Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Linux
[Top] [All Lists]

rooted ?

Subject: rooted ?
Date: 9 Sep 2004 12:21:36 -0000


Sorry if this is not the correct forum,

Curious a day or so after a up2date on a fedora 2 system, I noticed very 
sluggish behavior. After checking obvious things such as netstat, du, nmaping 
it from another machine and checking ps commands thoroughly I found nothing 
abnormal. I then moved onto running a few rootkit scanners, all showed cleaned 
(for what its worth of course), I used both the tarball and rpm chkrootkit and 
scanned my machine with both. 

The strange part is, is that the one ran from source showed everything to be 
ok, the rpm showed 23-35 hidden processes, possible LKM rootkit installed. now 
after running the cmd " /usr/lib/chkrootkit-0.43/chkproc -v" I found the 
processes within the /proc and checked the status/info on all. they were all 
sleeping process from application I run all the time (evolution, mozilla, 
nautilus ). I booted the machine in init3 and without X and I didnt have this 
problem. 

The machine normally boots in init5, now if I start X then the problem arises, 
now I dont know if this is the right forum, but I would not think that I am 
rooted (optimistically said) and this is some weird iissue from an update. 1 
more note all the hidden processes were  owned and ran under my user account. 
Any input from anyone would be great. and no I didnt get Tripwire installed or 
record a MD5sum record ooopps

anyway just a day or so ago I read somewhere there may be a latency time diff. 
between the threads that are running and the chrootkit detection thus causing 
the discrepancy?

<Prev in Thread] Current Thread [Next in Thread>