From owner-freebsd-questions@FreeBSD.ORG Tue May 13 05:43:13 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1053437B401 for ; Tue, 13 May 2003 05:43:13 -0700 (PDT) Received: from webserver2.rtl.org (rtl-3.i2k.com [63.94.12.207]) by mx1.FreeBSD.org (Postfix) with ESMTP id 411BF43FA3 for ; Tue, 13 May 2003 05:43:12 -0700 (PDT) (envelope-from jstewart@rtl.org) Received: from mis3c.rtl.lan (rtl-2.i2k.com [63.94.12.206]) by webserver2.rtl.org (8.11.6/8.11.6) with ESMTP id h4DCfTj24594; Tue, 13 May 2003 08:41:29 -0400 From: Jason Stewart To: greg.lane@internode.on.net In-Reply-To: <20030513104721.GA24990@localhost.bigpond.net.au> References: <20030513104721.GA24990@localhost.bigpond.net.au> Content-Type: text/plain Content-Transfer-Encoding: 7bit X-Mailer: Ximian Evolution 1.0.8 (1.0.8-11) Date: 13 May 2003 08:43:22 -0400 Message-Id: <1052829803.4622.18.camel@mis3c> Mime-Version: 1.0 cc: freebsd-questions@freebsd.org Subject: Re: chkrootkit: LKM trojan(?) and strange cron behaviour X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 May 2003 12:43:13 -0000 On Tue, 2003-05-13 at 06:47, Greg Lane wrote: Nevertheless, I went further > investigating and found an interesting message from chkrootkit > at 3 am May 10 (2 days before): > > Checking `lkm'... You have 1 process hidden for readdir command > You have 1 process hidden for ps command > Warning: Possible LKM Trojan installed > > That was the only abnormal message that night and everything was > normal before this (for at least a month) and for the next two > nights till cron died (I run chkrootkit from cron just before > 3am each night). > > I just ran chkrootkit again and it reports nothing. I am building > static executables on another stable machine at the moment so that > I can run chkrootkit with known executables. > Has anyone ever seen this message from chkrootkit before and > determined it was a false alarm? (Note that I am running stable > and this is not the known problems with chkrootkit and current.) Hi Greg, This could be a false alarm. I've had them before, and they seem to only happen on the boxes that I have Apache running on. I would suggest keeping your eye on the box very closely for a while to be safe. If possible, monitor network traffic from another box for a while. > Would you be concerned?!?!? I would be concerned, but not alarmed. Jason