Gentoo Archives: gentoo-security

From:	Karl Hiramoto <karl@××××××××.org>
To:	gentoo-security@l.g.o
Cc:	whereislibertyandjustice@×××××××××.net
Subject:	Re: [gentoo-security] gmonstart / jvregisterclasses in tons of binaries with commands,malware?
Date:	Thu, 17 Dec 2009 06:17:08
Message-Id:	`4B29C90E.6060506@hiramoto.org`
In Reply to:	[gentoo-security] gmonstart / jvregisterclasses in tons of binaries with commands,malware? by whereislibertyandjustice@Safe-mail.net

1	On 12/17/09 03:06, whereislibertyandjustice@×××××××××.net wrote:
2	> In linux binaries, in any linux distro, I've discovered the same strings
3	> which I believe may be due to a virus or trojan.
4	>
5	> Yet, clamav, rkhunter, chkrootkit do not detect abnormalities.
6	>
7	> Whether I run 'strings' on the binary files or view with vim or gedit, here
8	> is what is always seen inside the binaries:
9	>
10	>
11	> __gmon_start__
12	> _Jv_RegisterClasses
13	>
14	> Followed by commands which differ within each binary.
15	>
16	Can you give an example of what commands you are talking about?
17
18	__gmon_start is part of a normal glibc
19	http://repo.or.cz/w/glibc.git/blob/HEAD:/csu/gmon-start.c#l60
20
21	Almost every gcc compiled dynamicly linked binary contains references to
22	_Jv_RegisterClasse.
23
24	--
25
26	--
27	Karl Hiramoto http://karl.hiramoto.org/