Skip to Content.
Sympa Menu

baslinux - [BL] process hidden for ps command

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: baslinux AT lists.ibiblio.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: [BL] process hidden for ps command
  • Date: Fri, 15 Feb 2008 15:46:40 +0000 (UTC)

For the past week or so it has taken 4-5 attempts to connect to my ISP with my Lucent PCI linmodem. LCP: timeout sending Config-Requests. Connection terminated. Sometimes I get messages about 7-bit and not being 8-bit clean. When I do connect, lynx downloads for a while at 50 decreasing to 20 bytes/sec, then suddenly speeds up to the usual 2-3K/sec.

So I ran chkrootkit in BL2. Download source code, unpackage, and if you are set up for compiling, 'make sense'. It compiles but gives some error message about something missing. I got a 'chkrootkit' anyway, which works.

I compiled busybox 1.3.2 to include netstat, which is required.
It produces the same output for me as the full netstat (in /bin - I may have got this from Slackware), and works with chkrootkit. BL3 busybox does not include netstat.

chkrootkit also requires awk, which is not found in bl2 ramdisk or in BL3. BL2 awk is symlinked to /usr/bin/awk, symlinked to /usr/bin/gawk (150K). Busybox 1.3.2 has awk, which works with chkrootkit. BL3 busybox 1.0.1 does not.

Busybox 1.3.2 (and anything else later than 1.0.1 of BL3) needs kernel 2.4 to work properly.

Perhaps Steven could compile a larger busybox 1.0.1 for optional use with ext2 BL3, including awk and netstat (maybe ALL of the possible commands, like the 'big' kernel).

I tried to run chkrootkit in BL2 ramdisk (from write-protected floppy disk, as recommended so it cannot be fiddled with by rootkit programs) and added netstat and awk to /bin, then it wanted 'echo' so I gave up. BL3 has echo.

chkrootkit can be run from the directory where it was compiled.
It is library-independent. 73K script.
http://keesan.freeshell.org/bl/chkrootkit
Add netstat and awk from Slackware.

chkrootkit told me the following:

basename, dirname, echo, env, passwd, traceroute were INFECTED.
(This is not true, busybox confused chkrootkit).

Possible RH-Sharpe's rootkit installed.

It searched for all sorts of rootkits and worms .... nothing found.
It warned me that .sc_history file size is zero.

Checking `lkm' .... You have 14 process hidden for ps command.
chkproc: Warning: Possible LKM Trojan installed.

I did some reading on LKM Trojan but did not understand much.
rootkits try to hide themselves by modifying ps so it does not show them.
Also ls and netstat.

I was supposed to compare md5sums but ps is part of busybox. Hopefully rootkit designers don't bother with busybox ps or ls or netstat.

Why do I have 14 (or sometimes 12 or 15) hidden processes?

I then plugged in an external modem on com2 and it dials and connects immediately and downloads at normal speed. Apparently the internal modem takes a while to get warmed up and work properly. The 1997 external modem cannot deal as well with our noisy phone line but I am okay if I don't try to listen to streaming audio.

Sindi

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org



  • [BL] process hidden for ps command, baslinux, 02/15/2008

Archive powered by MHonArc 2.6.24.

Top of Page