[sentinix-list] chkrootkit installed.

"M. Morgan" <[email protected]> Wed, 18 Feb 2004 16:33:01 -0500 (GMT-05:00)
Newsgroups gmane.linux.sentinix
Message-ID <2763893.1077140012816.JavaMail.root@wamui04.slb.atl.earthlink.net>
Hello list,
 I installed chkrootkit 0.43 on my Sentinix test box today and ran it without trouble. 

I did get what I believe is a false positive for LKM rootkits though. I say false positive for many reasons and after investigation it further Im confident it is so.

 The message I get from chkrootkit is:
~~~~~~~~~~~~
checking "lkm"... you have four processes hidden for ps command
warning... possible lkm trojan installed
~~~~~~~~~~~~

 The ps command only shows bash and ps active. Anyone have any idea what those processes may be? Other than webmin this machine is a default install. Im just curios as to why this is showing up this way.

thanks,
michael