On Thu, 15 May 2008 13:53:25 -0500, Chris wrote: > Greetings, > > after installing from a F9 DVD, I'm online however, after install > chkrootkit I get this: > > Checking `asp'... not infected > Checking `bindshell'... not infected > Checking `lkm'... find: WARNING: Hard link count is wrong for /proc/1: > this may be a bug in your filesystem driver. Automatically turning on > find's -noleaf option. Earlier results may have failed to include > directories that should have been searched. You have 2 process > hidden for readdir command You have 2 process hidden for ps command > chkproc: Warning: Possible LKM Trojan installed > > Anyone getting this? or is this a situation where chkrootkit just needs > to catch up to F9 The warning is reproducible with a simple find /proc >/dev/null so it's something where the /proc virtual file-system causes problems. The hidden processes can be examined with /usr/lib/chkrootkit-0.48/chkproc -v and here it looks like they are threads and chkrootkit doesn't know that. -- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
