Avisos en rootkit log

Luisinho · Apr 17th 2013

Hola foro, buenos días!!

Revisando un poco el panel de servidor, he visto los siguientes avisos en el Rootkit Log

Quote

Checking `bindshell'... INFECTED (PORTS: 465)
Checking `lkm'... You have 5 process hidden for readdir command
You have 5 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

¿me tengo que preocupar? acabado de estrenar como quien dice el servidor ¿es normal tener estos avisos?

Muchas gracias, Luisinho.

**kurgans** · Apr 17th 2013

Por lo general eso son falsos positivos, en funcion de la distribucion dara unos u otros, pero para asegurarte de que no sea nada mira que procesos estan ocultos por la consola

Luisinho · Apr 17th 2013

Gracias Kurgans, siempre estás ahí

Parece que no hay nada raro

ps aux

Code

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 24144 1024 ? Ss Apr02 0:04 init
root 2 0.0 0.0 0 0 ? S Apr02 0:00 [kthreadd/23052]
root 3 0.0 0.0 0 0 ? S Apr02 0:00 [khelper/23052]
root 106 0.0 0.0 17180 256 ? S Apr02 0:00 upstart-udev-bridge --daemon
102 125 0.0 0.0 23764 588 ? Ss Apr02 0:00 dbus-daemon --system --fork --activation=upstart
root 128 0.0 0.0 21284 356 ? Ss Apr02 0:00 /sbin/udevd --daemon
root 170 0.0 0.0 21280 208 ? S Apr02 0:00 /sbin/udevd --daemon
root 171 0.0 0.0 21280 208 ? S Apr02 0:00 /sbin/udevd --daemon
root 266 0.0 0.0 15136 192 ? S Apr02 0:00 upstart-socket-bridge --daemon
root 427 0.0 0.0 49904 724 ? Ss Apr02 0:13 /usr/sbin/sshd -D
daemon 493 0.0 0.0 16856 208 ? Ss Apr02 0:00 atd
root 494 0.0 0.0 19060 512 ? Ss Apr02 0:14 cron
root 495 0.0 0.0 15928 360 ? Ss Apr02 0:56 /usr/sbin/irqbalance
root 505 0.0 0.0 4276 284 ? Ss Apr02 0:00 acpid -c /etc/acpi/events -s /var/run/acpid.socket
root 534 0.0 0.0 26728 180 ? S Apr02 0:00 supervising syslog-ng
root 537 0.0 1.5 106640 16708 ? Ss Apr02 1:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid
www-data 1729 0.0 1.0 908268 10900 ? Sl 03:38 0:08 /usr/sbin/apache2 -k start
www-data 1730 0.0 1.0 908444 11104 ? Sl 03:38 0:09 /usr/sbin/apache2 -k start
vmail 4382 0.0 0.1 22352 1448 ? S 07:33 0:00 /usr/lib/gamin/gam_server
root 5815 0.0 0.3 73448 3544 ? Ss 09:48 0:00 sshd: root@notty
root 5971 0.0 0.0 12860 1004 ? Ss 09:49 0:00 /usr/lib/openssh/sftp-server
www-data 6860 0.0 0.8 906036 8420 ? Sl 10:33 0:02 /usr/sbin/apache2 -k start
vu2011 7531 0.0 1.5 283268 16028 ? S 11:34 0:02 /usr/bin/php5-cgi
postfix 7618 0.0 0.1 27128 1492 ? S 11:44 0:00 pickup -l -t fifo -u -c
root 7815 0.0 0.5 26972 5644 ? S 12:00 0:00 /usr/bin/perl /var/www/imscp/engine/imscp-apache-logger
vmail 7862 0.0 0.1 21420 1228 ? S 12:05 0:00 /usr/bin/imapd /var/mail/virtual/nippon-tour.com/blogs
vmail 7882 0.0 0.1 21420 1228 ? S 12:05 0:00 /usr/bin/imapd /var/mail/virtual/x3mdesign.com/blogs
vmail 7883 0.0 0.1 21420 1244 ? S 12:05 0:00 /usr/bin/imapd /var/mail/virtual/x3mdesign.com/ljlorente
vu2011 7923 0.0 1.5 283080 15824 ? S 12:11 0:00 /usr/bin/php5-cgi
vu2007 7933 0.1 1.5 283312 16072 ? S 12:13 0:00 /usr/bin/php5-cgi
vu2013 7973 0.0 1.5 284408 16768 ? S 12:17 0:00 /usr/bin/php5-cgi
vu2004 7978 0.0 1.5 283112 15860 ? S 12:19 0:00 /usr/bin/php5-cgi
vu2004 7983 0.0 1.3 280244 14132 ? S 12:21 0:00 /usr/bin/php5-cgi
root 7985 0.0 0.3 73316 3468 ? Ss 12:22 0:00 sshd: root@pts/0
root 8134 0.1 0.4 22088 4596 pts/0 Ss 12:22 0:00 -bash
postfix 8156 0.0 0.4 62232 5236 ? S 12:22 0:00 smtpd -n smtp -t inet -u -c -o stress=
postfix 8157 0.0 0.1 27128 1524 ? S 12:22 0:00 anvil -l -t unix -u -c
vmail 8160 0.0 0.1 21420 1228 ? S 12:22 0:00 /usr/bin/imapd /var/mail/virtual/nippon-tour.com/blogs
