Re: suspicous activities...

[L0stm4n <lostman () gmail com>]

On Wed, 15 Sep 2004 10:22:31 +1000, hilton de meillon
<hiltond () hotpop com> wrote:

> (just for reference zzz.yyy.xxx.www is my ip and www.xxx.yyy.zzz is the mail
> server.)
>
> xyzhost:~# chkrootkit -q
>
> You have     2 process hidden for readdir command
> You have     2 process hidden for ps command
> Warning: Possible LKM Trojan installed
>   eth0 is not promisc

A mail server probably has alot of processes being created and
destroyed as well as directories. This is a common false positive for
chkrootkit on heavily loaded systems.