[sentinix-list] chkrootkit installed.
"M. Morgan" <[email protected]> Wed, 18 Feb 2004 16:33:01 -0500 (GMT-05:00)
| Newsgroups | gmane.linux.sentinix |
|---|---|
| Message-ID | <2763893.1077140012816.JavaMail.root@wamui04.slb.atl.earthlink.net> |
Hello list, I installed chkrootkit 0.43 on my Sentinix test box today and ran it without trouble. I did get what I believe is a false positive for LKM rootkits though. I say false positive for many reasons and after investigation it further Im confident it is so. The message I get from chkrootkit is: ~~~~~~~~~~~~ checking "lkm"... you have four processes hidden for ps command warning... possible lkm trojan installed ~~~~~~~~~~~~ The ps command only shows bash and ps active. Anyone have any idea what those processes may be? Other than webmin this machine is a default install. Im just curios as to why this is showing up this way. thanks, michael