Hi there,
i am relatively new to security purposes and in this list. My name ist Michael Weber, i'm Networkadmin from Germany and i hope you can help me to solve this riddle:
When starting "chkrootkit" (v 0.38) i get the Message:
"You have 4 process hidden for ps command" and the hint for a probably installed "LKM Rootkit". So far, so good. "chkproc" with verbose option enabled (-v) say:
[EMAIL PROTECTED] chkrootkit-0.38]# ./chkproc -v PID 26194: not in ps output PID 26195: not in ps output PID 26196: not in ps output PID 26197: not in ps output You have 4 process hidden for ps command
That's fine, now we know the PID and can ask...
[EMAIL PROTECTED] chkrootkit-0.38]# ps p 26194 PID TTY STAT TIME COMMAND 26194 ? S 0:00 named -u named
https://listman.redhat.com/archives/phoebe-list/2003-February/thread.html
"chkrootkit on phoebe"
0.38 is outdated
http://www.chkrootkit.org/
0.41 is available
-- shrek-m
--------------------------------------------------------------------------- ----------------------------------------------------------------------------
