[cobalt-users] chkrootkit-0.38/RaQ4

["B. Runge" <brunge@xxxxxxxxxxx>]

Just installed 0.38 with no other previous versions of chkrootkit
package installed.
*This server is a little behind when it comes to having all the software
upgrades...
Waiting for the maintenance window to roll on around....

Not sure which way to go with this as long as the end result is nailing
this down. See below for the results of the scan.

I have no issues logging in or creating user accounts nor do I have
issues
with creating, removing, changing any sort of file, script or directory.
LSMOD brings nothing out of the ordinary back to me. 
Are these not "some" of the signs that you may have been or are
compromised?

Any input or direction would be greatly appreciated.
Thanks - Bill

Checking `lkm'... You have     2 process hidden for readdir command
You have     2 process hidden for ps command
Warning: Possible LKM Trojan installed
[root chkrootkit-0.38]# ./chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v
###
PID 14597: not in readdir output
PID 14597: not in ps output
PID 14600: not in readdir output
PID 14600: not in ps output
PID 14603: not in readdir output
PID 14603: not in ps output
PID 14604: not in readdir output
PID 14604: not in ps output
You have     4 process hidden for readdir command
You have     4 process hidden for ps command


Checking `lkm'... You have     4 process hidden for readdir command
You have     4 process hidden for ps command
Warning: Possible LKM Trojan installed
[root chkrootkit-0.38]# ./chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v
###
PID 18124: not in readdir output
PID 18124: not in ps output
You have     1 process hidden for readdir command
You have     1 process hidden for ps command


Checking `lkm'... You have     2 process hidden for readdir command
You have     2 process hidden for ps command
Warning: Possible LKM Trojan installed
[root chkrootkit-0.38]# ./chkrootkit -x lkm
ROOTDIR is `/'
###
### Output of: ./chkproc -v
###
PID 31401: not in readdir output
PID 31401: not in ps output
PID 31402: not in readdir output
PID 31402: not in ps output
You have     2 process hidden for readdir command
You have     2 process hidden for ps command