Re: Possible LKM Trojan , Need Help

From: Hugo Vanwoerkom (hvw59601_at_care2.com)
Date: 11/29/03

  • Next message: hendrik_at_pooq.com: "Re: X won't start" 
    To: debian-user@lists.debian.org
Date: Sat, 29 Nov 2003 10:04:32 -0600

    Thomas H. George wrote:
    > chkrootkit reported possible LKM Trojan. 4 processes hidden for ps
    > command.
    >

    Bug in chrootkit. Check Debian Bugs. Has been discussed here before.

    > Before reformating the hard drive and reinstalling Debian, started a dvd
    > backup using growisofs.
    > The backup of /usr was successful, backup of /var failed with duplicate
    > names in /rr_moved.
    >
    > Obviously I would like to delete /rr_moved but it is hidden from me. Is
    > there any way to do this?
    >
    > In the mean time I am continuing the backup on the assumption that I
    > might retrieve specific files without reconatiminating the system.
    >
    > The backup of /home was successful with the warning "missing whole name
    > for 'rr_moved'"
    >
    > Tom
    >
    >
    > 

    -- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: hendrik_at_pooq.com: "Re: X won't start"