On Tue, 8 Oct 2002, Hesty P wrote:
> After installing RH 8.0, I ran chkrootkit and it
> reports that some LKM trojan might exist. Running:
> ./chkrootkit -x lkm
> reveals that there are 6 processes hidden from ps. Is
> this any cause for concern? I did run ethereal and
> cannot see anything out of ordinary.
Unless you have some really efficient hackers, it is more likely to be the
change to ps which no longer shows multiple threads. There is only one
security advisory for 8.0 (fetchmail), and I doubt hackers have time to
exploit it yet.
Michael Young
