Kernel-level rootkit or trojaned version of netstat.

IP-Burn3r · **Joined:** Fri Feb 06, 2009 4:39 pm **Posts:** 55

I received this warning in the Security Events how and what should I do to check if this is so?

Code:

Port `53239`(tcp) hidden. Kernel-level rootkit or trojaned version of netstat.

IP-Burn3r · **Joined:** Fri Feb 06, 2009 4:39 pm **Posts:** 55

I have since found the answer to my question --> http://www.mail-archive.com/ossec-list@googlegroups.com/msg02073.html

Now I have been trying to reproduce the error but I'm having no luck. I have ran the netstat command a few times but have never tried to replace the file, could a user of an ssh account be up to no good? That would not be hard to track down since there is only 1 user account open at this time.

Just like the link above said "Happy digging

" (LOL) where?

faris · **Joined:** Thu Dec 09, 2004 11:19 am **Posts:** 1845

At this stage I expect it is more likely to be a false positive than anything else.

Have you run rkhunter and chkrootkit to see if they can find anything? (warning: you may see false positives from them too, especially with the signatures of certain binaries including netstat).

Kernel-level rootkit or trojaned version of netstat.

Who is online