Subject: chkrootkit and LKM? ... the kernel and then use some device (the grsecurity kernel patches and ... world's premier technical IT security event! ...
      (Incidents)
    • Re: process identification
      ... IT Technical Security Officer ... the computer has an open port with a listening ftp-server, but there is no matching PID with netstat. ... to facilitate one-on-one interaction with one of our expert instructors. ... Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. ...
      (Security-Basics)
    • RE: Cisco IOS vulnerability
      ... Subject: Cisco IOS vulnerability ... On a perimeter router you should be implementing RFC1918 and RFC2827 ... Although these security measures in themselves will not prevent the attack, ... world's premier technical IT security event! ...
      (Incidents)
    • RE: Need some help and guidance, please....RE: TROJAN: Symantec: New Serious Virus found. (fwd)
      ... which will bring up lots of pop up windows like window ... > Norton Security Response, has detected a new virus in the Internet. ... > world's premier technical IT security event! ... > Early-bird registration ends July 3. ...
      (Incidents)
    • RE: Cisco IOS vulnerability
      ... Subject: Cisco IOS vulnerability ... On a perimeter router you should be implementing RFC1918 and RFC2827 ... Although these security measures in themselves will not prevent the attack, ... world's premier technical IT security event! ...
      (Incidents)