Re: LKM Trojan

[Matt Wehland <mjw@littlegrassy.com>]

On Tuesday 15 June 2004 10:05 am, hcrouch@mchsi.com wrote:
> While exploring the workings of my OS weekend before last, I managed to
> break Shorewall (Shoreline Firewall) and I surfed unprotected for a couple
> of daze before I was able to fix it.  I ran chkrootkit this last weekend,
> which reported that I had four hidden processes and might have picked up
> the LKM trojan.  For lack of a better plan, I reformatted my root partition
> and rebuilt from the ground up.  :-(

Well I'm a little late on this, but I haven't seen anyone else mention it.
Which version of Debian/chkrootkit did you use.
If you check the debian user/security acrhives you will find threads on 
chkrootkit throwing false positives  when run against debian (sarge/sid I 
believe).
So you may have not even been trojaned, it may just have been a faulty 
detection.


Matt


-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.