On 8/30/07, NoOp <<a href="mailto:glgxg@sbcglobal.net">glgxg@sbcglobal.net</a>> wrote:<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> On 08/30/2007 08:26 AM, NoOp wrote: > On 08/29/2007 01:00 PM, Jimmy Wu wrote: >> Tried chkrootkit, and everything seems fine, except for these lines: >> Checking `lkm'... You have 3 process hidden for readdir command >> You have 3 process hidden for ps command >> chkproc: Warning: Possible LKM Trojan installed >> >> Should I be worried, and what should I do? >> >> Thanks >> > > Google is your friend (sometimes)... you'll find many threads regarding > chkrootkit and the possibility of false positives. Google for "Possible > LKM Trojan installed". Also: > > <a href="http://www.chkrootkit.org/faq/">http://www.chkrootkit.org/faq/</a> > <a href="http://www.chkrootkit.org/faq/#6">http://www.chkrootkit.org/faq/#6</a> > > However, I would take it as serious until you can confirm that it is a > false positive. I'd also recommend that you scan using Rootkit Hunter: > <a href="http://www.rootkit.nl/projects/rootkit_hunter.html">http://www.rootkit.nl/projects/rootkit_hunter.html</a> > > $ sudo apt-get install rkhunter > > to see if it finds the same. > > Sorry, forgot to add that after '$ sudo apt-get install rkhunter' do: $ sudo rkhunter --update then $ sudo rkhunter -c Gary</blockquote> <div id="{8749ED4C-6F18-4BBA-A838-9887F2373FED}"> </div></div>tried rkhunter: it didn't find LKM trojan, but it did give a Warning with a message tellingme to "Please inspect" the following hidden files: /dev/.static /dev/.udev /dev/.initramfs Jimmy