[clug] chkrootkit: LKM Trojan?

Andrew Pollock andrew-clug at andrew.net.au
Thu Apr 1 00:15:23 GMT 2004


On Tue, Mar 30, 2004 at 01:50:02AM +1000, Pearl Louis wrote:
> 
> Netstat could have been compromised though.
> nmap says that all ports are closed.

If you run something like AIDE as well as chkrootkit as part of your
security checking routine, you'll know if your netstat binary has been
compromised.

regards

Andrew


More information about the linux mailing list