chkrootkit and vncserver

[Steven Stern]

On Mon, 24 May 2004 08:21:20 -0500, "Benjamin J. Weiss" <benjamin at weiss.name>
wrote:

>From: "Steven Stern" <subscribed-lists at sterndata.com>
>> This morning's normal system checks triggered alarms.  Chkrootkit reported
>a
>> possible LKM trojan.
>>
>> Checking `lkm'... You have     5 process hidden for readdir command
>> You have     5 process hidden for ps command
>> Warning: Possible LKM Trojan installed
>>
>> I've tracked this down to vncserver.  I have one X session assigned to
>VNC.
>>
>> If I do /sbin/service vncserver stop, then chkrootkit reports no LKM
>problem.
>> When I restart the server, the LKM message reappears.
>>
>> Can anyone else verify this on their system?
>
>What are you running, FC1 or FC2?


FC2.  The same configuration and version of chkrootkit was in place in FC1.
(BTW, I did install Dag's RPM of chkrootkit for FC2, just in case, but I still
get the warning when vncserver is running.)
--
   Steve