[Cialug] rootkit bug?

[Dave J. Hala Jr.]

I really liked 7.2.... I miss it... <sniff> <sniff>

On Thu, 2005-03-10 at 16:57, timwilson011@mchsi.com wrote:
> Yeah, yeah, I know, I need to upgrade.  RH 7.2 is old, but it works!
> 
> On the plus side, once I changed the ps command back to "ps auxw", it found no
> problems.  Maybe RH 7.2 is too old for script kiddies to pay attention to. :-)
> 
> --
> Tim W.
> 
> 
> > timwilson011@mchsi.com wrote:
> > > I think there might be a problem in chkrootkit.  When it checks lkm, I get:
> > > ps: error: Thread display not implemented.
> > > 
> > > And then I get the syntax screen for ps.  I also noticed in the log posted 
> > later
> > > in this thread, it looks like lkm was skipped.  It says: "Checking `lkm'...
> > > Checking `rexedcs'... not found".  Notice there isn't a result for lkm before 
> > it
> > > starts checking rexedcs.
> > > 
> > > Looking at chkproc.c, it uses "ps mauxw", whereas chkrootkit 0.44 used "ps
> > > auxw".  Evidently procps-2.0.7-11 can't handle thread display.
> > > 
> > > --
> > > Tim W.
> > 
> > Tim... UPGRADE! :p
> > 
> > Tested it on my "old" Mandrake 9.2 system, seems to work just fine. It 
> > has procps-3.1.11-2mdk.
> > 
> > ...
> > Checking `lkm'... chkproc: nothing detected
> > Checking `rexedcs'... not found
> > ...
> > 
> > -dc
> > 
> > _______________________________________________
> > Cialug mailing list
> > Cialug@cialug.org
> > http://cialug.org/mailman/listinfo/cialug
> _______________________________________________
> Cialug mailing list
> Cialug@cialug.org
> http://cialug.org/mailman/listinfo/cialug
-- 

Open Source Information Systems (OSIS)
Dave J. Hala Jr. <dave@osis.us>
641.485.1606