Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i ran chkroot, rkhunter, and nothing was revealed.

i ran unhide brute,

and it reveals a hidden PID

so i ps aux | grep ^PID

but nothing shows up.

i run unhide brute again, and theres nothing.

i run unhide brute again in a few seconds, and theres a new PID.

what should i do ? should i be concerned... ?

share|improve this question

2 Answers 2

Try using OSSEC rootcheck to test. It is better at detecting rootkits than these two tools. Link: http://www.ossec.net/rootcheck/

share|improve this answer

If this is unhide from http://www.security-projects.com/ 2009-08-10 (BETA), it isn't necessarily any foul play.

A quick look at the source-code of the brute-force-check, there seems to be a race-condition present.

What it looks like is that the brute-force scan will fork processes and try to touch the entire pid space, after it's done with all trying to touch all possible pids, it will then go through the entire list and for each pid it hasn't touched it'll run a ps against that pid and check if it exists. The problem is that there's plenty of time for a legitimate process to exit during the brute-fork scan or during ps'ing other holes in the brute-fork scan, and this will then be listed as hidden.

share|improve this answer
    
This race condition is a common cause of false positives in tools like chkrootkit. –  Zanchey Oct 28 '09 at 11:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.