FreeBSD Version:FreeBSD 4.9-STABLE #2
Platform: x86
I recently ran chkrootkit and it complained about processes that were in
ps but not in /proc. Usually these are just transient processed but in
this case I investigated and found something weird.
Here's a sample output:
PID 11252: not in readdir output
PID 11253: not in readdir output
PID 11254: not in readdir output
Strangely, ls shows something different
[56] ls /proc | grep 1125
11252
Even more strangely, which processes are implicated moves around,
but they always claim to be running out of /etc/periodic,
e.g.
root11252 0.0 0.0 672 176 ?? I10Dec04 0:00.00 /bin/sh -
/usr/sbin/periodic security
root11253 0.0 0.0 648 168 ?? I10Dec04 0:00.00 /bin/sh -
/usr/sbin/periodic security
root11254 0.0 0.0 648 168 ?? I10Dec04 0:00.00 /bin/sh -
/etc/periodic/security/100.chksetuid
Note the old dates here: I've got a filesystem on a removable drive
that didn't detach cleanly and now some attempts to grovel through
the filesystem tables (e.g. df) hang badly. I can obviously reboot
to clear this error but I wondered if there was any more investigation
I should do before I destroy the "evidence".
Does this look familiar to anyone?
Thanks,
-Ekr
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
