Re: LKM Trojan installed

> On February 7, 2003 07:41 am, Rivanor P. Soares wrote:
filters
> certain processes from your viewing.

    If it's an LKM trojan, they wouldn't show up in /proc, would they?

> notice extra PIDs (which you will quickly notice if you infact have 69
hidden
> processes), then you should enter their corresponding directories and
analize
> the information within, to see if the process is malicous.
one
> which isnt backdoored. Only problem with this is, once it is on your
how
> easily a kernel backdoor [LKM, kernel patch (hard or /dev/kmem)]could to
do.

    The theory on this is that you need to boot off a clean filesystem (cf. Knoppix), and then use the clean boot to analyse the filesystems on the compromised box. I don't know enough to help you with analysis, though.

    Thanks,

Tim Nelson
Systems Administrator
Sunet Internet

Tel:  +61 3 5241 1155
Fax: +61 3 5241 6187
Web: 
http://www.sunet.com.au/