Re: chkrootkit and lkm

To: debian-security@lists.debian.org
Subject: Re: chkrootkit and lkm
From: Werner Macho <werner.macho@boku.ac.at>
Date: Thu, 27 Nov 2003 09:18:09 +0100
Message-id: <[🔎] 1069921089.2096.3.camel@metis.boku.ac.at>
In-reply-to: <[🔎] 1069806005.2365.10.camel@pagan>
References: <[🔎] 20031125121835.4f5f4a4f.graumann@its.caltech.edu> <[🔎] 1069806005.2365.10.camel@pagan>

I'm not quite sure if i'm right .. but isn't there a kernel bug
displaying some processes with PID 0 in ps or top.

maybe lkm is using this..

just a thought

greets Werner

> > > Checking `lkm'... You have     4 process hidden for ps command
> > > Warning: Possible LKM Trojan installed

I

Attachment: signature.asc
Description: This is a digitally signed message part

Reply to:

References:
- chkrootkit and lkm
  - From: Johannes Graumann <graumann@its.caltech.edu>
- Re: chkrootkit and lkm
  - From: Andre Timmermann <_deblist.darktim@darktim.de>

Prev by Date: Time for apt-secure?
Next by Date: Re: [sec] Time for apt-secure?
Previous by thread: Re: chkrootkit and lkm
Next by thread: Re: chkrootkit and lkm
Index(es):
- Date
- Thread