chkrootkit hidden processes possible LKM Trojan.

[Wackojacko <wackojacko32@ntlworld.com>]

Hi all

I realise there has been some discussion recently over the merits or 
otherwise of chkrootkit, but the last two days it is warning of hidden 
processes (ps and readdir).

After googling a little further I see this has been a problem in the 
past but was unable to find any recent examples.

However, using

#chkrootkit -x lkm

and

#chkproc -v -v

and comparing these to the output of ps and ls /proc I have determined 
that there are processes which do not show up on /proc or ps but I am 
still able to

#cd /proc/PID

for these processes and then

#cat cmdline

to find out what service is hidden.

The results suggest that icedove-bin and nepomukerserver are the main 
culprits, but I want to know why!!

I do not have any services running on external ports as I am behind a 
netgear router and have confirmed this via various external port scan 
sites.  I do run smb, imap (dovecot), postfix, cups and apt-cacher 
(perl) locally for my internal network.

Am I really rooted?  Anyone else seeing something similar?

TIA

Wackojacko