[plug] Possible LKM Trojan?

Chris Caston caston at arach.net.au
Wed Dec 3 09:11:13 WST 2003


Hello,

I have just run chkrootkit (for the first time) and got a message saying
that I may have an LKM Trojan installed:

Checking 'lkm'... You have 	9 processes hidden for readdir command 

You have	9 process hidden for ps command
Warning possible LKM trojan installed.

Anyone know how to check for this?

I've just updated and started running ClamAV (clamscan --recursive)
from the root directory. I'll post back if it finds anything.

Oh and does LKM stand for Linux Kernel Module?

thanks,

Chris Caston




More information about the plug mailing list