Re: chkrootkit output

From: Oliver Gobin (200410usenet_at_ogobin.de)
Date: 10/08/04 

Date: Fri, 8 Oct 2004 14:08:35 +0000

On Fri, 08 Oct 2004 12:02:47 +0200 John Gallet wrote:

> First try to see if 14894 is listed in /proc for example with
>
> ls /proc |grep 14984

not listed...

> If it is not listed, but if the command ls /proc/14984 does return
> results, it does not smell good.

it does return results...

> If checkrootkit says you are infected with "SIGINVISIBLE Adore"
> you should double-check with rootkit-hunter www.rootkit.nl

This one doesn't find any trojan, just some vulnerable
applications like gpg... :)

And there are no suspicious logs or other abnormal server
activities, so I'm quite sure it is clean.

Thanks for your help.

ciao,
Oliver