HELP - Rootkit

[Fernando Gleiser]

On 20 May 2003, Guy Van Sanden wrote:

> I found some strange files in /stand namely -sh and [

They are perfectly normal. Don't worry about them.

> This got me somewhat suspicious, so I installed chkrootkit.
>
> It says:
> Checking `chfn'... INFECTED
> Checking `chsh'... INFECTED
> Checking `cron'... not infected
> Checking `date'... INFECTED
> Checking `ls'... INFECTED
> Checking `ps'... INFECTED
> Checking `lkm'... You have     9 process hidden for ps command
> Warning: Possible LKM Trojan installed
>
> Does this mean I got hacked?

Is it a 5.0 system? chkrootkit gives false positives in 5.0


			Fer