[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

chkrootkit: false positive? LKM

Hallo Liste,

ich habe hier folgendes:

chkrootkit:

Checking `lkm'... You have     9 process hidden for readdir command
You have     9 process hidden for ps command
Warning: Possible LKM Trojan installed

# chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v -v
###
PID  1278: not in readdir output
PID  1278: not in ps output
CWD  1278: /var/cache/bind
EXE  1278: /usr/sbin/named
PID  1279: not in readdir output
PID  1279: not in ps output
CWD  1279: /var/cache/bind
EXE  1279: /usr/sbin/named
PID  1280: not in readdir output
PID  1280: not in ps output
CWD  1280: /var/cache/bind
EXE  1280: /usr/sbin/named
PID  1292: not in readdir output
PID  1292: not in ps output
CWD  1292: /
EXE  1292: /usr/sbin/lwresd
PID  1293: not in readdir output
PID  1293: not in ps output
CWD  1293: /
EXE  1293: /usr/sbin/lwresd
PID  1294: not in readdir output
PID  1294: not in ps output
CWD  1294: /
EXE  1294: /usr/sbin/lwresd
PID  1751: not in readdir output
PID  1751: not in ps output
CWD  1751: /
EXE  1751: /usr/sbin/ippl
PID  1752: not in readdir output
PID  1752: not in ps output
CWD  1752: /
EXE  1752: /usr/sbin/ippl
PID 10779: not in readdir output
PID 10779: not in ps output
CWD 10779: /home/gerhard
EXE 10779: /usr/bin/python2.3
You have     9 process hidden for readdir command
You have     9 process hidden for ps command


außerdem:

chkrootkit:

Searching for suspicious files and dirs, it may take a while... 
/usr/lib/plt/bin/.libs 
/usr/lib/plt/collects/readline/.DS_Store 
/usr/lib/jdk/1.1/bin/i386/green_threads/.extract_args 
/usr/lib/jdk/1.1/bin/i386/native_threads/.extract_args 
/usr/lib/jdk/1.1/bin/.java_wrapper /usr/lib/blender/.Blanguages 
/usr/lib/blender/.bfont.ttf 
/usr/lib/GNUstep/System/Library/Cenon/Projects/DTP/Advertising.cenon/.gwdir 
/usr/lib/GNUstep/System/Library/Cenon/Projects/DTP/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Projects/Models/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Projects/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Projects/Shapes/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Projects/NoSmoking/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Devices/hpgl/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Devices/din/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Devices/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Devices/gerber/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/ai/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/ps/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/PCB/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/dxf/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/hpgl/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/Gerber/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Examples/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/.dir.tiff 
/usr/lib/GNUstep/System/Library/Cenon/Documentation/.dir.tiff 
/usr/lib/j2se/1.3/bin/.java_wrapper 
/usr/lib/j2se/1.3/jre/bin/.java_wrapper
/usr/lib/plt/bin/.libs

kavscanner warning:

/usr/lib/libcupsimage.so.2

samhain:

-----BEGIN MESSAGE-----
[2004-05-20T14:55:12+0200] 127.0.0.1
CRIT   :  [2004-05-20T14:54:26+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/fetchmailrc>, ctime_old=<[2004-05-16T12:53:00]>, 
ctime_new=<[2004-05-20T12:53:56]>, 
CRIT   :  [2004-05-20T14:54:31+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/cups>, ctime_old=<[2004-05-16T12:52:12]>, 
ctime_new=<[2004-05-20T12:52:53]>, 
CRIT   :  [2004-05-20T14:54:31+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/cups/classes.conf>, ctime_old=<[2004-05-16T12:52:12]>, 
ctime_new=<[2004-05-20T12:52:53]>, 
CRIT   :  [2004-05-20T14:54:32+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/cups/printers.conf>, ctime_old=<[2004-05-16T12:52:12]>, 
ctime_new=<[2004-05-20T12:52:53]>, 
CRIT   :  [2004-05-20T14:54:32+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/cups/ppd>, ctime_old=<[2004-05-16T12:52:12]>, 
ctime_new=<[2004-05-20T12:52:53]>, 
CRIT   :  [2004-05-20T14:54:32+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/cups/cupsd.conf>, ctime_old=<[2004-05-16T12:52:12]>, 
ctime_new=<[2004-05-20T12:52:53]>, 
CRIT   :  [2004-05-20T14:55:06+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/X11/twm>, ctime_old=<[2004-05-03T01:47:14]>, 
ctime_new=<[2004-05-16T13:39:53]>, mtime_old=<[2004-05-03T01:47:14]>, 
mtime_new=<[2004-05-16T13:39:53]>, 
CRIT   :  [2004-05-20T14:55:06+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/X11/twm/system.twmrc>, ctime_old=<[2004-05-03T01:47:14]>, 
ctime_new=<[2004-05-16T13:39:53]>, mtime_old=<[2004-05-03T01:47:14]>, 
mtime_new=<[2004-05-16T13:39:53]>, 
CRIT   :  [2004-05-20T14:55:06+0200] msg=<POLICY [ReadOnly] --------T->, 
path=</etc/X11/twm/menudefs.hook>, ctime_old=<[2004-05-03T01:47:14]>, 
ctime_new=<[2004-05-16T13:39:53]>, mtime_old=<[2004-05-03T01:47:14]>, 
mtime_new=<[2004-05-16T13:39:53]>, 
CRIT   :  [2004-05-20T14:55:12+0200] msg=<POLICY [ReadOnly] C--I----TS>, 
path=</etc/email-addresses>, inode_old=<1785977>, inode_new=<1785986>, 
size_old=<312> size_new=<339> ctime_old=<[2003-03-30T22:36:26]>, 
ctime_new=<[2004-05-16T22:57:43]>, mtime_old=<[2003-03-12T20:59:48]>, 
mtime_new=<[2004-05-16T22:57:43]>, 
chksum_old=<5681EE36A91B60A4BE3C05C049EF6699763EF29ABE18E75E>, 
chksum_new=<6D7B9E8F4166B15A00FD00802A09B526E0AE18C8838AAB68>, 

Muß ich mir Sorgen machen?

ciao

Gerhard
Reply to: