lkm trojan

nullpt · 12-24-2003, 12:24 PM

Hello guys,

In my periodic chkrootkit check i found this:

Checking `lkm'... You have 3 process hidden for readdir command
Warning: Possible LKM Trojan installed

I googled some and found information about this kind of trojan, its installed in the kernel and everything can be corrupted, binaries, etc..

Can anyone give some hints to check if im really infected and if I am how to remove it?

Thanks for your precious time.
Regards,

TIM

acid_kewpie · 12-24-2003, 01:09 PM

Please do not post the same thread in more than one forum. Picking the most relevant forum and posting it once there makes it easier for other members to help you and keeps the discussion all in one place.

http://www.linuxquestions.org/rules.php

Kilka · 12-24-2003, 08:24 PM

lsattr /sbin/init

Maybe that's it, but I don't know if it at all applies for LKM root kits.

-Kilka

nullpt · 12-25-2003, 12:09 AM

Hello,

I can't find any "lsattr" in my FreeBSD system!
But i went check on /sbin/init and it's listed on "ps" and it's at /proc , so no mismatch. I tried to check every proccess listed in ps at /proc but i got lost. Some script to check if the pid's listed in /proc are in "ps" would be somehow easier.
I don't really know what this lkm stuff is but i just know that i got 3 hidden process, so if anyone can help it would be really great!

Thanks Kilka