From owner-freebsd-stable@FreeBSD.ORG  Sun Dec 24 02:36:00 2006
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
X-Original-To: freebsd-stable@freebsd.org
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 6867116A407
	for <freebsd-stable@freebsd.org>; Sun, 24 Dec 2006 02:36:00 +0000 (UTC)
	(envelope-from matthew.herzog@gmail.com)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.191])
	by mx1.freebsd.org (Postfix) with ESMTP id 0813E13C455
	for <freebsd-stable@freebsd.org>; Sun, 24 Dec 2006 02:35:59 +0000 (UTC)
	(envelope-from matthew.herzog@gmail.com)
Received: by nf-out-0910.google.com with SMTP id x37so3708708nfc
	for <freebsd-stable@freebsd.org>; Sat, 23 Dec 2006 18:35:59 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=qTnGw4IuSV0h+65q03pzYAx9opSSCE8jvSKLsWRvPYYuW3Uo853Cy3Ylkq/oOX0VardAzetJfMrVDH5G/WrUBybZDOt3qCUlbMMhtPNgtd40MR47OwiPWLmkWIEFZwjlNCSh8Zo5zoJPYy71L6yyLKbfQ8Y1bRJsLF3/smJDYXM=
Received: by 10.82.127.15 with SMTP id z15mr685559buc.1166927758875;
	Sat, 23 Dec 2006 18:35:58 -0800 (PST)
Received: by 10.82.190.9 with HTTP; Sat, 23 Dec 2006 18:35:58 -0800 (PST)
Message-ID: <7cf39bb60612231835y504ff65ah554dfb007fe3af5e@mail.gmail.com>
Date: Sat, 23 Dec 2006 21:35:58 -0500
From: "Matthew Herzog" <matthew.herzog@gmail.com>
To: "Edwin Groothuis" <edwin@mavetju.org>, 
	"Matthew Herzog" <matthew.herzog@gmail.com>, freebsd-stable@freebsd.org
In-Reply-To: <20061224014523.GB90165@k7.mavetju>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <7cf39bb60612231257p1a8a62c3g43a9da939306a59e@mail.gmail.com>
	<20061224014523.GB90165@k7.mavetju>
Cc: 
Subject: Re: chkrootkit finds 94 process hidden for readdir
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 24 Dec 2006 02:36:00 -0000

Yeah, I saw postings that refered to "time difference in ps and
processing /proc" but did not know
whether the postings could be trusted. I see no strange behavior on
the machine. I run chkrootkit about once a month just in case.

On 12/23/06, Edwin Groothuis <edwin@mavetju.org> wrote:
> On Sat, Dec 23, 2006 at 03:57:35PM -0500, Matthew Herzog wrote:
> > I run FreeBSD 6.1-RELEASE-p7 on an UltraSparc 5 machine.
> > I ran chkrootkit yesterday and saw this:
> > Checking `lkm'... You have    94 process hidden for readdir command
> > chkproc: Warning: Possible LKM Trojan installed
>
> I thought this was related to the time difference in "ps" and the
> processing of the /proc directory.
>
> Edwin
>
> --
> Edwin Groothuis      |            Personal website: http://www.mavetju.org
> edwin@mavetju.org    |          Weblog: http://weblog.barnet.com.au/edwin/
>