chkrootkit

[jackal]

I run this on a daily basis this morning I received this in the email.

Can someone explain to me what this is?


Checking `bindshell'... not infected
Checking `lkm'... You have 1 process hidden for readdir command
You have 1 process hidden for ps command
Warning: Possible LKM Trojan installed
Checking `rexedcs'... not found
Checking `sniffer'...

cPanel.net Support Ticket Number:

[Sash]

From www.chkrookit.org

How accurate is chkproc?

If you run chkproc on a server that runs lots of short time processes it could report some false positives. chkproc compares the ps output with the /proc contents. If processes are created/killed during this operation chkproc could point out these PIDs as suspicious.

NOTE: chkproc is the lkm checker.

Mike

cPanel.net Support Ticket Number: