[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Hoax: Re: What up with www.debian.org ?

On Fri, Nov 21, 2003 at 02:39:10AM -0800, Tom wrote:
> On Fri, Nov 21, 2003 at 03:52:43PM +0530, Raghavendra Bhat wrote:
> > Tom posts:
> > 
> > >> deinstalled  due to missing  dependencies, but  the 2nd  time through
> > >> they work.  (This time, it was most of the qt3*-dev and gtk2*-dev and
> > >> relateds.)
> > 
> > When did you notice this ? 
> > 
> > When I  installed the procps  of `sid' v3.x.x, chkrootkit  was informing
> > that I  had a LKM worm  but disappeared when downgraded.   Some say that
> > procps masks certain  threads.  I really wonder what  is up, because now
> > chkrootkit does not complain about  masked threads on ps (procps v3.x.x,
> > which I put in again).
> > 
> > I have removed all my devel packages and chkrootkit as well.
> Christ, now I'm really getting scared:
> chkrootkit reports:
> Checking `lkm'... You have     4 process hidden for ps command
> Warning: Possible LKM Trojan installed
> I'm running SID.  What's this mean?

There was a recent discussion on a bug in chkrootkit on
debian-security.  It might be the case here. 


Johann Spies          Telefoon: 021-808 4036
Informasietegnologie, Universiteit van Stellenbosch

     "A new commandment I give unto you; That ye love one 
      another. As I have loved you, so ye also must love one
      another.  By this shall all men know that ye are my 
      disciples, if ye have love one to another."    
                         John 13:34,35 

Reply to: