[cobalt-security] chkrootkit keeps complaining about hidden processes

["Jelmer Jellema" <cobalt@xxxxxxxxxxxxxxx>]

Hi all you helpful lot,

Once in a while I get messages from chkrootkit mentioning:

You have     5 process hidden for readdir command
You have     5 process hidden for ps command
Warning: Possible LKM Trojan installed

where the number of processes differ. When I rerun the command myself, it
usualy finds nothing at all.

My guess: these are <defunct> cgi processes. Or should I worry. One in a
while it gets too much and I reboot. This sort of quiets down these
messages.

Is my guess right?

Jelmer
-----------------------------------------------------------------
  Jelmer Jellema - Spin in het Web
  www.spininhetweb.nl
  Spin in het Web: Alle Touwtjes In Handen
-----------------------------------------------------------------

Spin in het Web is de producent van:
www.visinhetnet.nl: Niet Het Laatste Nieuws