Re: [SLE] chkroot claims top infected

On Sat, 31 Jan 2004, David Herman wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Sorry to keep replying to my own posts but I fear others may have lost 
> interest. Here's another update
> 
> On Saturday 31 January 2004 03:52 pm, David Herman wrote:
> > ran chkroot (chkrootkit-0.43, Sat Dec 27 2003) and it gave the 
> > results
> >       Checking `top'... INFECTED
> > and
> >       Checking `lkm'... You have 5 process hidden for ps command
> - ---------------snip---------------

You should definitely follow Gar's suggestion and post this on the
suse-security list as that may trigger a much more rapid response from the
people who would be most concerned with the potential problem.

Best regards, Alex.