chkrootkit - The "chkproc: Warning: Possible LKM Trojan installed ...

unix.stackexchange.com/questions/162859/the-chkproc-warning-possible-lkm-trojan-installed-appears-and-disappears
I have chkrootkit version 0.49 installed on Debian 6.5. When I run sudo chkrootkit, I keep getting variable warnings about the LKM trojan, when I run the command repeatedly. First run Checking `...

chkrootkit scanner detected possible KLM Trojan - Ask Ubuntu

askubuntu.com/questions/587872/chkrootkit-scanner-detected-possible-klm-trojan
You will see the message any time the lkm check reports hidden processes inaccessible by the readdir command. If you have something like ClamAV, MySQL, Exim or MailScanner running you are bound to see this warning. ... not in ps output You have 1 process hidden for readdir command You have 1 process hidden for ps command Note, that this also ...

Debian - Warning: Possible LKM Trojan installed - Server Fault

serverfault.com/questions/702278/debian-warning-possible-lkm-trojan-installed
As you can see: the before is the same (ps aux has one first line for columns that ls /proc/* doesn't). So before, we have 218 processes. After, we have still 218 but only 215 (216 - 1) processes in ps. And I get the alert: You have 3 process hidden for ps command, so exactly the difference between /proc/ and ps. What were those processes?

问 chkrootkit扫描器检测到可能的KLM特洛伊木马 - 腾讯云

cloud.tencent.com/developer/ask/sof/117052671
今天，我使用chkrootkit工具扫描了机器，运行如下：sudo chkrootkit这是一些输出：检查"`lkm"..。 2进程隐藏在readdir命令中，两个进程隐藏在ps命令chkproc:警告:可能已安装LKM特洛伊木马: chkdirs:无检测到这有什么好担心的吗？如果是的话，我又如何补救呢？我正在运行Ubuntu14.10和chkrootkit版本0.49。

chkproc: Warning: Possible LKM Trojan installed - ConfigServer ...

forum.configserver.com/viewtopic.php?t=11240
I have received a few emails over the past few weeks similar to the following content. Can someone tell me if this is a serious issue and what I can do to fix it.

LinuxQuestions.org - possible LKM trojan installed?

www.linuxquestions.org/questions/linux-security-4/possible-lkm-trojan-installed-273943-print/
Likely just short lived processes spawned during the compile that die quickly. The hidden process check performed by chkrootkit just compares the output of ps to the processes listed in proc, so if the process dies before the second check is performed, then it looks like a hidden process to chkrootkit and results in a false positive.

LinuxHostingSupport » INFECTED (PORTS: 465) + LKM Trojan installed

linuxhostingsupport.net/blog/infected-ports-465-possible-lkm-trojan-installed
The port 465 belogs to SMTPS service and if not in use, you can block it using iptables to avoid the false alarm. Regarding "chkproc: Warning: Possible LKM Trojan installed", it is generated when a process is killed and initiated when chkrootkit is running. Normally, you see whether they were php, perl or someother processes.

Warning: Possible LKM Trojan installed - Linode

www.linode.com/community/questions/1527/warning-possible-lkm-trojan-installed
You can mention users to notify them: @username. You can use Markdown to format your question. For more examples see the Markdown Cheatsheet. > I'm a blockquote. I'm a blockquote. [I'm a link] (https://www.google.com) I'm a link **I am bold** I am bold *I am italicized* I am italicized

Chkrootkit - Possible LKM Trojan infection - Arch Linux Forums

bbs.archlinux.org/viewtopic.php?id=115149
result. I restarted X and have run the program repeatedly. I have not recived that warning again. An NMap gives the usual results and rkhunter comes back fine aside from the common Arch false-postives. Based on some Googling it seems likely that the warning was caused by a short-lived process running then and there as it where.

chkproc: Warning: Possible LKM Trojan installed

www.techtalkz.com/threads/chkproc-warning-possible-lkm-trojan-installed.73852/
chkrootkit says I have a possible lkm trojan. What is this. How do I verify it and how do I get rid of it? ... oldcomputer@ubuntu:~$ sudo chkroot Password: sudo: chkroot: command not found oldcomputer@ubuntu:~$ sudo chkrootkit ROOTDIR is `/' Checking `amd'... not found Checking `basename'... not infected Checking `biff'... not found Checking ...
Feedback