From owner-FreeBSD-users-jp@jp.FreeBSD.org Wed Apr 14 02:04:34 2004
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id i3DH4Yg39576;
	Wed, 14 Apr 2004 02:04:34 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from ns.kobe1995.net (kaz@219.117.208.10.user.rb.il24.net [219.117.208.10])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with ESMTP/inet id i3DH4X939569
	for <FreeBSD-users-jp@jp.FreeBSD.org>; Wed, 14 Apr 2004 02:04:33 +0900 (JST)
	(envelope-from kaz@kobe1995.net)
Received: (from kaz@localhost)
	by ns.kobe1995.net (8.8.8/3.7W-primary) id CAA11180;
	Wed, 14 Apr 2004 02:04:32 +0900 (JST)
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-2022-jp
To: FreeBSD-users-jp@jp.FreeBSD.org
In-Reply-To: Your message of "Tue, 13 Apr 2004 18:08:45 +0900".
	<20040413180354.9FF2.ENDO_T@nifty.com>
From: kaz@kobe1995.net (NAKAMURA Kazushi)
X-Mailer: mnews [version 1.22PL6] 2002-07/03(Wed)
Message-ID: <040414020431.M0108706@ns.kobe1995.net>
Reply-To: FreeBSD-users-jp@jp.FreeBSD.org
Precedence: list
Date: Wed, 14 Apr 2004 02:04:31 +0900
X-Sequence: FreeBSD-users-jp 78924
Subject: [FreeBSD-users-jp 78924] Re: chkrootkit
Sender: owner-FreeBSD-users-jp@jp.FreeBSD.org
X-Originator: kaz@kobe1995.net
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+040413

$BCfB<OB;V!w?@8M$G$9!#(B

In article <20040413180354.9FF2.ENDO_T@nifty.com>
endo_t@nifty.com writes:
>Checking `lkm'... You have     5 process hidden for readdir command
>You have     5 process hidden for ps command
>Warning: Possible LKM Trojan installed
>
>$B$^$!!"$]$C$7$V$k$J$s$G!"$$$$$+$J$!!"$J$s$F;W$C$F$k$s$G$9$,!"(B
>$B$0$0$C$F$_$k$H!"(BBTS $B$,F0$$$F$k$H$+$J$s$H$+!#$^$!!"$?$$$F$$$O(B
>Linux $B$N5-;v$J$s$G$9$1$I!&!&!&(B

Possible$B$G$bNI$/$J$$$G$9!#(Bshell script$B$J$N$G!V8+$F!W$_$l$P(B
$BNI$$$G$9$,!"(Brootkit$B$rH/8+$7$F$b!"CGDjI=8=$OM>$j;H$o$:!"B?J,(B
$B$H$+$N[#Kf$JI=8=$r$9$k$h$&$K$J$C$F$$$^$9!#8m8!CN$N2DG=@-$,(B
$BM-$k$+$i$J$N$G$9$,!"%;%-%e%j%F%#4X78$NJ8=q$OBgDq$3$&$$$&I=8=(B
$B$r$9$k$N$,$*LsB+$G$9!#(B

>$B$3$NJU$N:G?7>pJs$r$"$s$^$jCN$i$J$$$N$G!"$4B8$8$NJ}!"%]%$%s%?(B
>$B$G$b$$$$$N$G$*65$(D:$1$^$;$s$+!)(B

$B$^$:$O(Bkldstat$B$G(Bkldmodule$B$N>uBV$r8+$F$_$^$7$g$&!#$=$l$>$l$N(B
kldmodule$B$d(Bkldstat$B%3%^%s%I<+?H$,2~cb$5$l$F$$$J$$$+3NG'$7$F(B
$B$_$^$7$g$&!#$H8@$C$F$b(Brootkit$B$KK\Ev$K?/F~$5$l$F$$$?$i!"3NG'(B
$B$9$k%3%^%s%I$d(Blog$B$b2~cb$5$l$F$$$kLu$G!"3NG'$OFq$7$$$N$G$9$,!#(B
$B$I$N%3%^%s%I$r<B9T$7$h$&$H$7$F$$$k$N$+3NG'$9$k0Y$K!"(Bwhich
$B$G3NG'$9$k$H$+!"A4$F$N%3%^%s%I$r@dBP(BPath$B$G;XDj$9$k$H$+$7$^$9!#(B
$B5$5Y$a$+$bCN$l$^$;$s$,!#(B

$B;d$NL5@UG$$J21B,$G$O!"(Blinux$B%(%_%e%l!<%?$d!"$=$N>e$GF0$/!"(B
linprocfs$B$d(Blinux$BMQ(BFlash$B%W%i%0%$%s$d$i(Blinux$B%9%l%C%I$J$s$+$N(B
$B%b%8%e!<%k$,F~$C$F$$$k$@$1$G$O$J$$$+$H;W$&$N$G$9$,!#(B
$B$A$J$_$K%&%A$O(Blinux$B%(%_%e%l!<%?F~$l$F$J$$$N$G!"(Bchkrootkit$B$O(B
nothing detected$B$HJs9p$7$F$/$l$F$^$9!#(B
-- 
$BCfB<OB;V!w?@8M(B		<mailto:kaz@kobe1995.net>
NAKAMURA Kazushi@KOBE	<http://kobe1995.net/>
- Break the hate chain. No more kill!
administrator@[127.1]
