RE: [cobalt-users] Hacked Cobalt Servers

["Chuck Lewis" <clewis@xxxxxxxxxx>]

Tom,

Thanks for the reply. So are you saying that it is OK to have the LKM on and
not worry about it ? I'm confused - sorry :-)

I'm running it now and will run it a couple of more times.

Thanks,

Chuck 

-----Original Message-----
From: Tom Cameron  Sent: Thursday, April 17, 2003 5:29 PM
 
>LMK is a trojan that modifies your 'ps' command and attempts to hide
>processes. This check simply adds up the processes in the 'ps' command and
>compares that with the real processes.

>Unfortunately the two checks are run seconds appart and sometimes the
>difference in the number of processes is not actually an indication of the
>trojan but just a consequence of  new processes starting up on your machine
>between the checks.

>Run the check again several times to be certain that it is a constant
>problem. On my Raq I get this warning about once every few months and it
>always turns out to be a false alarm.

>Tom