?<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7226.0">
<TITLE>[plug] GAM SERVER - chkrootkit ?</TITLE>
</HEAD>
<BODY>
<DIV id=idOWAReplyText28974 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2><A
href="http://ww.chkrootkit.org">http://ww.chkrootkit.org</A> shows the latest
version as 0.46a - just a few versions behind...</FONT></DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Maybe it's an oversite
they've fixed?</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> plug-bounces@plug.org.au on behalf of
Ranime<BR><B>Sent:</B> Fri 02-Dec-05 10:56 AM<BR><B>To:</B>
plug@plug.org.au<BR><B>Subject:</B> [plug] GAM SERVER - chkrootkit
?<BR></FONT><BR></DIV>
<DIV>
<P><FONT SIZE=2>Googled, read but not understood... I think I need help....<BR>
<BR>
Two Questions here :<BR>
<BR>
1. My Mandriva 10.2 (LE2005) and 2006 boxes have two instances of<BR>
'GAM SERVER' <BR>
KPM shows one for 'root' and one for the 'user' as sleeping.<BR>
trying to 'KILL' is not allowed and they they momentarily show as<BR>
'ZOMBIED' ?<BR>
<BR>
can someone please let me know what 'GAM SERVER' is used for on<BR>
Mandriva ?<BR>
<BR>
2. Both boxes when checked with 'chkrootkit' show<BR>
Find... INFECTED<BR>
<BR>
again, googling this appears that this may not be a hacked machine, but<BR>
a clash between an older chkrootkit 0.43 and the newer kernel<BR>
version.....?<BR>
can someone please confirm this please ,<BR>
has anyone got a solution if needed , or have seen this before ?<BR>
<BR>
The 10.2 box has been used for a long while but the 2006 box has only<BR>
just been created in the last week, the only net connection was for ftp<BR>
from mirror.pacific for updates<BR>
and the complete contents of 'main media' <BR>
no web or email etc have been used , and no servers should be running<BR>
and both machines are behind a nat enabled ADSL and swiched eth<BR>
connection.<BR>
<BR>
TIA for any useful advise.<BR>
--<BR>
>>>>>>>>>>>>>>>>>> <<<<<<<<<<<<<<<<<<<BR>
Regards.<BR>
Ranime.<BR>
<BR>
Linux Counter Registered User #302050<BR>
Mandriva 10.2 KDE 3.3<BR>
<BR>
sipphone : 17476016164<BR>
free world dialup : 630406<BR>
_______________________________________________<BR>
PLUG discussion list: plug@plug.org.au<BR>
<A HREF="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A><BR>
Committee e-mail: committee@plug.linux.org.au<BR></FONT></P></DIV>
</BODY>
</HTML>