on "2-7-2003" "Craig Holmes" writ:
: On February 7, 2003 07:41 am, Rivanor P. Soares wrote:
: > Checking `lkm'... You have 69 process hidden for ps command
: > Warning: Possible LKM Trojan installed
: > Could this be *true* ? How can I discover it?
: If this is true, then your 'ps' binary has been replaced with one that filters
: certain processes from your viewing.
: The best, easiest method to determine if this is true,
... i created a directory, copied 'ps' et al to it, and used chattr on
them. having a known good binary outside $PATH is something of a comfort
...
--
... i'm a man, but i can change,
if i have to , i guess ...
