Comments on: M3rry Chr1stm4s, y0u ar3 0wn3d http://www.whirlycott.com/phil/2004/12/25/m3rry-chr1stm4s-y0u-ar3-0wn3d/ Philip Jacob's web page Tue, 13 Sep 2011 08:59:30 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: system5 http://www.whirlycott.com/phil/2004/12/25/m3rry-chr1stm4s-y0u-ar3-0wn3d/comment-page-1/#comment-129960 system5 Wed, 04 Feb 2009 03:50:16 +0000 http://www.whirlycott.com/phil/?p=29#comment-129960 I work in a datacenter and I was running chkrootkit on some Korean guy's RHEL web server, and I kept getting the same "Possible LKM trojan installed" message. Then I read your blog about the race condition in the code, so I typed in: /etc/init.d/httpd stop to stop Apache and then ran chkrootkit again and now the race condition was gone and the "Possible LKM trojan installed" message disappeared with it. Thanks! I work in a datacenter and I was running chkrootkit on some Korean guy’s RHEL web server, and I kept getting the same “Possible LKM trojan installed” message. Then I read your blog about the race condition in the code, so I typed in:

/etc/init.d/httpd stop

to stop Apache and then ran chkrootkit again and now the race condition was gone and the “Possible LKM trojan installed” message disappeared with it.

Thanks!

]]> By: Chris http://www.whirlycott.com/phil/2004/12/25/m3rry-chr1stm4s-y0u-ar3-0wn3d/comment-page-1/#comment-64764 Chris Sun, 30 Mar 2008 23:03:12 +0000 http://www.whirlycott.com/phil/?p=29#comment-64764 Thanks for the LKM post. I was speechless and did a google on it and found your explanation. Ran chkrootkit again and voila, no false positives. Thanks for the LKM post. I was speechless and did a google on it and found your explanation. Ran chkrootkit again and voila, no false positives.

]]>