From: AAW (AAWmilwpc.com)
Date: Tue Jun 03 2008 - 13:49:32 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

chkrootkit is reporting:
Checking `lkm'... You have chkproc: Warning: Possible LKM Trojan installed

/usr/lib64/chkrootkit/chkproc -v claims:
You have You have 69 process hidden for ps command

I've booted to my fallback install (2008.1, never connected to internet) and
checked the installation (chkrootkit, rkhunter, checked md5sum of ps and
other important binaries against "rpm -qp --dump"). Everything looks OK.

I see a similar question by Dick Gevers on 2008-02-20 but no responses. I've
also seen some google research that some distro's modify ps to hide
processes; redhat was the only one specifically mentioned.

Should I be panicking?

Thanks,
Arn
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]