How can I be sure if it is LKM or not?
Today I've run chkrootkit and it gave me:
Checking `lkm'... You have 179 process hidden for readdir command
You have 179 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
Checking `chkutmp'... The tty of the following user process(es) were not found
in /var/run/utmp !
! RUID PID TTY CMD
! root 3206 tty1 /sbin/mingetty tty1
! root 3285 tty2 /sbin/mingetty tty2
! root 3337 tty3 /sbin/mingetty tty3
! root 3388 tty4 /sbin/mingetty tty4
! root 3439 tty5 /sbin/mingetty tty5
Those hidden tty can be "su -" sessions that I have just started. The
computer has just been restarted, and I have just opened those su
sessions.
There are also some "hidden files", all of them named .packlist and
.exists. Everything else is fine.
rkhunter looks fine.
" rpm -Va kernel* " looks fine.
Remote users access are being controlled through /etc/ssh/sshd_config
in a user-host fashion.
Thanks in advance.
--
Vilela
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