vmail 8161 0.0 0.1 21420 1228 ? S 12:22 0:00 /usr/bin/imapd /var/mail/virtual/x3mdesign.com/blogs
vmail 8162 0.0 0.1 21420 1232 ? S 12:22 0:00 /usr/bin/imapd /var/mail/virtual/x3mdesign.com/ljlorente
vu2007 8163 0.0 1.4 282616 14980 ? S 12:23 0:00 /usr/bin/php5-cgi
vu2004 8165 0.0 1.4 282816 14724 ? S 12:23 0:00 /usr/bin/php5-cgi
vu2011 8168 0.0 1.3 280640 14556 ? S 12:23 0:00 /usr/bin/php5-cgi
vu2004 8170 0.0 1.4 283336 15260 ? S 12:23 0:00 /usr/bin/php5-cgi
vu2008 8175 0.6 1.2 279084 12896 ? S 12:25 0:00 /usr/bin/php5-cgi
root 8178 0.0 0.1 16836 1192 pts/0 R+ 12:25 0:00 ps aux
root 13468 0.0 0.0 4260 372 ? S Apr02 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/authdaemon/pid -start /usr/lib/courier/courier-authlib/authdaemond
root 13469 0.0 0.0 23176 668 ? S Apr02 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 13471 0.0 0.1 32416 1584 ? S Apr02 0:09 /usr/lib/courier/courier-authlib/authdaemond
root 13472 0.0 0.0 31624 880 ? S Apr02 0:08 /usr/lib/courier/courier-authlib/authdaemond
root 13473 0.0 0.1 32420 1628 ? S Apr02 0:09 /usr/lib/courier/courier-authlib/authdaemond
root 13474 0.0 0.0 31624 880 ? S Apr02 0:08 /usr/lib/courier/courier-authlib/authdaemond
root 13475 0.0 0.1 32040 1296 ? S Apr02 0:08 /usr/lib/courier/courier-authlib/authdaemond
root 13479 0.0 0.0 4260 428 ? S Apr02 0:02 /usr/sbin/courierlogger -pid=/var/run/courier/pop3d.pid -start -name=pop3d /usr/sbin/couriertcpd -maxprocs=40 -maxperip=
root 13480 0.0 0.0 8464 632 ? S Apr02 0:04 /usr/sbin/couriertcpd -maxprocs=40 -maxperip=4 -nodnslookup -noidentlookup -address=0 110 /usr/lib/courier/courier/couri
root 13485 0.0 0.0 4260 428 ? S Apr02 0:01 /usr/sbin/courierlogger -pid=/var/run/courier/imapd.pid -start -name=imapd /usr/sbin/couriertcpd -address=0 -maxprocs=40
root 13486 0.0 0.0 8464 628 ? S Apr02 0:02 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -nodnslookup -noidentlookup 143 /usr/lib/courier/courier/imap
root 13497 0.0 0.0 4260 428 ? S Apr02 0:00 /usr/sbin/courierlogger -pid=/var/run/courier/pop3d-ssl.pid -start -name=pop3d-ssl /usr/sbin/couriertcpd -address=0 -max
root 13498 0.0 0.0 8464 628 ? S Apr02 0:01 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=4 -nodnslookup -noidentlookup 995 /usr/bin/couriertls -server -t
root 13602 0.0 0.0 4252 464 ? S Apr02 0:00 /var/www/imscp/daemon/imscp_daemon -p /var/run/imscp_daemon.pid
mysql 17122 0.4 5.7 920236 60436 ? Ssl Apr03 81:11 /usr/sbin/mysqld
bind 17749 0.0 1.4 186652 15028 ? Ssl Apr08 4:10 /usr/sbin/named -u bind
root 17920 0.0 0.1 25064 1448 ? Ss Apr08 0:27 /usr/lib/postfix/master
postfix 17924 0.0 0.1 27644 2016 ? S Apr08 0:11 qmgr -l -t fifo -u
postfix 17931 0.0 0.2 37796 2136 ? S Apr08 0:01 tlsmgr -l -t unix -u -c
polw 20467 0.0 0.6 55472 6672 ? S Apr03 0:21 policyd-weight (child)
root 21651 0.0 0.4 99828 4964 ? Ss Apr16 0:11 /usr/sbin/apache2 -k start
root 21653 0.0 0.2 26580 2728 ? S Apr16 0:01 /usr/bin/perl /var/www/imscp/engine/imscp-apache-logger -t error
www-data 21655 0.0 0.1 97888 1728 ? S Apr16 0:00 /usr/sbin/apache2 -k start
www-data 21656 0.0 0.1 99048 2072 ? S Apr16 0:07 /usr/sbin/apache2 -k start
polw 25125 0.0 0.6 55472 6612 ? S Apr03 0:22 policyd-weight (child)
nobody 29543 0.0 0.0 115088 740 ? Ss Apr06 1:04 proftpd: (accepting connections)
polw 31095 0.0 0.2 55076 2100 ? Ss Apr02 0:08 policyd-weight (master)
polw 31096 0.0 0.2 55208 2188 ? Ss Apr02 0:08 policyd-weight (cache)
postgrey 31304 0.0 0.5 68308 5676 ? Ss Apr02 0:03 /usr/sbin/postgrey --pidfile=/var/run/postgrey.pid --daemonize --inet=10023

Display More

Avisos en rootkit log

Share

Daily visitors