chkrootkir LKM Trojan ?

[Varga Levente]

>Dave S wrote:

> I just had an email from chkrootkit last night -
> 
> ---
> 
> The following suspicious files and directories were found:
> 
> You have     3 process hidden for readdir command
> You have     3 process hidden for ps command
> chkproc: Warning: Possible LKM Trojan installed
> 
> ---
> 
> Running chkrootkit now and all is OK

> I have exactly the same issue.
> 
> (a) I have a trojan, seems unlikely I am behind a netgear router
firewall
> NAT with no incoming ports open. Running nothing more than samba, ssh
and
> unison on the local network though I have to admit I have not hardened
my
> system.
> 
> (b) Its a false alarm - it is called by /etc/cron.daily so a lot of
> different scripts are called at the same time - though I have no idea
what
> could have caused it.

> Yep,  those would be the possibilities :-)  I don't know.  I think
it's (b),
> but I'm uncertain.  chkrootkit is remarkably unhelpful about its
warnings -
> what does it mean that processes are "hidden"?  How does it attempt to
> recognize packet sniffers? It routinely reports dhclient!

Try rkhunter and see!

Levi