LKM Trojan

[Pedro Fernandes Macedo]

david walcroft wrote:

> Would these be a 'false positive' or for real and if so how do I
> confirm and remove any infected process/trojan
>
>  Thanks   david
>

There's a high chance that these are false positives... Run chkrootkit 
with the verbose option and it'll show the PID of the processes...
Then , check the /proc/$PID/ directory.. the "status" file will give u 
the program name... and the other files (specially environ and cmdline) 
will give more details.
and for the path of the file , check the symlink "exe" in that folder..

I used to have lots of false positives , so I just quit using chkrootkit 
(as my machine isnt all that sensitive and I secured it the best I can..)..

--
Pedro Macedo