Re: [gentoo-user] Another chkrootkit false positive?

[Mick]

On 4 April 2011 22:59, Paul Hartman <paul.hartman+gentoo@×××××.com> wrote:

> If you're suspicious of your "ps" binary I would do "which ps" to be
> sure ps is the one you really expect. Maybe re-emerge procps to
> replace it, too.
>
>>  The tty of the following user process(es) were not found
>>  in /var/run/utmp !
>> ! RUID          PID TTY    CMD
>
> I do get this message (with my X process listed below it)
>
>> however, rkhunter shows:
>>
>> Heroin LKM                                          [ Not found ]
>>
>> Is this different to LKM Trojan mentioned above?
>
> I think LKM is just shorthand for "Loadable Kernel Module", not the
> name of any particular trojan.

Thanks Paul, I ran chkrootkit again manually this morning and none of
the previous warnings showed up.

The warnings were generated last time the cron job run chkrootkit.  I
think that the box was rather busy in the middle of emerging stuff at
the time, so I wonder if that had something to do with it.

I remerged procps just as a precaution.
-- 
Regards,
Mick