chkrootkit 을 실행한 결과
Checking `lkm'... You have 3 process hidden
for readdir command
Warning: Possible LKM Trojan installed
LKM Trojan installed 라고 나옵니다.
아무래도 백도어가 설치된것 같은데..
찾아서 지워야하는데
아무리 찾으려구 해도 어디에 있는지 모르겠습니다.
LKM 이라는게 어떤건지 정확하게 모르겠습니다.
설명좀 해주시면
감사드리구요...
dmesg 를 출력한 결과가....
(da0:ahc0:0:0:0): Invalidating pack
(da0:ahc0:0:0:0): SCB 0x9 -
timed
out
>>>>>>>>>>>>>>>>>>
Dump Card State Begins
<<<<<<<<<<<<<<<<<
ahc0:
Dumping Card State while idle, at SEQADDR 0x8
Card was
paused
ACCUM = 0xe, SINDEX = 0x48, DINDEX = 0xe4, ARG_2 = 0x3
HCNT
= 0x0 SCBPTR = 0x1
SCSISIGI[0x0] ERROR[0x0] SCSIBUSL[0x0]
LASTPHASE[0x1]:(P_BUSFREE)
SCSISEQ[0x12]:(ENAUTOATNP|ENRSELI)
SBLKCTL[0xa]:(SELWIDE|SELBUSB)
SCSIRATE[0x0] SEQCTL[0x10]:(FASTMODE)
SEQ_FLAGS[0xc0]:(NO_CDB_SENT|NOT_IDENTIFIED)
SSTAT0[0x0]
SSTAT1[0x2]:(PHASECHG) SSTAT2[0x0] SSTAT3[0x0]
SIMODE0[0x8]:(ENSWRAP)
SIMODE1[0xa4]:(ENSCSIPERR|ENSCSIRST|ENSELTIMO)
SXFRCTL0[0x80]:(DFON)
DFCNTRL[0x0] DFSTATUS[0x89]:(FIFOEMP|HDONE|PRELOAD_AVAIL)
STACK: 0x0
0x16a 0x180 0x3
SCB count = 20
Kernel NEXTQSCB = 15
Card
NEXTQSCB = 15
QINFIFO entries:
Waiting Queue entries:
Disconnected Queue entries: 0:9
QOUTFIFO entries:
Sequencer
Free SCB List: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
23 24 25 26 27 28 29 30 31
Sequencer SCB Info:
0
SCB_CONTROL[0x66]:(DISCONNECTED|TAG_ENB|DISCENB) SCB_SCSIID[0x7]
SCB_LUN[0x0] SCB_TAG[0x9]
1 SCB_CONTROL[0x0]
SCB_SCSIID[0x7] SCB_LUN[0x0] SCB_TAG[0xff]
2 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
3 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
4 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
5 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
6 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
7 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
8 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
9 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
10 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
11 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
12 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
13 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
14 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
15 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
16 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
17 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
18 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
19 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
20 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
21 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
22 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
23 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
24 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
25 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
26 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
27 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
28 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
29 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
30 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
31 SCB_CONTROL[0x0]
SCB_SCSIID[0xff]:(TWIN_CHNLB|OID|TWIN_TID)
SCB_LUN[0xff]:(LID)
SCB_TAG[0xff]
Pending list:
9
SCB_CONTROL[0x62]:(TAG_ENB|DISCENB) SCB_SCSIID[0x7] SCB_LUN[0x0]
Kernel Free SCB list: 14 16 17 18 19 0 1 2 3 4 5 6 7 8 13 12 11 10
>>>>>>>>>>>>>>>>>
sg[0]
- Addr 0x2b3c000 : Length 4096
sg[1] - Addr 0x21e9d000 : Length
4096
sg[2] - Addr 0x2ff7e000 : Length 4096
sg[3] - Addr 0x124ff000
: Length 4096
(da0:ahc0:0:0:0): Queuing a BDR
SCB
(da0:ahc0:0:0:0): no longer in timeout, status =
34a
(da0:ahc0:0:0:0): Invalidating pack
위와 같습니다.
버퍼오버플로우가 아닌지 의심됩니다.
어떻게 해결해야 하는지요??
시스템을 다시 재설치 해야하는지?
궁금합니다.
다시 설치하지 않고 해결할수 있는 방법은 없는지요?
고수님들의 도움을 바랍니다.
