chkrootkit - Fedora 9
Michael Schwendt
mschwendt at gmail.com
Thu May 15 20:08:00 UTC 2008
On Thu, 15 May 2008 13:53:25 -0500, Chris wrote:
> Greetings,
>
> after installing from a F9 DVD, I'm online however, after install
> chkrootkit I get this:
>
> Checking `asp'... not infected
> Checking `bindshell'... not infected
> Checking `lkm'... find: WARNING: Hard link count is wrong for /proc/1:
> this may be a bug in your filesystem driver. Automatically turning on
> find's -noleaf option. Earlier results may have failed to include
> directories that should have been searched. You have 2 process
> hidden for readdir command You have 2 process hidden for ps command
> chkproc: Warning: Possible LKM Trojan installed
>
> Anyone getting this? or is this a situation where chkrootkit just needs
> to catch up to F9
The warning is reproducible with a simple
find /proc >/dev/null
so it's something where the /proc virtual file-system causes
problems.
The hidden processes can be examined with
/usr/lib/chkrootkit-0.48/chkproc -v
and here it looks like they are threads and chkrootkit doesn't
know that.
More information about the fedora-list
mailing list