Re: Possible LKM Trojan , Need Help - Thank You

2003-11-29 Thread Sebastian Kapfer
On Sat, 29 Nov 2003 21:10:14 +0100, Thomas H. George wrote: > I still must learn about the "/rr_moved" directory which blocks my > backups but this is a separate issue so I will post a separate question. man mkisofs, look for rr_moved in various capitalizations. -- Best Regards, | Hi! I'm a .s

Re: Possible LKM Trojan , Need Help - Thank You

2003-11-29 Thread Frank Gevaerts
On Sat, Nov 29, 2003 at 09:39:30AM -0500, Thomas H. George wrote: > > I still must learn about the "/rr_moved" directory which blocks my In case it helps : rr_moved is the name used for a special directory on iso9660 filesystems when using Rock Ridge extensions. IIRC it is needed because standard

Re: Possible LKM Trojan , Need Help - Thank You

2003-11-29 Thread Thomas H. George
On Sat, Nov 29, 2003 at 10:58:31AM -0500, Paul Morgan wrote: > On Sat, 29 Nov 2003 05:49:31 -0500, Thomas H. George wrote: > > > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. > > > > Before reformating the hard drive and reinstalling Debian, started a dvd > > backu

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Shaul Karl
On Sat, Nov 29, 2003 at 05:49:31AM -0500, Thomas H. George wrote: > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. > Are you aware to, for example, the section titled `Running chkrootkit' of http://www.wiggy.net/debian/developer-securing? I don't know the answe

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Hugo Vanwoerkom
Thomas H. George wrote: chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. Bug in chrootkit. Check Debian Bugs. Has been discussed here before. Before reformating the hard drive and reinstalling Debian, started a dvd backup using growisofs. The backup of /usr was succ

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Florian Ernst
Hello Thomas! On Sat, Nov 29, 2003 at 05:49:31AM -0500, Thomas H. George wrote: chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. Wow, hold on, first check chkrootkit -x lkm and see whether the report only contains PID 3-6. If so then it's only a bug, see http://bugs.deb

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Paul Morgan
On Sat, 29 Nov 2003 05:49:31 -0500, Thomas H. George wrote: > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. > > Before reformating the hard drive and reinstalling Debian, started a dvd > backup using growisofs. > The backup of /usr was successful, backup of /var fa

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Brian McGroarty
On Sat, Nov 29, 2003 at 05:49:31AM -0500, Thomas H. George wrote: > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. Do you have any other evidence of the LKM Trojan, beyond chkrootkit's output? I think you may just be looking at a bug that's not yet been worked out. N

Re: Possible LKM Trojan , Need Help

2003-11-29 Thread Jamin W. Collins
On Sat, Nov 29, 2003 at 05:49:31AM -0500, Thomas H. George wrote: > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps command. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=217278 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=219730 > Before reformating the hard drive and