[ILUG] Bad EIP value due to compromise

[Justin Mason]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Conor Wynne writes:
> > You might be jumping to conclusions. try running "chkrootkit"
> > www.chkrootkit.org
> 
> As I wrote that, I decided to install and run chkrootkit on my own
> websever. It resulted in:
> 
> Checking `lkm'... You have     4 process hidden for readdir command
> You have     4 process hidden for ps command
> 
> Googling gives me others similarly confused. I am still running 2.6.4 on
> this particular box, as it refused to boot into 2.6.6 rpm upgraded
> kernel via apt. Dunno why. 
> 
> Now downgrading to kernel#2.4.22-1.2199.nptl and we shall see if she
> boots or not. 
> 
> Is this box really trojaned or what?

nah -- chkrootkit has a crappy race condition that causes this.
explanation:

    - uses readdir() on /proc
    - ...time passes...
    - compares with "ps" output
    - complains if they differ

depending on how much time passes in the second step, and if any
procs start/stop at that point, it may produce that warning.
not the cleverest.   anyway, that one seems safe unless it repeatedly
gives that warning.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFBK3gRQTcbUG5Y7woRAjx8AJ9wTCgF9RUbvuX0kBLPAK5aWzeAdwCdF1Iz
AX821IV91V/olQqkuqHFM9w=
=7RlR
-----END PGP SIGNATURE-----