chkrootkit - Fedora 9
Chris
racerx at makeworld.com
Thu May 15 20:49:04 UTC 2008
On Thu, 15 May 2008 22:08:00 +0200
Michael Schwendt <mschwendt at gmail.com> wrote:
> On Thu, 15 May 2008 13:53:25 -0500, Chris wrote:
>
> > Greetings,
> >
> > after installing from a F9 DVD, I'm online however, after install
> > chkrootkit I get this:
> >
> > Checking `asp'... not infected
> > Checking `bindshell'... not infected
> > Checking `lkm'... find: WARNING: Hard link count is wrong
> > for /proc/1: this may be a bug in your filesystem driver.
> > Automatically turning on find's -noleaf option. Earlier results
> > may have failed to include directories that should have been
> > searched. You have 2 process hidden for readdir command You
> > have 2 process hidden for ps command chkproc: Warning: Possible
> > LKM Trojan installed
> >
> > Anyone getting this? or is this a situation where chkrootkit just
> > needs to catch up to F9
>
> The warning is reproducible with a simple
>
> find /proc >/dev/null
>
> so it's something where the /proc virtual file-system causes
> problems.
>
>
> The hidden processes can be examined with
>
> /usr/lib/chkrootkit-0.48/chkproc -v
>
> and here it looks like they are threads and chkrootkit doesn't
> know that.
>
Thanks everyone!
--
Best regards,
Chris
() ascii ribbon campaign - against html e-mail
/\ www.asciiribbon.org - against proprietary attachments
"There's no place like 127.0.0.1"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20080515/2e72acab/attachment-0001.sig>
More information about the fedora-list
mailing list