Re: chkroot warning

From: Bit Twister (BitTwister_at_localhost.localdomain)
Date: 08/06/04 

Date: Fri, 06 Aug 2004 01:05:44 GMT

On Fri, 06 Aug 2004 00:59:17 GMT, rsina wrote:
> Hi all, I've got the following warning in chkroot. Could someone please let
> me know what it means and what should be my next step:
>
> [snip]
> Checking `lkm'... You have 11 process hidden for readdir command
> You have 11 process hidden for ps command
> Warning: Possible LKM Trojan installed

Running mozilla/firefox/thunderbird in other windows perhaps.

If Suse uses rpm database,
you might run rpm -Va | grep '..5' > /tmp/verify
and see if you have bin/ file changes.