Re: Chkroot reports LKM troyan, false postive?

From: buck (buck_at_private.mil)
Date: 12/22/03


Date: Mon, 22 Dec 2003 16:11:51 GMT

On Mon, 22 Dec 2003 14:04:36 +0000 (UTC), runlevel0
<runlevel0@wanadoo.es> wrote:

>Hy group,
>
>I run chkrootkit yesterday (22.12.2003) and got all negatives except
>for a complaint about:
>
> "possible lkm troyan"
> "4 processes hidden from ps"

chkroot -x lkm

/proc contains process not seen by ps or vice-versa.

buck