RE: [cobalt-users] LKM Trojans

[David Etheridge <DavidE@xxxxxxxxxxxx>]

After a reboot the hidden processes are still there but the number of them
doesnt seem related to the number of logins (maybe ruling out a Login
Trojan).

Does anyone know of any legitimate reason that there may be 1 or 2 hidden
processes. I run Portsentry etc but they arent hidden!

Another factor is that I installed OS4 update last week (hence my tripwire
logs were like waaay out!).

Dave Etheridge

-----Original Message-----
From: David Etheridge [mailto:DavidE@xxxxxxxxxxxx]
Sent: 06 March 2001 10:39
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] LKM Trojans


I have just done a rootkit check and found hidden processes and a warning of
a possible LKM Trojan installed.

Does anyone know what might have been changed or what I can check for?

Thanks

Dave Etheridge

_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users