Re: Bug in chkrootkit ?

["shrek-m () gmx de" <shrek-m () gmx de>]

Michael Weber wrote:

> Hi there,
>
> i am relatively new to security purposes and in this list. My name ist
> Michael Weber, i'm Networkadmin from Germany and i hope you can help
> me to solve this riddle:
>
> When starting "chkrootkit" (v 0.38) i get the Message:
>
> "You have 4 process hidden for ps command" and the hint for a probably
> installed "LKM Rootkit". So far, so good. "chkproc" with verbose option
> enabled (-v) say:
>
> [mw@zeus chkrootkit-0.38]# ./chkproc -v
> PID 26194: not in ps output
> PID 26195: not in ps output
> PID 26196: not in ps output
> PID 26197: not in ps output
> You have 4 process hidden for ps command
>
> That's fine, now we know the PID and can ask...
>
> [mw@zeus chkrootkit-0.38]# ps p 26194
> PID TTY      STAT   TIME COMMAND
> 26194 ?        S      0:00 named -u named

https://listman.redhat.com/archives/phoebe-list/2003-February/thread.html

"chkrootkit on phoebe"


0.38 is outdated

http://www.chkrootkit.org/

0.41 is available


--
shrek-m


---------------------------------------------------------------------------
----------------------------------------------------------------------------