Gentoo Archives: gentoo-security

From:	Ryan Voots <simcop2387@×××××.com>
To:	gentoo-security@l.g.o
Subject:	Re: [gentoo-security] gmonstart / jvregisterclasses in tons of binaries with commands,malware?
Date:	Thu, 17 Dec 2009 06:03:16
Message-Id:	`200912162349.30219.simcop2387@yahoo.com`
In Reply to:	[gentoo-security] gmonstart / jvregisterclasses in tons of binaries with commands,malware? by whereislibertyandjustice@Safe-mail.net

1	whereislibertyandjustice@×××××××××.net said:
2	> In linux binaries, in any linux distro, I've discovered the same strings
3	> which I believe may be due to a virus or trojan.
4	>
5	> Yet, clamav, rkhunter, chkrootkit do not detect abnormalities.
6	>
7	> Whether I run 'strings' on the binary files or view with vim or gedit, here
8	> is what is always seen inside the binaries:
9	>
10	>
11	> __gmon_start__
12	> _Jv_RegisterClasses
13
14	http://gcc.gnu.org/ml/gcc/2002-06/msg00112.html
15
16	This at least appears to answer the _Jv_RegisterClasses issue, (i haven't found anything about gmon_start). Essentially what appears to be going on is gcc is doing it, its intended, and i would guess more than likely related to gcj in some way.