[cobalt-security] chkrootkit LKM Detection?

["James Zawacki" <jzawacki@xxxxxxxxxxxxxx>]

Hello,  Just out of the blue, I've just started receiving these in my chkrootkit output some nights.  Other nights it doesn't show up.

<snip>
Checking `lkm'... You have     2 process hidden for readdir command
You have     2 process hidden for ps command
Warning: Possible LKM Trojan installed
Checking `rexedcs'... not found
Checking `sniffer'... eth0 is not promisc
</snip>

Now, from my research, it soulds like it's common under RedHat?  But, why did it just start happening, and why only on this box?  None of my other Raq4's are showing this.

Thanks,
James




---------------------------------------------------------------
http://www.customlynx.com - Low cost web authoring and hosting!
Get your FREE E-mail address or give them out! (culymail.com)