Re: [cobalt-users] chkrootkit

[David Lucas <david@xxxxxxxxxxxxxxxx>]

At 03:28 PM 2/24/2003, you wrote:
> Is this bad to get this when running chkrootkit? :)
> Checking `lkm'... You have     1 process hidden for readdir command
> You have     1 process hidden for ps command
> Warning: Possible LKM Trojan installed
> Checking `rexedcs'... not found
> Checking `sniffer'...
> eth0 is not promisc
> Checking `wted'... nothing deleted
> Checking `scalper'... not infected
> Checking `slapper'... Warning: Possible Slapper Worm installed
> Checking `z2'... user kvken deleted or never loged from lastlog!
> user mull deleted or never loged from lastlog!
>
> Should we dump this box and os restore it?
> Thanks Ryan

How did you run it?


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.