Hi everyone, still learning and this morning I've received this from chkrootkit.
Code:
/etc/cron.daily/chkrootkit:
You have 1 process hidden for readdir command
You have 1 process hidden for ps command
Warning: Possible LKM Trojan installed
eth0: PACKET SNIFFER(/sbin/dhclient[200])
Then I've tried:
Code:
myhost:~# chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v -v -p 2
###
Which, as you see, returned nothing. I've search around and it seems it is possible that chkrootkit returns false positives.
I use the 2.4.29-linode39-1um kernel with Debian Sarge.
Can someone explain to me what triggered this false positive today? Is it installation/upgrade of modules on the host-side?
Thanks!
FAQ
Search
Members
Register
Login [ Anonymous ]
