Re: chkrootkit - Fedora 9

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 15 May 2008 22:08:00 +0200
Michael Schwendt <mschwendt@xxxxxxxxx> wrote:

> On Thu, 15 May 2008 13:53:25 -0500, Chris wrote:
> 
> > Greetings,
> > 
> > after installing from a F9 DVD, I'm online however, after install
> > chkrootkit I get this:
> > 
> > Checking `asp'... not infected
> > Checking `bindshell'... not infected
> > Checking `lkm'... find: WARNING: Hard link count is wrong
> > for /proc/1: this may be a bug in your filesystem driver.
> > Automatically turning on find's -noleaf option.  Earlier results
> > may have failed to include directories that should have been
> > searched. You have     2 process hidden for readdir command You
> > have     2 process hidden for ps command chkproc: Warning: Possible
> > LKM Trojan installed
> > 
> > Anyone getting this? or is this a situation where chkrootkit just
> > needs to catch up to F9
> 
> The warning is reproducible with a simple
> 
>   find /proc >/dev/null
> 
> so it's something where the /proc virtual file-system causes
> problems.
> 
> 
> The hidden processes can be examined with
> 
>   /usr/lib/chkrootkit-0.48/chkproc -v
> 
> and here it looks like they are threads and chkrootkit doesn't
> know that.
> 

Thanks everyone!

-- 
Best regards,

Chris

()  ascii ribbon campaign - against html e-mail
/\  www.asciiribbon.org   - against proprietary attachments

	"There's no place like 127.0.0.1"

Attachment: signature.asc
Description: PGP signature

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux