From owner-freebsd-security@FreeBSD.ORG  Tue Nov 20 14:54:09 2007
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2921B16A421
	for <freebsd-security@freebsd.org>;
	Tue, 20 Nov 2007 14:54:09 +0000 (UTC)
	(envelope-from johnpollock@bellsouth.net)
Received: from fmailhost03.isp.att.net (fmailhost03.isp.att.net
	[204.127.217.103])
	by mx1.freebsd.org (Postfix) with ESMTP id 2998E13C474
	for <freebsd-security@freebsd.org>;
	Tue, 20 Nov 2007 14:54:09 +0000 (UTC)
	(envelope-from johnpollock@bellsouth.net)
Received: from rarepenguin.org ([65.13.22.129])
	by bellsouth.net (frfwmhc03) with ESMTP
	id <20071120144154H0300m6ag5e>; Tue, 20 Nov 2007 14:41:54 +0000
X-Originating-IP: [65.13.22.129]
From: JP <johnpollock@bellsouth.net>
To: freebsd-security@freebsd.org
Date: Tue, 20 Nov 2007 09:41:52 -0500
User-Agent: KMail/1.8.3
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200711200941.52719.johnpollock@bellsouth.net>
Subject: chkrootkit V. 0.47
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Nov 2007 14:54:09 -0000

Running freeBSD 6.1

After changing chkrootkit to the latest version V. 0.47 and compiling it then 
running it I get the following:

==================<SNIPPIT>================
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... INFECTED (PORTS:  6667)
Checking `lkm'... You have   131 process hidden for readdir command
chkproc: Warning: Possible LKM Trojan installed
Checking `rexedcs'... not found
Checking `sniffer'... vr0 is not promisc
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
==================</SNIPPIT>================

Looking above, the above shows a few anomalies like the bindshell ... INFECTED 
(PORTS: 6667)
--and--
Checking `lkm'... You have   131 process hidden for readdir command
chkproc: Warning: Possible LKM Trojan installed

I do run an IRCd, and also YABB Message board along with APACHE web server - 
would the above then be normal output, and what about the lkm? Many thanks to 
those with more experience in this area.

JP