Subject: Re: [Security-Discuss] Hidden Processes - msg#00001

On Tue, 03 Jun 2008 14:49:32 -0400, AAW
<AAW-yvxbkcIk1KXQT0dZR+AlfA@xxxxxxxxxxxxxxxx> wrote:

> /usr/lib64/chkrootkit/chkproc -v claims:
> You have You have 69 process hidden for ps command
> Should I be panicking?

Almost guaranteed to be a false alarm. I have 76.
As the processes are in /proc, you can see what they are ...

#!/bin/bash

for ProcessNum in `/usr/lib/chkrootkit/chkproc -v | grep "ps output" | awk
'{print $2}'`; do
if [ -f "/proc/${ProcessNum:0:4}/cmdline" ]; then
cat "/proc/${ProcessNum:0:4}/cmdline"
echo .
fi
done
# End of script

On my system, the above script shows that the processes belong to nscd,
console-kit-daemon,
pulseaudio, wish (running amsn), opera. If you remove the if statement, there
is one which
belongs to chkrootkit ifself, which is gone by time the script gets to the
point of trying
to show the cmdline.

Taking one of the process numbers, 8474, it indeed does not show up in "ps
-ax", yet it
does show up in htop, as a thread for opera.

A google search on 'chkrootkit "false positive"' will turn up lots of hits.

Regards, Dave Hodgins
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________