Baslinux mailing list

[baslinux AT lists.ibiblio.org]

For the past week or so it has taken 4-5 attempts to connect to my ISP 
with my Lucent PCI linmodem.  LCP:  timeout sending Config-Requests. 
Connection terminated.  Sometimes I get messages about 7-bit and not being 
8-bit clean.  When I do connect, lynx downloads for a while at 50 
decreasing to 20 bytes/sec, then suddenly speeds up to the usual 2-3K/sec.

So I ran chkrootkit in BL2.  Download source code, unpackage, and if you 
are set up for compiling, 'make sense'.  It compiles but gives some error 
message about something missing.  I got a 'chkrootkit' anyway, which 
works.

I compiled busybox 1.3.2 to include netstat, which is required.
It produces the same output for me as the full netstat (in /bin - I may 
have got this from Slackware), and works with chkrootkit.  BL3 busybox 
does not include netstat.

chkrootkit also requires awk, which is not found in bl2 ramdisk or in BL3. 
BL2 awk is symlinked to /usr/bin/awk, symlinked to /usr/bin/gawk (150K). 
Busybox 1.3.2 has awk, which works with chkrootkit.  BL3 busybox 1.0.1 
does not.

Busybox 1.3.2 (and anything else later than 1.0.1 of BL3) needs kernel 2.4 
to work properly.

Perhaps Steven could compile a larger busybox 1.0.1 for optional use with 
ext2 BL3, including awk and netstat (maybe ALL of the possible commands, 
like the 'big' kernel).

I tried to run chkrootkit in BL2 ramdisk (from write-protected floppy 
disk, as recommended so it cannot be fiddled with by rootkit programs) and 
added netstat and awk to /bin, then it wanted 'echo' so I gave up.  BL3 
has echo.

chkrootkit can be run from the directory where it was compiled.
It is library-independent.  73K script.
http://keesan.freeshell.org/bl/chkrootkit
Add netstat and awk from Slackware.

chkrootkit told me the following:

basename, dirname, echo, env, passwd, traceroute were INFECTED.
(This is not true, busybox confused chkrootkit).

Possible RH-Sharpe's rootkit installed.

It searched for all sorts of rootkits and worms .... nothing found.
It warned me that .sc_history file size is zero.

Checking `lkm' .... You have 14 process hidden for ps command.
chkproc:  Warning:  Possible LKM Trojan installed.

I did some reading on LKM Trojan but did not understand much.
rootkits try to hide themselves by modifying ps so it does not show them.
Also ls and netstat.

I was supposed to compare md5sums but ps is part of busybox.   Hopefully 
rootkit designers don't bother with busybox ps or ls or netstat.

Why do I have 14 (or sometimes 12 or 15) hidden processes?

I then plugged in an external modem on com2 and it dials and connects 
immediately and downloads at normal speed. Apparently the internal modem 
takes a while to get warmed up and work properly.  The 1997 external modem 
cannot deal as well with our noisy phone line but I am okay if I don't try 
to listen to streaming audio.

Sindi

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org